CASE STUDY · PROFESSIONAL SERVICES · INTEGRATION
Automated Provisioning Scales to 125,000 Users at a Global Professional Services Firm
One of the world's largest Active Directory environments now provisions without manual bottlenecks.
The Enterprise Challenge
Every practitioner’s product access ran through a separate interface inside one of the world’s largest Active Directory environments.
The client is a global professional services firm providing a broad range of services, including audit, consulting, financial advisory, risk advisory, and tax. Its workforce of 125,000 users operates inside one of the world’s largest Active Directory (now Entra ID) environments, where every practitioner’s productivity starts with having the right accounts and access on the systems their engagements require.
The firm faced significant challenges from a fragmented provisioning process and a lack of integration among multiple critical systems. Employees frequently encountered delayed network access, duplicate Active Directory accounts, and inefficient, redundant data entry across disparate platforms, leading to decreased productivity and slow response times across the full 125,000-user base. The firm needed one multi-tiered system to unify its siloed platforms and consolidate provisioning.
The Solution
At a Glance
A global professional services firm’s 125,000 practitioners each needed access provisioned through a separate interface for every system inside one of the world’s largest Active Directory environments. i3solutions automated provisioning into a single system, removing the manual bottlenecks.
Consolidating multiple interfaces into one automated system shortened account creation, update, and disable times across the 125,000-user environment, eliminated duplicate Active Directory accounts, and moved every access request through a management approval workflow.
Strategic Trigger
Fragmented Provisioning at 125,000-User Scale
The firm’s provisioning problem was structural multiplication: every siloed system meant another interface, another data entry, and another chance for accounts to drift out of sync. At 125,000 users, the drift produced duplicate Active Directory accounts and access delays as a routine condition rather than an exception.
The firm committed to one multi-tiered system to unify its siloed platforms and consolidate provisioning, with three objectives at the center: provisioning email accounts, safeguarding the IT infrastructure, and establishing a unified global identity with single sign-on capabilities.
Conditions That Triggered the Engagement
- Provisioning fragmented across disparate platforms, each with its own interface and its own data entry
- Employees encountering delayed network access and duplicate Active Directory accounts at a 125,000-user scale
- Redundant data entry multiplying manual errors and slowing response times organization-wide
Provisioning Fragmentation Is Fixable Without Discarding Existing Systems
This firm kept every platform it already ran; what changed is that one application now fronts all of them. If provisioning fragmentation is the issue in your environment, replacing the underlying systems usually isn’t required to fix it.
Stakes
Every Delayed Account Is Billable Time Lost
In a professional services firm, the workforce is the product, and a practitioner waiting on network access is capacity the firm cannot bill. Multiplied across 125,000 users, delayed access and slow response times were a direct productivity cost that recurred with every hire, transfer, and engagement change.
The infrastructure stake compounded it. Duplicate accounts and unintegrated provisioning paths are also a control problem: access that exists outside a governed process is access the firm cannot fully audit, in an industry where client confidentiality and access control are the franchise.
Constraints and Complexity
One of the World’s Largest Directory Environments
The scale set the engineering bar: one of the world’s largest Active Directory environments, serving 125,000 users, integrated with core productivity, database, and network technologies. A provisioning system at that scale has to propagate a single account across every production system automatically and reliably, or it simply relocates the fragmentation.
The integration surface added SAP, which had to be linked to the corporate directory, and the governance requirement was absolute: a workflow and approval module ensuring every new access request receives management authorization before the user touches sensitive data or applications. The solution also had to preserve the firm’s existing IT investments rather than replace them.
Selection Rationale
Senior Microsoft Specialists with Proven Delivery Depth
The engagement required integration engineering at enterprise scale: Microsoft BizTalk as the provisioning backbone, secure web services for account management, SAP-to-directory linkage, and an enterprise application integration layer disciplined enough to carry every access request through approval.
The firm engaged i3solutions, a Microsoft Partner with 30 years of delivery experience and 1,500+ Microsoft engagements, delivered by an all-senior, all US-based delivery team. Provisioning one of the world’s largest directory environments is not a first-project assignment; it is the kind of work that firms bring to engineers who have integrated at scale before.
The Engagement Approach
i3solutions consolidated provisioning into a single application that propagates one user account across the firm’s production systems, with approval governance on every request.
PHASE 01
Provisioning Path Consolidation Design
i3solutions mapped the firm’s provisioning paths across its siloed platforms and designed a single multi-tiered system to replace the separate interfaces, unify data across applications, and preserve the firm’s existing IT investments.
PHASE 02
BizTalk Provisioning Implementation
i3solutions delivered the Microsoft BizTalk implementation enabling user provisioning within one of the world’s largest Active Directory environments, with secure web services carrying account creation, update, and disablement.
PHASE 03
EAI Pilot and SAP Integration
The firm’s pilot Enterprise Application Integration provisioning system was introduced, and SAP was linked to the corporate Active Directory, extending the unified identity across the firm’s business systems.
PHASE 04
Approval Workflow and Rollout
A workflow and approval module was built in so every new access request receives management authorization before the user touches sensitive data or applications, completing the governed path from request to provisioned access.
Technical Transformation
The system centers on Microsoft BizTalk as the integration backbone for user provisioning within one of the world’s largest Active Directory (now Entra ID) environments, supporting 125,000 users. Administrators create a single user account that propagates automatically throughout the firm’s production systems and applications, integrated with core productivity, database, and network technologies. Secure web services carry the account operations, sharply reducing the time needed to manage user accounts and access. The SAP system is linked to the corporate directory, so business-system identity stays consistent with network identity, and a pilot Enterprise Application Integration provisioning layer extends the pattern across the application estate. Single sign-on establishes a unified global identity across applications. The workflow and approval module routes every new access request through management authorization before access is granted, putting governance inside the provisioning path rather than around it. Consolidating provisioning into a single application eliminated the separate interfaces, unified data across applications, and preserved the IT investments the firm had already made.
Measurable Outcomes
One System, 125,000 Users
A single automated system now creates, updates, and disables accounts across the full environment, with approval built in.
| Outcome | Before | After |
|---|---|---|
| Account lifecycle time | Separate interface on every system | Shortened, one automated system for create, update, disable |
| Network access for new hires | Frequently delayed | Reached sooner, with less downtime organization-wide |
| Duplicate Active Directory accounts | Routine at scale | Eliminated |
| Data entry | Redundant across disparate platforms | Single entry, unified data, sharply fewer manual errors |
| Access governance | Ungoverned paths across silos | Every request through management approval workflow |
| IT operating cost | Manual, repetitive provisioning work | Lowered, automated workflows off IT support staff |
New hires and existing employees reach the systems they need sooner, with less downtime organization-wide. The integrated solution eliminated duplicate Active Directory accounts and repetitive data entry, sharply reducing manual errors.
Single sign-on unifies identity management, and every access request goes through a clear, automated approval workflow. Building on BizTalk and IT investments the firm already owned lowered the administrative burden: automated workflows take repetitive tasks off IT support staff, decreasing operational expenses.
Who This Engagement Serves
This engagement is relevant for
- A large enterprise whose provisioning runs through a separate interface on every system, with duplicate accounts and delayed access as routine symptoms
- An organization operating a very large directory environment that needs one account to propagate automatically across production systems, including SAP
- An IT or security leader who needs management approval built into the provisioning path, not bolted on after access exists
Less relevant for
- You are evaluating a modern cloud-native IGA suite for a greenfield environment rather than consolidating provisioning across substantial existing IT investments
- You are an organization small enough that provisioning friction has not yet become a measurable productivity or control problem
What This Engagement Established
Consolidation Returns More Than It Costs
The engagement established that provisioning fragmentation is fixable without discarding the systems that produced it. The firm kept its platforms and its IT investments; what changed is that one application now fronts them all, one account propagates everywhere, and one approval workflow governs every request. It also established the scale ceiling for the pattern: one of the world’s largest Active Directory environments, 125,000 users, SAP linked to the directory, and single sign-on across applications. For organizations still provisioning system by system, the lesson is arithmetic: every separate interface is time, errors, and ungoverned access that consolidation removes.
Frequently Asked Questions
It is a single application through which every user account is created, updated, and disabled, replacing the separate provisioning interface each system otherwise carries. In this engagement, i3solutions delivered a Microsoft BizTalk implementation serving one of the world’s largest Active Directory environments, supporting 125,000 users at a global professional services firm. Administrators create one user account and it propagates automatically across the firm’s production systems, including SAP, which was linked to the corporate directory. Single sign-on establishes a unified global identity, and a workflow module routes every new access request through management approval before the user touches sensitive data or applications.
In this engagement, i3solutions built on what the firm already owned rather than replacing it. The design consolidated provisioning into a single multi-tiered application, unified data across the siloed platforms, and preserved existing IT investments, with Microsoft BizTalk as the integration backbone and secure web services carrying the account operations. Governance was designed into the path: the workflow and approval module means no access exists that management did not authorize. The three objectives set at the start, provisioning email accounts, safeguarding the IT infrastructure, and establishing a unified global identity with single sign-on, defined what done looked like.
The BizTalk integration layer connects the provisioning application to the firm’s core productivity, database, and network technologies. When an administrator creates a user account, secure web services carry that single record to each integrated system automatically, so the account exists everywhere it should without per-system entry. The SAP linkage keeps business-system identity consistent with the corporate directory, and the pilot Enterprise Application Integration layer extends the same routing pattern across the application estate. Updates and disablements travel the same path, which is what eliminated the duplicate Active Directory accounts and the redundant data entry that fragmented provisioning had produced.
In this engagement the returns were operational and organization-wide: shortened time to create, update, and disable accounts; new hires and existing employees reaching the systems they need sooner with less downtime; duplicate accounts and repetitive data entry eliminated, sharply reducing manual errors; and lower operational expenses as automated workflows took repetitive tasks off IT support staff. The governance return sits in the mechanism itself: every access request now passes management approval before access exists. An enterprise sizing its own return should count its provisioning interfaces, the elapsed time from hire to full access, and the duplicate or orphaned accounts its directory currently carries.
i3solutions is a Microsoft Partner with 30 years of delivery experience and 1,500+ Microsoft engagements, with every engagement staffed by an all-senior, all US-based delivery team. This engagement is among the largest of its class: provisioning for 125,000 users in one of the world’s largest Active Directory environments, BizTalk integration across productivity, database, and network technologies, SAP linked to the corporate directory, and approval governance on every request. A scoping conversation inventories your provisioning paths, shows what a single-application approach would replace, and gives you comparable engagements to reference when you build the internal case. The scope conversation is concrete from day one.
The firm’s environment serves 125,000 users in one of the world’s largest Active Directory (now Entra ID) deployments. The provisioning system propagates a single user account across its multiple production systems and applications.
It was not for this client. The solution consolidated separate provisioning interfaces into one application, unified data across existing systems, and preserved the IT investments already in place rather than replacing them.
Related Insights
More From i3solutions
Related Engagements
125,000 Users, One Governed Account Lifecycle
This is the scale ceiling the pattern was proven against: one of the world’s largest Active Directory environments. We’re glad to discuss what a comparable consolidation would look like at your scale.
