For municipalities running ID Connect
Running ID Connect today?
We help you move on with the right solution.
ID Connect A/S, which delivered user administration as a cloud service to a number of Danish municipalities, has gone bankrupt. The solution is now kept running by another company, so it still works, but what happens in the longer term is unclear. That is the situation we help municipalities out of: with an overview of what the solution does for you today, a decision basis you own, and the solution that fits you, whether that turns out to be the current one or a new one.
The situation
The solution works today. The question is what you can count on from here
ID Connect is a service operated for the municipality by a third party. That kind of dependency is perfectly normal, but it has one property a locally installed solution does not: it can cease without anything breaking on your side. So four things should be settled while the service keeps running under the new operator.
- Development. Who handles a new line-of-business system, a reorganisation or a new security requirement, and on what terms?
- Support. The agreement was made with a company in bankruptcy. What the new operator has taken on, and for how long, should be in writing.
- Key people. In a specialised solution built for a few customers, the knowledge of the configuration sits with a few people. Which of them are still there?
- The responsibility does not move. Making sure the right employee has the right access, and that the departed employee has none, is the municipality's responsibility throughout.
The risk
What grinds to a halt is the processes, not the screens
Should ID Connect become unavailable or unsupported, the municipality does not miss the system. It misses the processes the system performs every day without anyone thinking about them. Those are what must be secured, whichever solution you end up with.
The new starter
The care worker starting on Monday needs an account, email, the case system and the right permissions on time. Without automation, that becomes a manual task in an IT department that has not been given more hands.
The one changing role
From elderly care to citizen services: new access must be granted, and the old access must go. The second part is almost always forgotten once the process is manual.
The one who has left
The gap that most often remains. A former employee with live access to citizen data is both a breach of GDPR Article 32 and an observation the auditors will write up.
Temps and fixed-term staff
Care staff, supply teachers, students and seasonal workers are where a municipality has the most movement, and where a manual process suffers most.
The first 30 days
Five questions you should be able to answer within 30 days
Whichever way the municipality chooses in the long run, five questions should have a written answer quickly. They are just as useful if you stay with the company that now keeps ID Connect running as if you choose something else.
- Do we have an exportable copy of our own configuration?
Role and entitlement model, assignment rules, organisation and the history of access. It is the municipality's data, and it is easier to get out while there is still someone to ask.
- How long can user administration run manually, and who does it?
Put numbers on it: joiners, movers and leavers per month, time per case, and who has been given the task. Do the sums now, not in December.
- Which integrations stop if ID Connect is switched off?
Payroll and HR, Active Directory or Entra ID, the shared municipal access management and the line-of-business systems. Mark for each line what has to be done manually.
- What does the contract say about exit, data and bankruptcy?
Exit clause, data handover in a usable format, escrow, liability during a transition period. These questions belong with the municipality's lawyer or procurement function.
- Who can document to the auditors that the process still works?
Put a name on it, and make sure that person has access to the documentation the question requires.
The way forward
The way forward: three steps, where only the last is a major purchase
The common mistake is to go straight from an unclear situation to a large platform purchase. That means a long decision process precisely when uncertainty is greatest, and it forces the municipality to choose a product before it has described its needs. We recommend three steps that can be decided separately: a clarification now, a decision basis over four to eight weeks, and only then a decision on the solution.
If the decision ends with a new solution, it does not have to be built from scratch. Our municipal IGA solution runs on Omada, delivered as cloud, private cloud or sovereign cloud according to the municipality's requirements, with integrations to the municipal source systems, same-day provisioning, temp handling and documentation for the auditors. Several Danish municipalities are in production on the platform today.
The clarification and the decision basis are yours whatever you choose afterwards, and they normally sit below the threshold for municipal procurement, so they can be decided by you. Licensing and implementation of a new platform will typically exceed it and must be tendered, bought under a framework agreement, or procured through a contracted party with us as subcontractor.
See IGA for municipalitiesThe three steps
- Now, 0-4 weeks: clarification. What ID Connect does for you today, what you should have in writing from the current operator, and what the auditors need. Two to three days.
- 4-8 weeks: decision basis. What your solution actually does, requirements for the future, and a recommendation with costs, whether it points to staying or switching. Built on our IGA Ready pre-implementation project.
- 3-6 months: if you choose to switch: the municipal IGA solution in production, most important area first.
FAQ
Frequently asked questions
ID Connect is still running for us. Is there even a problem?
What typically happens is not that the system goes down, but that there is no longer anyone to adjust it when you get a new line-of-business system or reorganise. And the history of who has had which access lives in the current solution. If it cannot be exported, you also lose the documentation of the past. The meeting is about being prepared, not about switching tomorrow.
We are waiting to see what the new owner does with the solution.
That is a perfectly reasonable decision. An advisory meeting does not change it; it makes it easier to take when you have to. Not least because it is easier to get a copy of your own configuration out now, while there is still someone to ask.
We are looking at OS2MO. Isn't that the answer?
OS2MO is a real option, and we do not argue against it. Nor do the two solve the same problem: OS2MO is about organisation and employee data, while what we work with sits on top as governance of roles, access and approvals. OS2MO can very well be the source system in the solution we recommend.
Do we have to run a tender if we choose a new solution?
Yes, if you are buying a new platform. The purchase can be made through SKI 02.06 Standard Software, where we are an admitted supplier. But what the first meeting is about comes before that: the clarification and the decision basis. That normally sits below the threshold and can be decided by you.
What does the first meeting cost?
Nothing. It is 45 minutes on Teams with an adviser, three items and no product demo: what you are dealing with, what is urgent, and what the next step is. You get a concrete proposal for the first two steps with a price range you can take forward internally.
Materials
Download the white paper
Take the walkthrough into your internal discussion. Both papers are in Danish: one is about your situation with ID Connect, the other about the municipal solution we recommend if you choose to switch.
Municipalities running ID Connect: the way forward (Danish)
What ID Connect does for you, the five questions within 30 days, the three steps, the procurement route and the solution we recommend if you switch. Written for the IT manager and the information security officer.
Kommune IGA: access management built for municipal systems (Danish)
Our municipal solution on a standard platform: source systems, roles, processes and documentation for the auditors, and what can be reused from municipality to municipality.
Insights
Read on
Forgotten access: the quiet risk of poor offboarding
When employees leave, their access does not always leave with them. Forgotten accounts are one of the most overlooked security risks – here are the gaps and the process that closes them.
Read more →
Third-party access: when your security depends on someone else’s
External consultants, support agreements and shared VPN accounts give vendors access to your most critical systems – often with no expiry, owner or traceability. Here is how to take control of third-party access.
Read more →
NIS2 sets requirements for your access management – are you ready?
NIS2 sets concrete requirements for access management: access control policies, MFA, and documented control of who has access to what. Here is how the directive connects to IAM and IGA.
Read more →
Case: From manual access management to full overview in 12 weeks
A manufacturing company with 2,000 employees and 15 offices established a single identity overview and automated on- and offboarding with Pointsharp IGA – using a phased approach that can be completed in as little as 12 weeks.
Read more →
A first meeting takes 45 minutes and has three items
What you are dealing with today, what is urgent, and what your way forward is. There is no product to look at in that meeting. There is a plan to decide on.
Kristian Thim · CTO, IAM Group