Solution for municipalities
IGA for municipalities
Access governance built for municipal systems, in production on Omada.
A municipality has more movement in its workforce than most organizations of the same size: temps at the care home, substitute teachers, apprentices, seasonal staff and employees moving between service areas. At the same time it has to document, to auditors and supervisory authorities, who has access to citizen data, why they have it and who approved it. Our municipal IGA solution is the finished answer to that job: Omada, connected to the municipal source systems, reusing the work we have already done for other municipalities so the next one does not start from zero.
The starting point
A municipality has more movement than most
Most municipalities share the same foundation: employee data in a payroll and HR system, the organization maintained in OS2MO or in payroll, users in Active Directory and Entra ID, and access to the line-of-business systems managed in a different place for each system.
What ties it together is usually manual: a ticket to IT, a checklist kept by a manager, a spreadsheet of temps. That works as long as someone remembers. It does not hold when the auditor asks for the history, or when an employee left three months ago and can still open the care journal.
Our municipal IGA solution puts the governance in one place and lets employee data drive access – including when the employment has an end date.
Why it is urgent now
- The requirements come from outside: GDPR article 32, municipal audit and – for the parts of the municipality in scope – NIS2 all assume fixed processes and traceable documentation.
- There is a lot of movement: temps, apprentices, seasonal staff and internal moves weigh more in a municipality than in a company of the same size.
- Vendor risk is real: a bespoke solution built for a handful of customers stands and falls with that vendor, and responsibility for access stays with the municipality regardless.
Four challenges
Do you recognize this from your own municipality?
These are the same four things we meet, whatever the size of the municipality.
- The new hire is waiting: account, mailbox, line-of-business system and the right permissions have to be ready on day one, but the request goes through people who also do other work.
- The temp is never closed down: fixed-term employments have no natural end date in the systems, and access remains after the last shift.
- Permissions pile up when people move: whoever moves from elderly care to citizen services gets new access, and the old access comes along.
- The documentation is scattered: the answer to who approved what sits in old emails and closed tickets. The auditor expects it in minutes, not weeks.
The solution
Employee data drives access
The solution is Omada set up for a municipality. Omada is a Danish-built IGA platform, and we are its only business partner in Denmark. It is delivered as cloud, as private cloud or as sovereign cloud in containers, according to the municipality's requirements for data handling and operations.
The division of labour is simple: the payroll and HR system is the source, Omada is the engine, and Active Directory, Entra ID and the line-of-business systems are where access is used. When an employment is created, access follows automatically, and it closes on the day the employment ends.
The setup is configuration in a standard platform, not code written for you alone. That is the difference between a solution someone else can take over and one that follows individuals.
Three links, one flow
- Payroll and HR: the source of who is employed, where, in which position and for how long.
- Omada: the engine that turns the employment into roles, access, approvals and recertification.
- AD, Entra ID and the systems: where access is exposed and used every day.
How it works
The three events a municipality has most of
Hiring, moving and leaving are handled the same way every time, driven by the municipality's own employee data.
The integrations
We connect to the systems the municipality already has
We build on the integrations from one municipality to the next. The systems are largely the same, but the setup varies, so we adapt locally rather than starting from scratch. This is the part that usually costs time in a municipal project, and the part the next municipality does not pay full price for again.
Payroll and HR
The municipal payroll system is the source of employment, position, organization and termination. We read the data from there rather than asking managers to type it in again.
Organization
OS2MO or the payroll system as the source of departments, managers and positions. Once the organization is in place, roles can be assigned automatically.
Users and accounts
Active Directory on-premises and Entra ID in the cloud are governed in the same model, along with M365 licenses, mailboxes and groups.
Shared municipal services
The shared municipal support systems and the role catalogue, where the municipality uses them, so access to the shared services follows the same model as everything else.
Line-of-business systems
Care and health, schools, records management and finance. Standard integration where one exists, and otherwise the platform generic integrations over API, SCIM or file exchange.
Service accounts and AI agents
Non-human identities get an owner, a purpose and an expiry date in the same platform instead of living in a spreadsheet.
The outcome
What the municipality gets
Access ready on day one
Standard access is assigned from position, department and location, so the new hire can work from the first morning.
Same-day offboarding
Termination in payroll closes access automatically. No checklist, and no former employees with live access to citizen data.
Temps with an end date
Fixed-term employments get an expiry date from the start and have to be extended actively if they continue.
Self-service that relieves IT
Managers request and approve themselves, with full traceability. Most requests never become a ticket.
Recertification and audit trail
Scheduled recertification and a full history of who had which access and who approved it. You are audit-ready all year.
One view across systems
Access in Active Directory, Entra ID and the line-of-business systems appears in the same picture instead of one console per system.
Future-proofing
Why this does not become a new dependency
A municipality that has learned what dependency on one vendor bespoke solution costs should not buy the same dependency again. These are the five things we would demand ourselves.
| Property | What it means for the municipality |
|---|---|
| A standard platform, not a bespoke one | Omada is a product with customers across Europe and a fixed release cycle. New functionality and security updates come from the vendor, not from a single developer who knows your particular setup. |
| Configuration rather than code | The setup is configuration in the platform. That keeps the running cost down over the years and means someone else can take it over without reading their way into home-grown code. |
| The municipality owns data and setup | The role and permission model, assignment rules and history can be exported. The exit test is simple: can a company other than us take over operations within a month? The answer has to be yes. |
| The municipality chooses the delivery model | The same platform is delivered as cloud, as private cloud and as sovereign cloud in containers. The municipality chooses the model that meets its requirements and can move later without changing platform and without rebuilding. |
| Ready for what comes next | Service accounts and AI agents are governed in the same platform. What is a spreadsheet of technical accounts today becomes part of ordinary access governance. |
We advise on identity and access management, not on procurement law. The specific procurement route and the contract terms are the municipality's own.
Several municipalities, one foundation
The municipalities have more in common than municipalities usually do
Several Danish municipalities are in production on the platform today, and that is part of why we call it a solution rather than a project. They draw employee data from the same payroll and HR systems, are connected to the same shared municipal infrastructure and have the same joiner, mover and leaver processes.
That is why we reuse the work we have done for other municipalities rather than starting from scratch every time. It shortens implementation, lowers the running cost, and lets the next municipality benefit from what the previous ones learned. There are always local variations in systems, organisation and processes, so what is reused is the starting point – adapted to your municipality.
We share named references at a meeting, once the reference customer has agreed.
About the Omada partnershipWhat gets reused
- The integrations to the municipal source systems, adapted to your setup.
- The role and process model with same-day provisioning and temp handling, adapted locally.
- The documentation set for the auditor, so the answer to whether you can show it is yes from day one.
The process
Four steps, and you can stop after each of them
The order is built so the municipality knows enough to decide the next step before it costs anything larger.
01 · No-obligation dialogue
45 minutes, no product demo
45 minutes on Teams with an adviser: what you are dealing with, what is urgent, and what the next step is. No product demo.
02 · Decision basis
Needs, requirements and budget – owned by the municipality
Mapping of needs, requirements and economics that you own. Built on our pre-project IGA Ready, cut down for a municipality that knows its need. Four to eight weeks.
03 · Implementation
First area live within months
Setup on the shared foundation, integration to the municipal source systems, role model and handover to operations. The first area in production within months rather than after a year.
04 · Operations and development
We run the solution and bring new systems on board
Managed IGA: we run the solution with an agreed response time, keep the integrations alive and take on new systems as they arrive.
Why IAM Group
What you get with us on the job
Omada's only partner in Denmark
We are Omada's only business partner in Denmark. That gives a short route to the vendor when something has to be clarified or fixed.
About the partnership →Municipal engagements and SKI
We have ongoing municipal engagements in identity and access management, and we are an admitted supplier on SKI 02.06 Standard Software, so the municipality can buy the solution through SKI.
About buying through SKI →Advice before product
If the picture looks different from the one this page describes, we say so. We also work with Pointsharp and One Identity.
See all partners →Identity and access only
It is our whole trade. Deliverables and decision material are ready for management, steering committee and auditor.
FAQ
Frequently asked questions
Do we have to run a tender?
Licensing and implementation of a new platform will typically exceed the threshold. The municipality can then run its own tender or buy through SKI's dynamic purchasing system 02.06 Standard Software, where we are an admitted supplier and where SKI has run the tender on the municipality's behalf. The advisory work and the decision basis normally sit below the threshold and can be decided by you. The assessment is the municipality's own, but we know the order of things.
We are looking at OS2MO. Is that not the same thing?
No, and the two do not exclude each other. OS2MO is about organizational and employee data. Our solution sits on top and governs roles, access, approvals and recertification. OS2MO can perfectly well be the source system in it.
How long before we see anything?
A decision basis takes four to eight weeks. The implementation runs in stages, with the first area in production within months. We start where the effect is largest, and that is almost always leavers and temps.
We have a solution today. Can you take it over as it is?
We map what it actually does for you and cover that with a standard package that can be extended. A bespoke single-vendor solution copied one-to-one would bring the same dependency along.
What does it cost?
The first meeting costs nothing. After the dialogue you get a concrete estimate for the decision basis and a price range for implementation and operations that you can take forward internally.
Materials
Download the material
A whitepaper on the solution and one on the way forward for municipalities running ID Connect, both written for the IT manager and the information security officer in a municipality. Both are in Danish and require contact details.
Whitepaper: Kommune IGA (Danish)
What the solution consists of, which systems it connects to, what the municipality gets out of it, and what a project looks like from first meeting to operations.
Municipalities running ID Connect: the way forward (Danish)
For municipalities running ID Connect: your situation, the five questions within 30 days and the three steps forward, whether you stay or switch.
Insights
Read on
Forgotten access: the quiet risk of poor offboarding
When employees leave, their access does not always leave with them. Forgotten accounts are one of the most overlooked security risks – here are the gaps and the process that closes them.
Read more →
Third-party access: when your security depends on someone else’s
External consultants, support agreements and shared VPN accounts give vendors access to your most critical systems – often with no expiry, owner or traceability. Here is how to take control of third-party access.
Read more →
NIS2 sets requirements for your access management – are you ready?
NIS2 sets concrete requirements for access management: access control policies, MFA, and documented control of who has access to what. Here is how the directive connects to IAM and IGA.
Read more →
Case: From manual access management to full overview in 12 weeks
A manufacturing company with 2,000 employees and 15 offices established a single identity overview and automated on- and offboarding with Pointsharp IGA – using a phased approach that can be completed in as little as 12 weeks.
Read more →
Shall we look at your municipality?
A first meeting takes 45 minutes and has three items: what you are dealing with today, what is urgent, and what the next step is. No product demo, just a plan to decide on.
Kristian Thim · CTO, IAM Group