Appalachian State University Replaces 20 Years of Banner Scripts with Bravura Security

The Challenge

Most of App State's provisioning and deprovisioning logic lived in custom Banner tables. Each ERP change touched identity, and each staff departure took institutional knowledge with it.

"Their core identity policy decisions, the provisioning and deprovisioning capabilities, were really nested deeply within their Banner environment," says Scott Weyandt, PhD, VP of Digital Identity and Security at Moran Technology Consulting. "That became more and more complex, more and more difficult to operate."

The process gaps were as real as the technical ones. Academic Affairs and Human Resources each onboarded employees their own way. Hundreds of generic and non-human accounts had accumulated with no clear owner. Faculty often held two or three positions, and static access rules could not keep up with nine-month contracts, affiliates, visiting staff, and student workers.

Matt McNaney, IT Manager for IAM at Appalachian State University, describes the legacy stack as a Jenga tower. "To try to add more features onto something to make it work, you're actually pulling out from the foundation of it, and it makes it more likely to fail."

Leadership change added risk. The first IAM manager left three months into Phase 1, and a new CIO arrived mid-program. The plan had to survive both. App State needed:

• One source of identity truth outside the ERP, so Banner changes stopped breaking access
• Shared onboarding and offboarding processes across Academic Affairs and HR
• Ownership for every account, including generic and non-human accounts
• A phased rollout that fit the academic calendar and survived leadership change

Solution

App State did not start with a tool. It started with an assessment. Moran Technology Consulting applied its IAM Assessment Framework, Reference Architecture, and Decision Matrix across governance, staffing, process, and technology. The result was a multi-year roadmap that doubled as the business case, and it carried the investment through when a new CIO arrived.

The assessment also funded structure. The university stood up a dedicated IAM unit, an identity governance and administration (IGA) committee, and a data governance committee, and named data stewards in each area. Academic Affairs and HR built one shared onboarding intake, the CISO's office took oversight of generic accounts, and a first purge of inactive accounts finished before any connector went live.

With requirements prioritized, App State selected Bravura Security through a formal RFP. "They weren't looking for the greatest tool that ever occurred," Weyandt says. "They were looking at the greatest tool that met their needs at App State."

1. Phase 1: Identity lifecycle, live December 20, 2024

Bravura Security deployed Bravura Identity as SaaS, pre-configured with the Bravura Higher Education Pattern and branded to the university. Nightly onboarding and offboarding, birthright provisioning to LDAP, Active Directory, and Google, affiliation-based roles with validity windows, and non-human account ownership went live together. A four-stage student model creates a Google account at application, email-only access at admission, and full access at enrollment, so hundreds of daily admits stage automatically.

2. Phase 2: Passwords and first login, live June 23, 2025

Bravura Pass delivered a unified password change platform across Active Directory, LDAP, Oracle, and Google, plus a first-time login flow with DUO MFA and security questions. Users gained self-service reset with email codes and one-time passcodes, the help desk gained assisted reset tools, and deactivation now revokes SSO and Google tokens.

3. Phase 3: Governance, underway

Access request and approval workflows, certification cycles, and program analytics are next.

"Bravura put me in contact directly with their engineers," says McNaney. "I've worked with many vendors and there was always a go-between. A lot of where we are has to do with the communication and openness with your team."

Timing mattered too. "You need to implement in a time and place in which students aren't readily accessing, and faculty and staff aren't trying to get online," McNaney says. "Make sure that you're in the valley of activity."

Outcome

One system now manages a user's entire access. Routine changes run nightly, urgent status changes apply within an hour, and a deactivated user loses SSO and Google sessions almost immediately.

Campus-Scale Coverage

Bravura Identity manages:

• 81,361 accounts, 38,634 active and 42,727 inactive
• 20,548 active students, 9,699 prospective students, and 7,902 student accounts in a transition or grace period
• 335 roles, 6,423 Active Directory groups, and 37 Google group memberships
• Password synchronization across Active Directory, LDAP, Google, and Oracle

This fall alone, App State onboarded 1,577 faculty, 2,369 staff, and 20,548 students through the platform.

Continuous Automation

From October 2025 to October 2026, Bravura Identity completed about 1.4 million automated lifecycle operations:

• 816,243 attribute updates
• 129,605 accounts created
• 153,109 group additions
• 61,404 organizational unit moves
• 56,397 account enables or disables

It also remediated 262,974 enforcement violations on its own. Each of those operations once meant a script someone had to maintain or a request someone had to work by hand. Now they run without a ticket.

Password Work Out of the Help Desk

Since June 2025, users have made 41,739 password changes, and only 3% needed support, a share McNaney says keeps falling. "For a vast majority of people, they got in the system, new UI or not, and they were able to get their way to changing their passwords across all the systems."

Help desk calls at the start of fall term doubled, from 503 to 1,081, as the campus met the new login, then fell as most access problems are now diagnosed inside Bravura Identity rather than routed to the LDAP, Active Directory, or Google owners.

Unplanned Wins

• Banner carries a privacy flag that Bravura Identity now writes to Google, so flagged individuals no longer appear in the campus address list. The control extends to applicants, admitted students, and non-human accounts.
• Automated service account password governance cut exposure from unmanaged credentials.
• Role-based assignments simplified audits, and Splunk logs show auditors who had access and when.

"The technology angle of this cannot be divorced from the interactions with the people who depend upon the system," McNaney says.

Next Steps

App State continues to expand the program with:

• Access request and approval workflows
• Certification cycles for role and group membership
• Program analytics for the IAM unit and governance committees

App State treats identity as a program, not a project, and keeps delivering. Both EDUCAUSE sessions are available on demand: IGA/IAM Straight Talk Success (February 2024) and From Complexity to Control (November 2025).