A well-designed IGA platform and future-proof identity management for Odisee
About Odisee
Odisee is a Flemish university of applied sciences with more than 12.500 students and 1.350 staff members. Spread across campuses in Aalst, Brussels, Dilbeek, Ghent, Schaerbeek and Sint-Niklaas, among others. As a member of the KU Leuven Association, the university not only serves its own users but also a large number of KU Leuven users.
That comes with quite a few challenges. Students, lecturers and external users need timely access to the digital environments and applications they need. At all times and always with the right permissions.
During peak periods, f.e. the start of a new academic year or the beginning of the resit period, up to 50 unique identities have to be created and/or modified each day.
How do you manage thousands of identities that are constantly changing? Especially when one person can be a student, staff member, guest lecturer and KU Leuven user all at the same time?
To make those processes scalable and keep them that way, Odisee and ACEN have worked together on an IGA solution over the past ten years. The project was one of constant evolution. Between 2015 and 2025, the environment evolved from Microsoft Forefront Identity Manager (FIM), via Microsoft Identity Manager (MIM), to an entirely new midPoint environment.
The challenge: Over the years, the platform had grown ‘out of shape’ and more automation was needed
The collaboration started more than ten years ago, with the implementation and configuration of a new FIM platform. Odisee’s in-house expert on the platform at the time had left. On top of that, the merger of HU Brussel and KaHo Sint-Lieven into Odisee brought along new needs and requirements.
The university was already working mainly with Microsoft technology. Given its history with FIM, it chose this solution once again.
But it had its limits. With thousands of user accounts and closer collaboration with KU Leuven, identity management became increasingly important. Besides students and staff, Odisee also had to manage guest lecturers, consultants, temporary staff, working students and users with multiple roles.
“We used to work with an Excel file containing usernames and passwords, and every account was set up manually. Today that’s simply unthinkable, but that’s how it was done. In the FIM environment, a lot was handled through custom scripts and DevOps, but things there often went sideways there too. We needed more optimisation and automation.”
A recent IT audit also revealed an important problem with account governance. External accounts, for example those of guest lecturers, were not managed in a structured way. This led to so-called “ghost accounts”. The matter not only caused unnecessary licence costs but also posed a potential security risk.
As the collaboration with KU Leuven grew, it also became increasingly clear that the gap between the two IT environments was simply too wide. Many users had both an Odisee account and a KU Leuven account, each with its own activation process, MFA method and policies. For end-users, this was very confusing. And it also made managing access and permissions considerably more complex.
Transition scenarios meant that Odisee was running into the technical limitations of its MIM setup at the time. Working students, or teachers going back to school, for example, created complex re-hire processes that sometimes required manual intervention.
In addition, synchronisation between the two platforms was too slow. MIM works on scheduled triggers, while a near-real-time flow for data exchange was needed.
Automatisation as a trigger for stronger governance
Over the years, the identity platform was steadily expanded with automations and self-service features.
Among other things, a Self-Service Password Reset solution was implemented, allowing users to reset their password themselves via OTP (one-time password) verification. A portal was also developed to easily register and manage temporary users.
Today, accounts are automatically created, updated and deleted based on data from the various source systems, consolidated in one central database. When someone changes job, programme or department, their access rights are adjusted automatically. Temporary accounts are also followed up in a controlled way. Unused accounts are automatically deactivated and deleted.
During an optimisation track, around 17.000 outdated or orphaned accounts were cleaned up.
These automations do more than make operations efficient. They also form the foundation of a strong governance strategy. All digital identities are consistently regulated and managed throughout their entire lifecycle.
The gap between identities
Students had two completely separate accounts, each managed independently of the other. When multi-factor authentication was introduced, users even had to use a separate authenticator app for each environment. Besides being confusing, this was also very inefficient.
To improve the user experience for Odisee students, the focus shifted to a much closer integration between the two environments.
MIM became responsible for creating Foreign Security Principals within the Odisee domain. This made it easy to add users from the KU Leuven domain to security groups, automatically giving them the right access rights within the Odisee environment.
The platform was further expanded with automated management of roles, teams, security groups and shared resources. Mailboxes and shared mailboxes were later also provisioned automatically in Exchange Online.
Even with these extensions in place, MIM gradually began to show its limits. There was a growing need for near-real-time data synchronisation between Odisee and KU Leuven. Identities with multiple capacities also continued to cause problems. The MIM setup at the time also struggled with users who held multiple roles. It could not provide them with a separate AD account for each role.
Synchronisation between the two environments had to become faster, more flexible and smarter. And so gradually, attention turned to a new environment.
Why Odisee chose midPoint
Although Microsoft Identity Manager played an important role for many years, the platform gradually became increasingly complex.
At the same time, there was a growing need for faster processing, more transparency and better support for users with multiple roles.
Together with ACEN, Odisee explored several options and ultimately chose midPoint.
“MidPoint is a particularly good match for Odisee’s challenges. Multiple accounts for a single user are hard to support in many solutions. MidPoint can handle that complexity while keeping the architecture simple.”
A key advantage was the ability to manage different personas of a single user separately. Students who are also staff members, student workers or staff members who go back to studying each get the right identities and permissions. And this without complicated procedures.
A well-thought-out architecture and logic as the foundation
The migration project was built on a solid foundation: a well-thought-out architecture. Together, ACEN and Odisee analysed all processes, integrations and edge cases. They also took a critical look at what did and did not belong in the renewed environment.
This led to a much more deliberate approach to identity governance. Only processes that add sufficient value are automated. Exceptions that add a disproportionate amount of complexity are deliberately handled differently.
“Today we think much more critically about what belongs in an identity management system. Automation is good, but not when your system becomes needlessly complicated because you keep adding all kinds of exceptions.”
The implementatie: Knowledge transfer and simplicity as key strengths
Odisee was closely involved in every phase of the project. Design, configuration, testing and migration were all carried out in close collaboration. As a result, the internal team was already building up the necessary knowledge of the platform’s ins and outs during the project. “We did everything together,” said Wim Herremans, System & Cloud Engineer at Odisee. “For us, it was important that the knowledge didn’t stay with one person, but was built up broadly within the team.”
The smooth course of the migration was the result of a combination of factors: a strong focus on training and knowledge sharing, combined with the stability and robustness of the platform. Extensive testing also played an important role in the success of the migration. With test environments, test databases and several validation phases, the transition was carefully prepared before the final migration took place.
“MIM can sometimes feel like a ‘black box’ to customers. MidPoint offers more transparency, which generally makes it feel more manageable and predictable.”
The results
Thanks to the configuration, simplicity and knowledge sharing, Odisee handles day-to-day management itself.
1. Faster processing of account requests
Automation removes a great deal of manual work. Users are automatically linked to the right class groups and get the correct access to courses and learning materials. They can also reset their password, among other things, via a self-service portal. Programmes and departments with many guest users can also manage their external accounts themselves.
2. Less pressure on the internal IT department and service desk
“During busy enrolment periods, we receive up to 90% fewer identity-related tickets,” said Jan.
The reduced complexity also means that many issues can be investigated and resolved in-house.
3. More governance and control
Lifecycle processes ensure that accounts are followed up. This prevents orphaned accounts and keeps access rights better aligned with a user’s current job or role.
Users with multiple roles can now be managed correctly without complicated exceptions or workaround processes.
4. A cost-efficient solution
As an open-source solution, midPoint comes at no cost. This means there is no risk of vendor lock-in and no additional licence costs. Cost efficiency was important because the university also needs to make the most of its budget. For Odisee, this was a huge added value as well.
In addition, the internal team can handle day-to-day management itself, and ACEN is only called in for larger and/or more complex extensions to the platform.
“Because of the way we approached the project, Odisee quickly gained the confidence to start working with midPoint themselves.”
About the collaboration
The evolution between 2015 and 2025 has been one of continuous change, with two constants: ACEN and Odisee, at the drawing board together.
With every migration or change, problems and needs were examined critically. New avenues were explored and investigated together. And the environment was optimised and expanded step by step.
The combination of years of experience with the Odisee environment, in-depth IGA expertise and ACEN’s role as a midPoint Bronze Partner formed a strong basis for a successful migration. Extensive testing and thorough preparation for the cut-over ensured a controlled and successful transition.
“What we can solve ourselves, we take on with confidence. For what we can’t, we know ACEN is just one phone call away.”
