# Multi-IdP Architecture: Ensuring Identity Continuity and Resilience **Real-Time Identity Orchestration at 500,000 User Scale** At an enterprise scale of **500,000 users**, static directory synchronization and manual identity operations collapse under their own weight. **Hexnode Identity Orchestration** provides a real-time control plane between enterprise Identity Providers (IdPs) and managed endpoints. This document defines the **integration architecture, provisioning lifecycle, authentication controls, and attribute-mapping logic** used when connecting Hexnode with **Microsoft Entra ID, Okta,** and **Google Workspace** in globally distributed environments. Multi-IdP Architecture Model ----------------------------- **Centralized Governance with Distributed Autonomy** Hexnode supports a **Hub-and-Spoke identity architecture** designed for multinational and multi-tenant enterprises. ### Architectural Principle A central authority governs identity policy, while regional or subsidiary entities retain operational independence. ### Structural Components - **Master Identity Hub** A primary corporate IdP connected to the Hexnode UEM Portal establishes global governance, RBAC baselines, and compliance posture. - **Regional Identity Spokes** Subsidiary tenants integrate local Okta or Google Workspace directories to satisfy regional autonomy and data residency requirements. ### Resulting Capability - Unified visibility across all tenants - Independent lifecycle control at the subsidiary level - No cross-tenant identity collision or attribute leakage Just-In-Time Provisioning -------------------------- **On-Demand Identity Creation Without Directory Bloat** Just-In-Time (JIT) provisioning eliminates the need for pre-synchronizing hundreds of thousands of dormant accounts. ### Authentication-Driven Identity Creation - A user authenticates via SSO using SAML or OIDC. - Hexnode evaluates the authentication assertion in real time. - If no local identity exists, a user record is created instantly using IdP claims. - Role assignment and organizational placement are derived from claim attributes. ### Scale Impact - Zero preloaded user databases - Every active account is validated against a live IdP session - Dormant or unused identities never materialize in the system SCIM 2.0 Lifecycle Enforcement ------------------------------- **Continuous Identity State Synchronization** While JIT governs first access, **SCIM 2.0** governs the full identity lifecycle. ### Event-Driven Deprovisioning Hexnode listens for SCIM push events from supported IdPs: - DELETE events for terminated users - PATCH (active=false) for suspended identities ### Automated Response Chain Upon receiving a SCIM signal, Hexnode can automatically halt active sessions. ### Security Outcome Identity termination in the directory propagates instantly to device, credential, and network access layers. High-Assurance Authentication Controls --------------------------------------- **Protection of Administrative and High-Risk Actions** Hexnode enforces modern authentication standards across all management interfaces to prevent unauthorized administrative actions. Control LayerImplementation LogicSecurity ObjectiveSingle Sign-OnSAML or OIDC integration with enterprise IdPsCentralized admin authenticationMulti-Factor AuthenticationMandatory MFA enforcement using approved authenticatorsProtection of high-impact actionsIdentity-Link BindingCryptographic association between DeviceID and UserUPNEnrollment integrity and impersonation preventionThis model ensures that sensitive operations such as remote wipe or policy modification are always identity-verified. Attribute-to-Policy Mapping Engine ----------------------------------- **From Directory Metadata to Endpoint Behavior** The core intelligence of identity orchestration lies in mapping IdP attributes to Hexnode enforcement logic. ### Attribute Translation Logic User metadata is transformed into organizational placement, policy assignment, and access scope without manual intervention. IdP AttributeHexnode Mapping TargetEnforcement OutcomeDepartment = FinanceFinance Organizational UnitFinancial application deployment and restrictive firewallLocation = LondonEMEA Organizational UnitRegional DAFS routing and Wi-Fi certificate assignmentGroup = TechniciansAdministrative RoleScoped RBAC access within the management console### Operational Effect Users receive the correct policies, apps, and access privileges immediately upon authentication, regardless of geography. Large-Scale Deployment Readiness Checklist ------------------------------------------- **Operational Validation Before Global Rollout** 1. Establish SAML or OIDC trust by registering Hexnode as an enterprise application in the primary IdP 2. Enable SCIM 2.0 provisioning by configuring the Hexnode SCIM base URL and secret token in the IdP 3. Define attribute schemas that map custom IdP fields such as cost center or region to Hexnode tags 4. Execute a controlled pilot with approximately 10,000 users to validate authentication, provisioning, and deprovisioning flows Strategic Outcome ------------------ This identity integration framework enables **real-time, attribute-driven, and lifecycle-aware endpoint management** at extreme scale. Identity becomes the trigger, the control surface, and the enforcement signal across devices, networks, and administrative access. In short, **directory events become security actions**, without latency, manual intervention, or architectural fragility.