Enterprise Identity and Access Management (IAM) Solution

Project Overview Minnesota State Colleges and Universities (Minnesota State) is issuing this Request for Proposal (RFP) to solicit proposals from qualified vendors for the implementation of a modern, secure, and scalable Identity and Access Management (IAM) solution. The Minnesota State system consists of 33 institutions: 26 colleges, 7 universities, and a system office (SO), 34 entities in total. The goal of this initiative is to replace the custom-built programs and existing system integration with Microsoft Identity Manager (MIM) system with a cloud-first platform that supports integration with Workday, Microsoft Entra ID (Azure Active Directory), and other enterprise and institution-specific systems. The new IAM platform must support a federated model of identity governance across the entire Minnesota State system, enabling centralized policy enforcement while allowing for delegated administration at the institution level. The solution must address current limitations with identity lifecycle management, provisioning and deprovisioning, authentication and authorization, and compliance reporting. It must also support a wide range of user types, including students, faculty, staff, alumni, contractors, and guests. Note a person may be one or more of these personas at the same time. The importance of this RFP is both strategic and tactical. Tactically, the solution must ensure that the integrity of our community’s digital identities remains confidential and highly available during the transition of the Student Information System (SIS) to Workday. A requirement for the NextGen Student project is to complete this project before the testing begins for the Academic and Foundation move to Workday in 2027. This RFP outlines the scope of work, technical and functional requirements, evaluation criteria, and submission instructions. The selected vendor will be expected to deliver a comprehensive IAM solution that aligns with Minnesota State’s strategic goals, enhances security posture, and improves the user experience across the system. Key Objectives include: Replacing legacy IAM infrastructure with a modern, cloud-native platform. Enabling real-time identity orchestration and event-driven workflows. Supporting integration with Workday for HCM and Workday student data. Providing delegated administration capabilities for institution staff (IT and others). Enhancing compliance with the Family Educational Rights & Privacy Act (FERPA), Minnesota Government Data Practices Act (MGDPA), and other appropriate regulations. Improving operational efficiency and reducing identity-related risks. Minnesota State is committed to a transparent and competitive procurement process. Vendors are encouraged to review the requirements carefully and submit proposals that demonstrate their ability to meet the needs of a large, distributed higher education system. Technical/Functional Requirements 1. Strategic Objectives Minnesota State Colleges and Universities are undertaking a comprehensive modernization of its IAM infrastructure to support its evolving digital ecosystem. The strategic objectives of this initiative are aligned with the institutions’ broader goals of security, operational efficiency, user empowerment, and cloud transformation. 1.1 Cloud-First and Scalable Architecture · Transition from on-premises IAM infrastructure to a cloud first solution, with a hybrid model as a secondary model. · Ensure high availability, disaster recovery, and elastic scalability to support peak identity changes during semester start. IAM manages over 3 million identities overall and of which 300,000 to 500,000 are active each term. · Eliminate or significantly reduce dependency on legacy systems and custom scripts. 1.2 Seamless Integration with Enterprise Systems · Enable real-time, bidirectional integration with Workday HCM and Workday Financial Management and Workday Student. · Integrate with existing enterprise platforms including but not limited to Microsoft Entra ID (Azure AD), ServiceNow, D2L Brightspace, Zoom, and other enterprise solutions that are utilized across Minnesota State or for a significant number of member institutions. · Support federated identity and social login (Microsoft, Google, Meta, etc.) for external users and partners. · Interoperability with various third-party CRM systems. 1.3 Centralized Governance with Delegated Control · Establish a unified IAM governance framework that supports centralized policy enforcement. · Empower institutions’ IT and business units with delegated administration capabilities. · Provide tools for institution-scoped real-time provisioning/deprovisioning, access reviews, and role management. 1.4 Enhanced Identity Lifecycle Management · Automate identity creation, updates, suspensions, reactivations, and deletions. · Eliminate or significantly reduce duplicate identities. · Support multiple concurrent roles and affiliations (e.g., student and employee). · Onboard-to-Separation identity tracking with configurable retention policies. 1.5 Improved Security and Compliance · Implement multi-factor authentication (MFA) that supports existing Entra ID integration, conditional access, and context-aware authentication. · Support compliance with FERPA, MGDPA, and other regulatory requirements. · Provide centralized logging, alerting, and reporting for identity-related events. · Support integration with Security Information Event Management (SIEM) tools, specifically support Splunk integration. · Support integration with third-party fraud detection services. · The identity system must have fraud prevention measures continually evolving as the fraud vulnerability landscape changes. Fraud prevention measures should contain features beyond basic measures like CAPTCHA, identity verification, and/or bot detection mechanisms. 1.6 User-Centric Experience · Deliver a consistent and intuitive user experience across both web and mobile platforms. · Password reset in Entra ID and sync password to multiple campus ADs. · Enable self-service capabilities for password resets, profile updates, and access requests. · Accommodate name changes and corrections. · Ensure accessibility compliance (WCAG 2.1 or higher) for all user interfaces. 1.7 Operational Efficiency and Risk Reduction · Reduce manual processes through automation and orchestration. · Minimize identity duplication and fragmentation across systems. · Improve visibility into identity flows and provisioning status for faster troubleshooting. These strategic objectives form the foundation for the functional and technical requirements outlined in the following sections. The selected IAM solution must demonstrate alignment with these goals and provide a roadmap for continuous improvement and innovation. 2. Scope of Work The scope of this project encompasses the design, implementation, integration, and support of a comprehensive IAM solution for the colleges and universities of Minnesota. The selected vendor will be responsible for delivering a modern IAM platform that meets the functional and technical requirements outlined in this RFP and aligns with the strategic objectives of Minnesota State. 2.1 Solution Design and Architecture Conduct discovery sessions with Minnesota State stakeholders and Subject Matter Experts (SMEs) to understand the current IAM Infrastructure and validate requirements to define the future-state architecture. Design a scalable, cloud-first IAM architecture that supports centralized governance and delegated institution administration. Develop a detailed implementation roadmap, including milestones, dependencies, expected roles and responsibilities in a RACI format, and risk mitigation strategies. Design architecture that accommodates Entra AD, 34 institutional ADs both in Entra and on premise. Develop a Sustainment Transition Plan, including Knowledge Transfer Sessions, Documentation, etc., for ongoing support and management of the IAM solution by Minnesota State. 2.2 Identity Lifecycle Management Implement full lifecycle management for all identity types (students, faculty, staff, alumni, contractors, guests). Support multiple concurrent roles and affiliations per user. Enable onboarding to separation identity tracking with configurable retention and archival policies. Provide tools for verification of identity, identification/resolution of duplicate identities, merging and unmerge accounts reactivation. 2.3 Provisioning and Deprovisioning Automate provisioning and deprovisioning of accounts, roles, and entitlements based on real-time events to and/or from Workday and other systems. Support immediate deactivation for unscheduled terminations and security incidents. Provide visibility into provisioning workflows, status, and audit trails. Enable delegated and segmented provisioning and deprovisioning capabilities for member institutions Functional and IT teams. Provide ability for account creation and immediate use (e.g., person enrolls for an online professional development (non-credit) class and can immediately start taking the class upon payment and enrollment. 2.4 Identity Repository/Warehouse 2.4.1 Extensible and Flexible Schema Supports adding new identity attributes dynamically without requiring orchestration software reconfiguration. Accommodates identity data for emerging use cases (e.g., community partnerships, micro-credentials, noncredit learners). 2.4.2 Multiple Identity Sources Support Beyond Workday and ISRS Can harmonize identity data from third-party CRMs, campus-specific solutions, external research collaborations, or guest sponsors. Supports identities with no StarID, beyond what is currently envisioned for prospects (e.g., volunteer groups, vendors with no accounts in Workday). 2.4.3 Data Stewardship and Attribute-Level Delegation Allows attribute-level ownership (e.g., institution X owns address changes, institution Y owns program codes), independent of provisioning workflows. 2.4.4 Change Tracking and Data Lineage Maintains an authoritative history of all identity attribute changes, including the reason for changes, timestamps, and prior values. Provides full “merge/unmerge” tracking for identity record splits or combines. 2.4.5 Interoperability with Third-Party Orchestration Tools The repository should connect to a primary IAM orchestration platform and allow connection to additional third-party orchestration or workflow engines (e.g., case management systems, marketing systems). Ensures no vendor lock-in by publishing its data model and interface documentation. Ensures data model and interface documentation are open/published to eliminate vendor “lock-in”. 2.4.6 Metadata and Entitlements Catalog Stores relationships between identities and their entitlements/permissions in a decoupled way, so that provisioning tools can reuse this data but not own it. Includes a metadata registry to define attribute meanings, (including code explanation within the attribute), business rules, and responsible data stewards. 2.4.7 Batch and Real-Time Synchronization Flexibility Supports hybrid approaches: regular schedule/batch jobs, plus real-time change notifications to external systems via webhooks or message queues, and API integration. Can prioritize certain updates (e.g., security disables) for real-time vs. less urgent data for batch. Full ability to alert on scheduled/batch job success or failures. 2.4.8 API Security and Rate Limiting Implements API security best practices including token expiration, OAuth2 scopes, rate limiting, and anomaly detection on API calls. 2.4.9 Future-State Extensibility Supports plug-ins or extensions to accommodate new identity verification and fraud prevention measures beyond the standard CAPTCHA, including biometric registration or third-party verifiers. 2.4.10 Flexible Data Residency and Storage Allows choice of cloud region or hybrid storage architecture to meet evolving Minnesota State or Minnesota-specific data residency requirements. 2.4.11 Independent Scalability The identity repository should scale independently of the orchestration/provisioning engine, so performance bottlenecks in one do not affect the other. Automatic, system-driven flexible resource scaling based on utilization criteria and trending Key Performance Indicators (KPIs). 2.5 Authentication and Authorization Integrate with Microsoft Entra ID (Azure AD), local ADs, and other authentication providers. Provide or leverage an LDAP directory service to store and manage user identities and attributes for authentication and authorization. Support modern authentication protocols (SAML, OAuth2, OpenID Connect, LDAP, etc.). Implement MFA, conditional access, and password-less options. Support and configurable MFA authentication types (authentication apps, hardware and software-based tokens, etc.). Enable role-based and attribute-based access control (RBAC/ABAC). 2.6 Directory and Federation Service Integrate with a shared Azure AD tenant and local institution ADs. Support federated identity with external partners and customer authentication via consumer identity providers. Synchronize directory attributes across systems with support for scoped visibility. 2.7 Delegated Administration Provide role-based delegated and segmented administration tools for member institutions Functional and IT teams. Support institution-scoped provisioning, access reviews, account management, and group management. Support for system-wide provisioning, access reviews, and account and group management at the system office level. Enable self-service capabilities for authorized users. 2.8 Governance, Risk, and Compliance Implement workflows for identity attestation, re-attestation, and certification campaigns. Provide centralized logging, alerting, and reporting for identity-related events. Ensure compliance with FERPA, MGDPA, and other applicable regulations. Support legal hold and privacy indicator enforcement. 2.9 Integration and Extensibility Provide an Application Programming Interface (API)-first architecture with support for RESTful APIs, webhooks, and event streaming. Integrate with Workday, TeamDynamix, Desire 2 Learn (D2L) - Brightspace, and other enterprise systems as required in the defined Scope of Work. Support scheduled/batch processing and real-time updates. Ensure compatibility with Microsoft Fabric, Oracle, and Snowflake for identity warehouse integration. 2.10 User Experience and Accessibility Deliver a unified user experience across both web and mobile platforms. Provide self-service tools for secure password reset, profile management, and access requests. Ensure accessibility compliance (WCAG 2.1 or higher). 2.11 Training, Documentation, and Support Provide comprehensive training for the system office and member institutional Functional staff and IT staff. Deliver detailed documentation for system configuration, administration, and troubleshooting. Offer ongoing technical support, including Service Level Agreements (SLA) for issue resolution and system updates. 3. Functional Requirements The future IAM platform must support a modern, scalable, and secure identity ecosystem that aligns with Minnesota State’s cloud-first strategy, supports Workday integration, and enables delegated administration across 33 member institutions and the system office. The following functional requirements are categorized for clarity and traceability. 3.1 Identity Lifecycle Management Support for full identity lifecycle: creation, updating, suspension, reactivation, and deletion: support Joiner, Leaver, Mover (JLM) processes for roles/personas. The ability and option to manage identities with or without assigning a StarID (e.g., prospects, guests, vendors, test accounts). Support for multiple concurrent roles/personas and affiliations (e.g., student, faculty and employee). Identity reactivation and historical tracking (e.g., returning students or employees). Integration with Workday Human Capital Management (HCM) and Student for real-time identity processes and events (e.g. JLM, etc.). Support for identity account management with configurable retention policies (e.g. compliance reporting, account archiving, account deletions, litigation holds). 3.2 Provisioning and Deprovisioning Automated provisioning and deprovisioning of accounts, roles, and entitlements. Configurable workflows for onboarding/offboarding based on personas/roles, affiliations, and institutions. Delegated provisioning capabilities for institution-based staff members. Visibility into provisioning status and audit trails for troubleshooting both systemwide and at institutions. Support for immediate deactivation (e.g., adverse terminations or security incidents). 3.3 Authentication and Authorization Support for modern authentication protocols (SAML, OAuth2, OpenID Connect, LDAP, RADIUS). Integration with Microsoft Entra ID (Azure AD) and local ADs. Support for MFA, including conditional access policies. Role-based access control (RBAC) and attribute-based access control (ABAC). Delegated authorization management for institution-specific applications. 3.4 Directory and Federation Services Integration with a shared Entra AD tenant and local institution ADs. Support for federated identity with external partners and social identities. Directory synchronization and attribute mapping across systems. Ability to manage and expose scoped attributes (e.g., academic suspension visible only to home institutions). 3.5 Delegated Administration Role-based delegated administration for institution IT and business units. Granular control over who can manage what (e.g., student workers, adjunct faculty). Capabilities for institutions to manage users with local RBAC & ABAC control. Support for institution-scoped provisioning and access review. 3.6 Governance, Risk, and Compliance Identity attestation and re-attestation workflows. Support for certification campaigns (e.g., annual access reviews). Logging, alerting, and reporting for identity-related events. Compliance with FERPA, MGDPA and other applicable regulations. Integration with legal hold and privacy indicator processes. 3.7 Integration and Extensibility API-first architecture with support for RESTful APIs and webhooks. Integration with Service Management systems (e.g. TeamDynamix). Support for batch processing and real-time updates. Compatibility with Microsoft Fabric, Oracle, and Snowflake for identity warehouse integration. 3.8 User Experience and Support Unified user experience across both web and mobile platforms. Self-service secure password reset and profile management. Ability to self-create identity and determine if that person already has an identity and account created. Support for context-aware access (e.g., device, location, network). Accessibility compliance (WCAG 2.1 or higher). 3.9 Scalability and Performance Support for 800,000+ identities across a total of 33 member institutions and the system office. The authentication service must handle at least 1–10 million directory updates daily at peak. This includes updates for 100,000–200,000 users, with each user potentially triggering five or more directory server updates. Vendors must ensure the platform is able to process high throughput, not merely high user counts. Throughput and the ability to avoid backups or slowdowns during peak times are critical. High availability and disaster recovery capabilities. Performance SLAs for provisioning, authentication, and synchronization. The system must support millions of updates across dozens of connected systems daily, including campus and enterprise directories and solutions like Workday. The integration pattern will shift from mostly one-way provisioning (to directories) to bidirectional synchronization with systems like Workday, involving updates both in and out. The environment features cyclical peaks - especially at the start of fall and spring semesters - with otherwise low to moderate activity. The platform must be capable of scaling appropriately for these seasonal demands without degradation of service. 4. Future State Expectations 4.1 Identity Platform Replace MIM with a modern Identity Governance and Administration (IGA) platform. Support real-time identity orchestration and event-driven workflows. Enable role-based and attribute-based access control (RBAC/ABAC). 4.2 Directory Strategy Consolidate identity data into a single authoritative identity warehouse. Leverage Microsoft Entra ID as the enterprise directory. Reduce dependency on local ADs while supporting delegated institution control. 4.3 Integration & Extensibility API-first design with support for RESTful APIs, webhooks, and event streaming. Native integration with Workday, ServiceNow, D2L, and other enterprise systems. Support for federated identity and social login for guests and partners. 4.4 Security & Compliance Implement context-aware authentication (device, location, risk-based). Support MFA and password less options. Enable centralized logging, alerting, and compliance reporting. 4.5 Hosting & Scalability Fully cloud-hosted or hybrid deployment model. High availability, disaster recovery, and elastic scalability. Support for 800,000+ identities and millions of transactions per day. 5. Use Cases The IAM solution must support a wide range of real-world scenarios across Minnesota State’s 33 institutions. These cases reflect the diversity of identity types (personas), lifecycle events, and access needs that the platform must accommodate. The solution must be flexible, policy-driven, and capable of enforcing scoped access and identity governance across institutional boundaries to support multi-persona and cross-institution affiliations. 5.1 Student Lifecycle A person may begin as a prospect managed through an institution's CRM application. Alternatively, staff or other processes (e.g. CRM, ACT and financial aid) may add a prospect to the SIS. Doing so triggers identity creation and provisioning. A prospect may concurrently or consecutively apply to one or more institutions, triggering identity creation and provisioning. Ability or option to use social identity while students are prospective and/or enrolled students (credit and non-credit) Upon admission or enrollment, the student gains access to systems such as financial aid, LMS, and email. The student may enroll, drop, withdraw, or transfer between institutions. Students may be placed on academic probation, suspension, or expulsion, requiring scoped attribute enforcement. After graduation, the student becomes an alumnus, retaining limited access. Students may re-enroll after a gap, requiring identity reactivation and historical tracking. 5.2 Employee Lifecycle A new faculty or staff member is hired and provisioned with access to HR, email, and administrative systems. Employees may hold multiple roles (e.g., faculty and administrator) or work at multiple institutions. Role changes (e.g., faculty to department chair) must trigger access updates. Upon separation, access must be revoked immediately or transitioned to another role (e.g., emeritus). Rehires must have their identity reactivated with historical context preserved. 5.3 Student Workers A student may also be employed as a student worker, requiring dual identity handling. Access must be provisioned based on job role (e.g., help desk, library assistant). Upon job termination, only employment-related access should be deprovisioned, not student access. 5.4 Guests and Affiliates Visiting scholars, contractors, and volunteers require temporary access to specific systems. Access must be scoped, time-bound, and auditable. Guest identities may be sponsored by institution departments and require approval workflows. 5.5 Legal and Privacy Holds A legal hold may be placed on a user’s mailbox and OneDrive to preserve data for litigation. A privacy indicator may restrict the release of personal information across systems. These holds must be enforced consistently across all integrated platforms. 5.6 Multi-Institution Collaboration Faculty or staff may collaborate across institutions, requiring shared access to systems. Scoped attributes (e.g., academic suspension) must be visible only to the home institution. Identity federation and attribute isolation are critical to maintaining institutional autonomy. These use cases illustrate the complexity of identity relationships and the need for a flexible, policy-driven IAM platform. The solution must support dynamic role changes, cross-institutional collaboration, and compliance with legal and regulatory requirements. 6. Budget The budget for this contract is anticipated to be $2,000,000 for the duration of the contract. 7. Selection Process The selection process includes an evaluation of all qualified proposals. Minnesota State will select the Vendor(s) whose proposal(s), and follow up interviews if requested, demonstrate in Minnesota State’s sole opinion, the clear capability to best fulfill the purposes of this RFP cost-effectively. Minnesota State reserves the right to accept or reject proposals, in whole or in part, and to negotiate separately as necessary to serve the best interests of Minnesota State. This RFP shall not obligate Minnesota State to award a Contract(s) or complete the proposed project, and it reserves the right to cancel this RFP if it is in its best interest. 8. Evaluation Criteria Minnesota State will evaluate all proposals based on a comprehensive set of criteria that reflect the strategic, functional, technical, and operational priorities of the IAM modernization initiative. Each proposal will be scored by a cross-functional evaluation committee using a weighted rubric. Vendors are encouraged to provide clear, concise, and well-documented responses that directly address each criterion. Evaluation Factors The following factors and their identified weight will be used to evaluate the responses: Topic Factor Weight Adherence to Minnesota State Terms and Conditions. A statement of the objectives, goals, and tasks to show or demonstrate its view and understanding of the nature of the contract 2 Work Plan. A description of the deliverables to be provided by the Responder along with a detailed work plan that identifies the major tasks to be accomplished and be used as a scheduling and managing tool, as well as the basis for invoicing : Cloud-first design, scalability, integration with Workday and Entra ID, Project plan, timeline, resource requirements, and change management strategy, Support for FERPA, MGDPA, MFA, logging, attestation, and privacy controls, Availability of training, documentation, and support services. Alignment with lifecycle, provisioning, MFA, delegated admin, and user experience. 61 Cost/Value. Identify the level of the participation of Minnesota State in the contract, as well as any other services to be provided by Minnesota State, and details of cost allowances for this participation. Total cost of ownership, licensing model, scalability, and transparency 23 Qualifications of Respondent and its personnel. An outline of the Responder’s background and experience with examples of similar work complete by the Responder and a list of personnel who will conduct the project, detailing their training, and work experience. Resumes or other information about project personnel should not, if possible, contain personal telephone numbers, home addresses or home email addresses. If it is necessary to include personal contact information, please clearly indicate in the proposal that personal contact information is being provided. Higher education experience, especially multi-institution systems 10 Completeness, thoroughness and detail of the response Completeness, thoroughness and detail of the response as reflected by the proposal's discussions and coverage of all elements of work listed above 2 Accessibility A completed response to the linked Voluntary Product/Service Accessibility Template(s)®(VPAT) for all software, hardware, and websites as applicable (guidance available in the ‘Products’ tab). The response must contain adequate information to evaluate the responsiveness to the accessibility standards (e.g., a completed VPAT or equivalent). 2 Total: 100 9. Technical Questions Vendors should review the technical requirements listed in Appendix A: the list of technical requirements and provide a detailed response outlining how their proposed solution meets each requirement. For each item, please indicate whether the requirement is fully met, partially met, or not met, and include a clear explanation or supporting documentation where applicable. If a requirement is partially met or not met, please describe any planned enhancements, alternative approaches, or workarounds. Your response should demonstrate your solution’s capabilities, alignment with our needs, and any value-added features that exceed the stated requirements. # Feature Category Priority Ability to utilize open standards for authentication (e.g. SAML v1.1 and v2.0, WS-Fed, WS-Trust, OpenID Connect) as well as proprietary Auth methods (e.g. for forms-based auth or basic auth). Auth Critical Detailed response outlining how the proposed solution meets each requirement. For each item, please indicate whether the requirement is fully met, partially met, or not met, and include a clear explanation or supporting documentation where applicable. Contract Terms Minnesota State desires to enter into a contract with the successful Respondent(s) effective December 31st, 2025 or on the date the last recognized signature is obtained, whichever occurs later. The length of such contract(s) will be 5 YEARS If Minnesota State and Respondent are unable to negotiate and sign a contract by December 31st, 2025, then Minnesota State reserves the right to seek an alternative Respondent(s). Inquiries and Submission Instructions Minnesota State accepts all questions and bid submissions exclusively through Minnesota State's e-procurement system. Hard copy submissions, emails, or submissions through any other medium will not be considered. Each Respondent is solely responsible for the timely delivery of its questions and bids by the RFx date and time deadlines. Failure to meet the deadlines shall be grounds for rejection. Demonstrations and Clarifications - Oral Presentations Minnesota State will conduct interviews with the Key Personnel/Teams from a each of the Shortlisted Responders on the week of September 23rd. This RFP will require Oral Presentations for those who are shortlisted during the first phase of the technical evaluations. Shortlisted vendors will be invited to provide product demonstrations, technical deep dives, or clarification sessions. These sessions will be used to validate proposal content and assess usability, integration capabilities, and vendor responsiveness.