From Complexity to Control

Appalachian State's Real-World IAM Rollout with Moran Technology Consulting & Bravura Security

EDUCAUSE Online Breakout Session with Moran Technology and Appalachian State University

Has your IAM project stalled at planning? Learn how Appalachian State actually pulled it off. In this session, we’ll walk through how Appalachian State University, guided by Moran Technology Consulting and powered by Bravura Security, tackled IAM modernization in a hybrid environment. They replaced legacy systems, rolled out self-service tools like password reset and DUO MFA, and reduced help desk tickets while tightening compliance. We’ll highlight key milestones from Phase 2, like first-time login, audit improvements, and operational wins across Banner, Google, DUO, and LDAP, and share lessons others can learn from the journey. Takeaways would include: -How to phase IAM rollout without major disruption -What integrations moved the needle -How self-service improved both UX and security -Where other schools can start (or restart).

Speakers:

Book a Complimentary Lunch and Learn

Claim By December 15th, 2025

Bravura Security and Moran Technology Consulting are hosting an exclusive session for universities, colleges, and community colleges.

Enjoy lunch on us while you explore how leading institutions are improving identity security and efficiency. This practical session will walk you through how to assess your current identity infrastructure, pinpoint areas of risk, and prioritize next steps for a stronger, more efficient security posture — no sales pitch, just insights.

Request a session before December 15th, and lunch is on us for you and your team! We'll arrange the call and provide a lunch gift card for your team.

Review the Full Session Transcript

No time to watch the session? No problem. Take a read through the session transcript.

John White

From Complexity to control, where we're going to hear from Appalachian State about their real-world identity and access management rollout, and how they worked with both Moran Technology and Breva Security to get there.

I'm gonna start real quick with an intro for the folks you'll be hearing from today. So we've got Mac McNaney, who's the IAM IT Manager for App State. We've got Scott Wayant, VP of Digital Identity Security at Moran, and myself, John White, VP of Customer Experience here at Bravura Security.

So we're gonna go ahead and jump right in. I'm gonna pass things over to Scott first, just to give everyone a bit of an introduction to App State's initial challenges, and how they at Moran helped App State get started on their journey. So, Scott, the floor is all yours.

Scott Weyandt (Moran)

00:48

Thanks, John. Sure. Good morning, everyone. Thanks for joining us.

So, like many other higher education institutions, when we first started working with App State about a few years ago now, they were struggling to both, maintain, support their current identity and access management, technology and services.

But there were also lots of challenges and pressure for them to extend their capabilities, right? There was technical debt, legacy systems with few resources that understood how they worked or were able to support

Or, modify them. Which created operational risk.

And like I said, just really incapacity to address the new needs and new requirements. I think over the last five years or so, we've seen not only a continued emphasis on the importance of identity as part of your

posture, you know, part of zero-trust architectures, but also an increasing focus, and really at an executive level, on the importance, of identity and access management to improving the user experience, which obviously is critical.

And so they were in a situation, one of another university in North Carolina, UNC Chapel Hill, the CIO there, Michael Barker, we ran a series of workshops together on identity awareness for executives, and I remember, he's put it perfectly, when he took over at Chapel Hill.

Similarly, as part of his listening tour, he walked campus, he heard from his peers, how is IT doing, and the people couldn't

speak to identity and access management. They hadn't heard what IAM was, but he said over and over again.

The identity and access management team, despite how smart they were.

despite how hard they worked, they were known as where projects go to die. So all of these critical needs and drivers across campus were logjammed, stuck.

with an identity and access management environment, that was just really difficult to support. Now, at App State, the specifics were really focused on ERP, and ERP change.

With a lot of migrations in the cloud, new RP solutions, ERP solutions for students, non-traditional academic programs, but in this case, at App State, it was really about their core identity policies decisions.

The provisioning and deprovisioning capabilities were really nested deeply within the banner environment, and that became more and more complex, more and more difficult to operate, and as I said, just really made it difficult to address the complex and growing needs at App State.

John White

03:42

Brilliant. I think that's a pretty good summary. Thanks, Scott. Maybe now you can talk a little bit more about the relationship directly between yourselves and AppState, and how, you know, Moran enters into the equation here from a practical perspective. Can you talk a bit about that?

Scott Weyandt (Moran)

03:55

Sure, John. Yeah, I think so many times, when I talk to, people, at conferences, right, they talk about, so where do we get started? How does the journey begin? What do we do first? And often, the default response is, we need a new tool.

Help me find what it is.

But so when we started working with App State, I mean, we started with an assessment.

And the assessment outcome, in part, is a roadmap.

And so the goal is to establish not just a one-year plan, but a multiple-year, multiple-phase plan, that is actionable and really tailored to that institution. So in this case, tailored to the needs of App State.

And that planning… Includes…

looking at IAM as a program, not just technology. And I think you're going to hear from Matt today, a lot of the successes that they've had at Upstate are about

how do you establish and maintain executive awareness about the importance of identity and access management? How do you establish campus collaboration and communication with the departments that you're going to have to work with? HR, student, etc. And then what org changes, whether they're operational.

Changes or staffing changes need to be made to support

the new program, the new program's goals, and any new technology

That might be, identified. And so in this case, we did the assessment, we helped build a multi-year roadmap, and I think you're gonna hear from Matt later that that roadmap has to be flexible. Things do change, right? But it gives you a place to start. And then we also help them walk through IAM platform evaluations.

looking at lots of different vendors. Not that we picked a vendor for them, but what we helped, App State do is define their functional and technical requirements.

Prioritize those requirements.

So that when they went out to select a tool, in this case, Reverse Security became their partner through an RFP process, they weren't looking for the greatest tool that ever occurred, but they were looking at the greatest tool that met their needs at App State. So, tailored selection.

the right tool for them. And that's, where, you know, the major part of our journey ended, by providing that roadmap and helping App State move to that next, step of making a selection, for a vendor partner and an identity tool.

John White

06:38

Amazing. Thanks, Scott. It sounds like you guys are a pretty pivotal part of getting things off on the right foot there. You're kind of introducing what's coming next for Matt here, but Matt, turning to you.

Maybe you could give everybody a bit of background of the preparation process from your perspective, from the outset, and some of the critical points to consider. I know Scott's already mentioned a few of these things, but it'd be good for everyone to hear from you, I think, on this.

Matt McNaney

07:03

Thank you, John, and good morning, everyone.

So, Scott hit upon this, that the tool really is just a portion of what your IAM

outlook and planning should be about. And when I entered this position that I currently have, I had years in tech, but I didn't have a lot of IAM knowledge, and so I had to reach out to a lot of different areas to learn about

How identity management should work, and in the end, this was a good thing, because Align Early is one of the first… first section on there.

As I had to go out and find contacts and people that I could speak to about the payroll process.

HR hirings, academic affairs, the rules that govern faculty access, and those kind of things. So, one of the first things I did was I reached out to these different areas and found somebody that I felt comfortable with talking to often, and bugged often about my questions.

And I made them part of the process.

the technology angle of this cannot be divorced from the interactions with the people who depend upon the system, so it is important.

That you reach out to everyone and make sure that they're involved. When you have that involvement, it eases transition, which we'll get into, but it makes it simpler when you have complications that you have to work through with them.

We had a project manager who was excellent, and I…

put this as one of the things that I think is very important, because there are a lot of small details, while Scott laid out a framework of how we should prepare,

the project manager really broke it up into bite-sized pieces, and so we were constantly moving forward in increments and getting to a final goal. It may seem overwhelming, and it certainly was when I first got started, but as we started finishing off small bits of that, it became more accessible.

The last part of that I'll line early is.

my learning of the different areas in which we are getting connected to. I had to learn about Active Directory, and LDAP, and Google Administration, and Duo administration, things which, in my prior position, I didn't have a lot of contact with. But again.

I was able to make relationships with those people who administrate those functions, and so I could bring those people, the technical people, together with the foundational people in the different areas, and we could all talk about that.

When you are going forward with this, you will have a structure, and people will…

expect there's going to be some change, and you should be ready for that. There's going to be good change, in that you have a centralized system that can

Make sure that everybody is who they say they are, and that they have the access that they're supposed to have.

But it is going to be a transition, especially if you have, as Scott mentioned, we have long-standing mechanisms and technologies for controlling this, and there are big changes made.

How you can spin this positively.

is…

you are able to make up, is moving a little bit to strength and foundation, make up for technical debt. You probably have a lot of systems that were…

Taped together in certain fashions to make things work.

You have an opportunity here. I might call it kind of like the fog of chaos.

of saying, look, we're implementing this very large system, and now is the opportunity, since we're going to be changing a lot of things, is we reassess how we are doing things in different areas. And through that.

We were able to…

have, one of the things that the project manager in Moran came up was like, we need to have IG, IAM governance. We need to just have these discussions with different areas about how we do things, because we're not writing everything down, and we need to do those kind of things. So, use this as an opportunity to

Reassess your technology, and also reassess how you do things on campus.

I have on there, find a balance between the interface and functionality.

Fortunately, with Bever, you know, any product you get is not going to be the perfect product.

And Bavara, as great as it is, is not the perfect product either.

But they have a flexibility, and this is something you should be sure to insist upon, flexibility for it to meet the expectation of your users. We worked very carefully with the help desk. They instantly pinpointed problem points with people who get into the system. They know these problem points best.

And the expectation of a user coming in, and the confusion level they're going to have.

We have flexibility with Brevura to adapt the system to meet the expectations of the users.

Build the structure, formalize identity governance, talked about that a little bit. I have everything that I do, I try to document openly. There should always be a link that you send somebody when they have a question about something. How do you have your role set up? Go to this document.

when do faculty have access before their first day that they sit in an office chair? Go to this document. You should document everything so that… well, and I have to admit, sometimes you're going to forget the things that you're… that you've done.

It's always best to have those documents open, and it's always very beneficial to speak in a language that is for the layman, that everybody can read that kind of thing.

And then finally, I talked a little bit about the technical deck. We had great success in interactions with Brevura and event logging. Anytime that you have, you want to check to see where you are in interactions with people, and if people have problems, and they contact the help desk.

Aurora has a very robust event log for everything that happens in the system, and we use a product called Splunk. It can be any kind of product, but we found it was very useful in pinpointing problems down the line.

John White

12:46

Brilliant. Fog of chaos, I love it, that's a good term. And yeah, stakeholder engagement, obviously key, right? So you had the help desk involved early, they're helping you identify pain points before that hit the user base, so…

Yeah, sounds like you really did the right thing there, and like most things, it sounds… or sorry, like with most things, I think preparation and planning, tends to be equally more important than just the tools and tech on its own, so…

Sounds good. From a scoping perspective, maybe at a really high level, before we dive deep into the outcomes and benefits, where we want to spend most of our time today, maybe you could give everyone a bit of a rundown on how you've approached the scoping and timelines from a project perspective for what you've done at App State so far.

Matt McNaney

13:30

Well, you know, the first… The fir- the first phase was, like, the…

having all of the, the identity profiles that were in our systems, the interactions from Banner ERP,

And how that…

trickles down into LDAP and Active Directory and those type of things. That was the first big effort, and there was an expectation when I got started. It was like, well, we plan on going ahead at this time.

As you get closer, you're just going to find… differences, problems.

That maybe the interactions with things don't work as expected, or maybe once you are starting to put… nail down certain rules of identity management, they don't…

sync exactly with what you're doing. So…

my advice would be is that you don't set definite timelines. You don't have a, we are going live on this date. You have kind of flexible suggestions of dates, and you try to hit milestones. Like, we kind of expect

This to work at this certain date, this to work at this certain date.

But we had a good relationship. We actually had a CIO that came on while this was going on. And, you know, that's always worrisome, because you don't know what kind of angle they're going to take, but when he came on, he was just like, yeah, sure, big project, yeah, dates, do it when you're comfortable.

And hopefully that's…

What you can communicate and what you can ask for them to expect is that let's have some flexibility, let's do this correctly when it rolls out, let's… because everybody wants the smallest amount of downtime as possible, so that flexibility is very important.

John White

15:13

Awesome. So you went into production, December of last year with your, with your foundation, with, with some of the basics that you talked about.

Moving on from there, what was the next release? I know you're working on something now, but I think the last one was sort of mid this year. What were some of the things you prioritized after building that successful foundation, and, you know, if there's any insight as to why you've prioritized those things?

Matt McNaney

15:39

Yeah, so for Phase 2 was, password authentication authorization administration.

And it was taking over, you know, a long-standing process.

But, and, again, you have that…

that UI debt that you're gonna have to pay, and which people are just not used to the system going in for the first time, especially if they've been using the same thing for decades, which we had.

But, we got great benefits out of this change.

we were able to… the Brevura system manages non-human accounts by the owner and not separate, so the person can sign in with their authorization and update their non-human account through Brevura itself.

It's a unified password platform change, so you change the password in one place, and it trickles down to all the different systems. If there's a problem with the password, you don't necessarily have to reach out to different constituents to try to get that corrected, so that's a great benefit.

And one of the largest benefits we had is more self-service options, and we added, like, we could do email code confirmation and one-time password. Someone can call the help desk, they can identity proof that person, they can give them a one-time password, and…

they can get in. Strangely enough, with the email code confirmation, we thought that was a great idea. We noticed there was a problem with our email, in which

Most people were using their university email address for their personal email. Well, that's problematic, not just in an identity level, but also, like, in an administrative, human resources level. Somebody

leaves, and you need to contact them about some important information, you can't email them at App State, so that revealed some problems in our system, so…

The last thing was the decommissioning of the single sign-on, the Google tokens. So, that was something that had to be done manually prior.

But with Vero, we had a session cancel, so when somebody is deactivated, or they're changing their passwords, it flushes their tokens, it flushes their sessions, and then they have to log back in.

Because we would have instances sometimes of people keeping active sessions over after they're deactivated, and responding to a post on a group that they were keeping open, and…

They had already been left, and they were reporting that person had left for certain reasons. So,

We got great benefits from that.

John White

18:09

Thanks. You definitely, you know, it sounds like there's a lot more visibility with the second phase, and, you know, with some of that comes benefits to the end user population, and like you say, some things sort of get unearthed that you probably never would have known about, so that's very interesting.

I think that's pretty good framing and context now for the rest of this presentation, so let's get into it.

Why don't we spend a bit of time on this slide? It's probably one of the biggest ones we've got, because we want to really focus down on this, but let's start with the outcomes and benefits that are really worth diving into here for App State, and for you, Matt, and maybe some of the examples that you can provide so the audience today can really connect the dots here between what we've put on the screen and, you know, what you guys experienced.

Matt McNaney

18:54

Yeah, and I'm gonna kind of paraphrase some of the stuff we have in here. You can expect your help desk tickets to ramp up when you first get started, because again, it's a new system.

But, with more self-service options, and a more…

a single kind of department to contact about access issues, whereas before you had different areas that had to be contacted. Is this an LDAP problem? Is this an Active Directory problem? Is something wrong with their Google account?

When you have a centralized system, you also have a centralized entity of people who know about these kind of things. So that reduces the footprint of people that have to be contacted, or who do you have to… for problems in identity management, with passwords, or access, or onboarding or offboarding.

More efficiency.

Let's see.

John White

19:46

Yeah, why don't we jump over to user and institutional value off the back of that. It kind of mirrors what you've done in terms of your phases. We've got operational efficiency for you guys.

Matt McNaney

19:56

Yeah.

John White

19:57

And then, you know, what the students and what the staff and everybody integrated gets out of it.

Matt McNaney

20:00

One of the things we got out of the student… when we were implementing this for the first time, we were trying to determine how we were going to add students, because…

In North Carolina, we are admitting students

based upon almost, like, I think it's high school GPA, they have kind of an added

A new process to admit people.

And it creates a lot of different accounts, and so there's a big package of users that have to be added per day. We're talking hundreds of people added per day.

And we determined that, you know, the permissions for that group vary depending upon how far they are in the enrollment process. So what we were able to do in Bravera is we created, like, a four-stage process in which we can create the Google account.

Which, takes more time than just manipulating a Google account.

So when they're an applicant, we create a Google account. When they're admitted, they have a email-only Google account, and then when they move on to confirmation and eventual enrollment, they gain more permissions as they move through the system.

So what was before just kind of like, well, they've… they've admitted, and then now they're a student, and…

things that we were doing manually. It just put everything, sectionalized it, categorized these different students, and made manipulation of their permissions through the systems more granulated.

John White

21:23

Sure, and that probably segues pretty nicely into the other section here on risk reduction. I know you had an anecdote about people still having access after deprovisioning. You know, along the same lines, was there anything else there that you want to highlight or share an example of that kind of connects.

Matt McNaney

21:39

I'm sure, yeah, and I'm sure if there's other universities here, you have the same problem, where you have multiple third-party systems, vendor systems, which may not

work on your SSO, in which you, like, oh, you have an account over on this system. Or when a staff member or a faculty member starts a certain position.

Another system has to be, you know, that person leaves.

Whoever's the administrator of that system needs to be contacted.

We are in Phase 3, and we're moving into that area, but eventually Barura will interact with some of our major cloud systems, and when you are onboarded, you get all the systems that you need for your job, and when you are off-boarded, you lose access to the systems.

that you have. So, risk reduction and audits, very important to help with that. And also, you have all of the event logs that you have. It's an interaction between

the system and the users that are using it. When they change their password, when they're accessing the system. If there's a change in permissioning or departments or whatever, we have logs of that, and we can track how people are moving through the system.

Which helps greatly with, when audit is asking about, there was a person who was supposed to leave, and then they… they have access right now. Can you tell me what happened? And we can. We can go through and look at their… their history through the system.

John White

23:01

Amazing. Yeah, super valuable.

And then maybe let's round it out. You know, you've got some points listed here for campus-wide impact. Maybe let's share something out of that section for the team here.

Matt McNaney

23:12

Yeah, the role department-based assignments, they, as I said, simplified audits,

the shared records, the fact that we work, it's more of an IAM effort now, and as I said, I reached out to all these different areas, and so I'm very comfortable with talking with different people about, I'm having a problem with this account, what can you tell me about

What's going on over here, working with payroll or human resources, in which we can have kind of a common language about discussing

well, why should they have access then, and why should this access be continued, and how do we standardize that, instead of just like, well, that's how we've always done it, which is something that you will probably hear a lot.

One big win was the privacy, the global address list in Google. We have certain individuals on campus, either through their position, or maybe just a student who doesn't want to be contacted.

Doesn't want their information to go out.

And one of the ways that some information can be shared is the Global Access List and Google.

Or addressless, sorry.

So, you know, you start typing their username, and it's like, let me autofill that for you. Well, we…

have a connection with Banner that has a privacy flag in it. It's communicated to Bravera, and it writes it up to Google so that they don't appear on that list.

And we also, once we did that, we were like, well, we can carry this further. Why just stop at private individuals?

Applicants and admitted don't need to be on the global address list. Non-human accounts don't need to be on the global access address list. So, we were able to take

A big problem, a big… Something that needed to be solved, and then apply it.

elsewhere, as well. And that just helps with, you know, you can start typing in things and

you don't get addresses that aren't related to the person you're looking for, right? You want to find THE John Smith that works in faculty, you don't want all of the John Smiths that are in the system.

John White

25:14

Yeah, super interesting. That's a… that's a, that's a good find.

All right, so I mean, obviously, there's a lot to be excited for at the finish line of an effort like this, or at least some of these intermediate checkpoints, we'll call them, as your program evolves.

Before I move on to the next slide, Scott, is there anything that you want to add along these lines, either that you saw at App State, or just in general, that would be useful for the people here today to hear?

Scott Weyandt (Moran)

25:41

Yeah, I mean, I would just like to say, I think this slide on outcomes and benefits and Matt's use cases and examples is really exciting, because if you look at the campus-wide impact, and Matt, you mentioned, so when we started the assessment, that was under a different CIO,

And so there was a CIO who was very passionate, had been working for years to, you know, address the issues with the current, identities environment, and got the assessment rolling.

And then a new CIO came on board, and the assessment and roadmap was also a business case, right? And so.

the CIO knew, the former CIO, that they had to justify the investment in new tools, in changes to the organization, and the fact that it can be seen as disruptive when you start going out to collaborate. And so, the outcome of the roadmap was actually a business case.

That the initial CIO, you know, signed off on, the new CIO took over.

signed up, was on board, excited about the project, and then was able to leverage that to go, peers and establish that executive awareness, and create an environment that said, hey, this is going to have campus-wide impact in a good way, right? And it's listening to the,

To those stakeholders, so that when you go to improve the student lifecycle policies, and you start saying, well, what does

An applicant need versus an institutional admin, versus a deposited student, versus a matriculated student, etc.

Right? That you have people that you can work with, and they understand, oh, this isn't something the security team is trying to lock down, or this isn't something that IT is trying to control, but this is a way of benefiting the students, and improving

that onboarding experience, while also reduce… reducing institutional risk. So I just think it's great to see that the outcomes that have already been achieved demonstrate that capacity for continuous improvement, right? And, yeah, so I… it's just really fantastic to hear all that's been achieved.

John White

27:54

Yeah, absolutely, agreed. It's always interesting to hear, you know, how these things actually roll out in the real world, so appreciate the anecdotes there, Matt.

So yeah, you've been through two pretty significant phases. Like we said, you're in the process of building towards even more coverage in your program at App State. But maybe we can spend just a couple minutes here on, you know, some of your lessons learned and some of the recommendations you really want to highlight for others about to start down on this path.

Matt McNaney

28:22

Yes, when you are trying to determine.

how your ERP is going to function with whatever system you get.

You… tend to put a more critical eye towards the way that that ERP is set up

And we discovered… many different…

I'm trying to put this in the nicest way possible.

that just the way that Banner is so large, that…

sometimes people do things to just get it to work. It's probably a nicer way I can put it. But, you know, that evolved through its… its initial implementation, which was decades ago.

It's definitely more…

ordered now, but when we started getting records and getting them to properly appear within Bavaro, work within Bavura, it unearthed gaps, as we said, and

You would see differences between when people started and

just in the same area. Why is this person starting earlier? Well, you know, they asked.

We need to establish rules, so you start putting down guardrails of… which, again, leads back to the audit thing.

You start writing down, documenting, standardizing.

a governance model for your identity across campus. How do you determine the person is who they say they are? We're starting… we're creating a standardization of identity proofing. You just… you see the gaps of both security and audit, and just how the data is set up.

Going through the other, the other points, we had, after Phase 1 was set up, we had great

success, and having onboarded 190 faculty, 511, 8,200 students since Phase 1, which is in December.

And it grows day by day. You… I do get calls about different people, but it's only, like, you know, a handful of people today. It doesn't match the tens of thousands of users that are in Bevera right now.

Again, although we ex… we…

Help Desk knew, and we knew, that help desk calls would go up. I think they have fallen since we can quickly… usually quickly resolve issues. So their time on the phone initially was ramped up as people were getting used to it.

But now we can just… people can identify problems they have, and typically within the system itself, the prefer a system.

We can fix them. We can assess and determine what the problem is without having to go out to different areas.

That final stat, since the June 20th, only 4% of the 14,620, and this… this was getting… the percentages shrinking day by day, of those people actually needed to call the help desk to get

get assistance on changing their password. So, for a vast majority of people, They got in the system.

new UI or not, and they were able to get their way to changing their passwords across all the systems, and not having to call back, be like, well, I changed my password, but my Oracle connection isn't working, or I changed my password and I can't get into my desktop. And when we discovered those, you know, we quickly made changes within either the system or

How we did things to meet those… weaknesses, so…

Yeah, there's gonna be problems, but it's also a time of growth.

John White

31:51

Yeah, I mean, your story about being able to solve those problems kind of reminds me of what you're saying about having a common language with, you know, payroll and all these other engaged stakeholders. It sounds like you've got a, you know, common understanding and some visibility and, you know, the ability to deal with these things now, so…

where a problem may have come in and taken you hours or days before, it sounds like everybody kind of knows what to look for, how to solve the problem, and you can kind of work through things faster. So, really interesting to hear.

Brilliant. Okay, well, I mean, we at Rivera Security really look forward to watching your identity program at App State continue to evolve, you know, and hearing about the benefits today, and just in general as you progress is really interesting for us. On a similar topic, I suppose, Matt, you've shared now how the project sort of started and unfolded so far, the results that you've got, which all sound fantastic that you've presented today.

But we thought it would be helpful to also to take a couple minutes here during the presentation to reflect together on the experience of working with a vendor, and what made that partnership work. So, not just the tech and the solutions, like we said at the outset of this presentation, but,

you know, how AppState and Brevura work together to deliver a successful project. So I guess I'll start with a question for you, and we'll kind of take it in that format for this, but what did you discover early on that really made collaboration between your team and ours click?

Matt McNaney

33:17

I, you know, Brevera put me in contact with one of their Directly with their engineers.

I've been through many, many different vendors, or worked with many different vendors, and there was always… I always kind of had a go-between.

Between somebody, like, well, what do you want to do? Okay, well, I'll go talk to the engineer. And then they come back, well, the engineer said this.

So I was kind of surprised in which…

They just said, well, why don't you just have meetings with our engineer and talk about your problems?

Which was extremely helpful, because…

you know, the system wasn't written for App State. It was written… every… any vendor program is written for a general capacity to do a job, and a university is very complex, and it doesn't really have kind of the same rules as a business do, you know, just

You're onboarded on your first day of work in a business, and when you leave, that's the end of your account.

Not so much in university. That's… you have to have more flexibility. Amber Vera was willing to meet that flexibility. Was…

willing to have me work with a vendor, I mean, sorry, with their engineer, so that we could kind of plan out how things were supposed to work. An engineer who was also open, and I'm gonna drop his name, Martin, because he's awesome.

kind of plot out things like, well, I suggest you try doing this, and that's, you know, and if… whether… if I argued that, then he would bring something else that we could try. And so we've gotten to a point of where we are, which I think is successful, and a lot of that has to do with the communication and openness, with your team.

John White

34:50

Yeah, so it sounds like, you know, Martin, in this case, happy to name-drop Martin as well, was really interested in sort of understanding your, you know, your own system and internals, and kind of learning how that worked and finding that common ground. So, makes perfect sense that that led to some good solutions there.

Obviously, during that process, and even outside of that, you know, challenges do come up. So, when those came up, how did you decide which adjustments were worth making and which weren't?

Matt McNaney

35:19

Again, this is the reach-out thing. Like, you reach out to, like, well, we're thinking about making this change.

With faculty access. Well, then you need to talk to Academic Affairs, and you need to say, what do you think about this? It will go very badly for UNIT if you try to make decisions without talking with people who work in those systems. It will go especially bad for you if you make decisions for faculty. Anybody who works for the university.

Knows what I'm talking about.

It's a… there's special… special considerations, and you have to make allowances for

how things work differently. Again, in a company, it's kind of straightforward about who is employed, and who's in the system, and who has access. We've got 3 different areas of people

Faculty, staff, and students, and each of them has different needs.

So you need to be able to speak to all the representatives of those three different components, and agree upon that. And then also contact with people who work with the technology, because you're…

ideas of how something should work in, say, Active Directory or Google or something, may not be appropriate. So you need to collaborate with them and come to an agreement, and then pull those people in with… again, we had a systems group, different people from different areas in IT,

And we met with that engineer, and we would hash out problems and find solutions.

So, yeah.

John White

36:51

the openness, I suppose, and finding that common ground, having that sort of buy-in on both sides, and then being able to kind of stand up to the business and offer something that solves a problem, but, you know, may have to be slightly different than how they envision it. But as long as it's not being forced on you, I suppose, then you guys can kind of come to a collaborative solution, it sounds like that was the name of the game.

Matt McNaney

37:10

Yeah.

John White

37:11

Yeah.

Matt McNaney

37:12

Definitely.

John White

37:12

Okay. And if you were advising another institution or somebody on this call today who's starting out, how would you suggest they think about timelines and targets with a vendor?

Matt McNaney

37:23

Again, I would… I would recommend that you kind of…

Say, we want this to do this by this date.

And set up multiple dates of progress.

With the understanding that not meeting a certain date might push all the other dates forward a little bit. There has to be flexibility, especially the older your system is prior to your implementation of your IAM platform.

We had decades of… of different systems working together. They worked very well. I will give… can't knock the way that they had things set up before.

But as things grow, as populations grow, and your user base begins to become unwieldy.

You're gonna finally… you're gonna have to come to a decision on this, and

It is best to, as I said, bring in as many people as you can.

I will say one thing, one quick thing, specifically with universities, is you're gonna notice that that Phase 1 implementation was 5 days before Christmas. There is a reason for that.

We… you… you need to implement in a time and place in which…

students aren't readily accessing, they're not admitting multiple students, hundreds of students at the same time, that faculty and staff aren't trying to get online. So, yeah, the accommodation of scheduling is very important in an education environment, making sure that you're in the valley of activity.

John White

38:50

Yeah, absolutely. It's not just… not just the user populations and those sort of intricacies that, you know, arise out of that, but, you know, schedules as well, like you said, is… everything's a little bit different, so having a vendor that understands that, which sounds like the team that was working with you definitely did, can help move things towards success.

All right, that's fantastic advice, Matt. I hope everybody's taking notes. App State's a great institution to work with, and we can't agree more.

Matt McNaney

39:14

Thank you.

John White

39:15

their approach here. That's… that's the end of, I guess, me grilling Matt on, his… his, his journey here at App State.

But on the topic of working with a vendor, you know, we at Rivera Security would love to invite everyone on the call today to connect with us and Moran after the session at a, you know, a time that's convenient for you, to let us help you get started on mapping your own path forward. And that could be with a lunch and learn, by downloading one of our white papers, or just setting up an informal chat.

App State's identity and access management journey began with the same sort of strategy session that we're offering in the Lunch and Learn.

which obviously you've heard about today, and that's turned into a, you know, a practical roadmap that turned their IAM modernization into something, you know, measurable, and, you know, we've sat and listened to really interesting anecdotes and stories and outcomes from Matt today, you know, that all came out of that sort of initial conversation, planning, and preparation.

You can download one of our relevant white papers. I think everybody gets access to this, so there are some links here you can click on, but, you know, the first is how to quickly close cybersecurity risks today and produce an identity strategy for the future. That one provides some step-by-step guidance for designing your institution's identity strategy.

And then there's another one, if you can make it out, that's called Choosing the Right Vendor Can Be a Game Changer, and that one just lays out some expert tips on selecting and sequencing your IAM and or privileged access management programs.

So, with that.

If there's any questions, yeah, we've got 5 minutes left in the session, so if anybody wants to drop anything in chat, we're happy to take questions. But I do want to take the opportunity to thank Matt for everything he shared today, and Scott for everything that he's added to the presentation as well.

Matt McNaney

41:06

You're welcome. And if anyone wants to email me, I originally reached out to the University of Oregon, who also have a Bevera implementation, and they were very helpful, and I would like to pass that on. And I can also talk more about the tech angle, because Moran had us… initially, we, like, simplified our Active Directory, and we have a certain

kind of ERP extract, and I just didn't want to bog down too much time with that, but I'd be happy to discuss that with anybody if you want to contact me.

John White

41:31

Yeah, we've… we took a lot of time to make sure that we could fit into our window today, so Matt… Matt has definitely got tons of other stuff he could talk to you about if anyone's interested, and I'm sure he'd be happy to do that.

All right. If there are no other questions, then Scott, if you don't have anything else you'd like to add, then that'll probably be it for us today.

Scott Weyandt (Moran)

41:54

No, I think, Matt's done an excellent job, and I think the,

final takeaways around, you know, defining, measurable goals. You know, flexible schedule, but define, like, real value that you're going to deliver, to the client, to your stakeholders across campus.

It helps maintain executive support, helps clarify communications with your collaborators, you know, people outside of IT, and it should also be used to take time to celebrate your wins. Hopefully, Matt, you and your team are taking time, when you hit those milestones, to congratulate yourselves a little bit, take a deep breath.

And appreciate how much you've accomplished, so…

John White

42:34

Absolutely.

Matt McNaney

42:35

CIO threw a big party for us. It was very nice.

John White

42:43

Brilliant. Okay. I don't see any questions in the chat, guys, so I think that's… that's it, and we're at time. So, thank you very much for everybody, your time today, and like I said, feel free to reach out in whatever capacity makes sense for you guys. Thanks very much.

Matt McNaney

42:57

Thanks, John.

Scott Weyandt (Moran)

42:57

Later on.

Matt McNaney

42:58

Bye.