Deepan Udaiyar

Designed the authentication policy architecture behind a phishing-resistant MFA programme: a device-trust ladder where sign-in friction scales inversely with attested device trust. Recovery and enrollment are treated as part of the authentication boundary rather than as support workflows, because the back doors matter more than the front door. Built a Python pipeline against the identity provider's APIs to measure and prove enrollment and device-trust posture.

Led an end-to-end Active Directory decommission with no cutover downtime. Directory migrations fail at the cutover window, so this one removed the window: users converted themselves at their own pace, driven by an Okta Workflow that unassigned the directory link and issued a temporary credential. Written up and published as a public six-phase methodology.

Replaced a planned 500-form access-request build, one form per application, with a single request form driven by a master metadata table, so onboarding a new application became a metadata entry rather than a development task. Automated directory group provisioning and deprovisioning straight from approved requests. Delivered in under two months on a programme that had not shipped in over a year.

Consolidated five Atlassian instances into a single environment, delivered single-handedly and in-house. The decision that shaped the project was recognising that the built-in cloud-to-cloud transfer tooling could handle the data movement, so the real work was the configuration the tools don't cover plus stakeholder coordination, not raw engineering effort. I ran it as per-tenant playbooks with a named stakeholder and dedicated channel for each, phased the cutovers, and version-controlled the repetitive pipeline steps, then enforced SSO and connected SCIM provisioning once the tenants were merged.

Integrated identity through three acquisitions across two employers: merged acquisition Okta tenants with dozens of applications in under a month, ran a native cross-tenant mailbox migration that preserved directory identifiers and mail routing, and built a zero-touch onboarding pipeline that provisioned new employees with no manual intervention.

Brought the SaaS estate onto consistent federation and lifecycle patterns: dozens of integrations with automated licence assignment, SAML group sync, and automated deprovisioning, with an HRIS as the authoritative identity source driving joiner/mover/leaver across the application estate.