Higher Education IAM Discovery

Higher education has an identity problem no other sector has to solve at the same scale. A university of thirty thousand students may onboard eight thousand people and offboard seven thousand inside a two-week window, twice a year, every year. Nothing in banking, healthcare or manufacturing produces that shape of churn, and an identity model designed for a corporate joiner-mover-leaver process will not survive contact with it.

The harder problem is that one person is routinely several people at once. A graduate student may simultaneously be a teaching assistant with access to other students' grades, a research assistant working under a federally funded grant, a university employee with payroll records, and a patient at the campus health center. Each of those roles carries different data, under a different regulation, with a different lawful basis for access. Role conflict is not an exception to be cleaned up here — it is the normal state, and the requirements phase has to model it deliberately.

Then there is everyone who is not a student or a member of staff. Visiting scholars, emeritus faculty, contractors, volunteers, applicants, donors, parents with delegated access, summer program attendees, and alumni whose accounts frequently outlive their enrollment by decades. Add decentralized IT, where individual colleges and research groups run systems central IT does not control, plus federated access through InCommon and eduroam, and the estate is far wider than the student information system alone suggests.

When discovery takes 12 weeks, it typically lands mid-semester and misses the enrollment cycle it was meant to inform. ICA structures it in under 10 days, capturing the affiliation model, the multi-role cases and the departmental variation in one process — so the requirements document reflects how the institution actually works rather than how the org chart says it does.