A national social impact organisation needed a dependable, unified identity platform capable of synchronising users, photos, licensing, and metadata across its entire digital estate. The existing environment had grown organically, with manual onboarding, inconsistent data, and unpredictable downstream behaviour. Every new starter triggered a chain of fragile processes that frequently broke under pressure.
FYER was engaged to design and build a complete identity automation ecosystem from the ground up. Over three months, Daniel Swithinbank engineered a multi‑stage, cross‑vendor identity fabric that now acts as the organisation’s single source of truth for identity creation, propagation, and enrichment.
A Unified Identity Fabric
The solution integrates the organisation’s HRIS, Azure AD / Entra ID, on‑prem Active Directory, CRM, internal people applications, and more than forty downstream systems. What began as fragmented components is now a cohesive identity plane where onboarding, metadata, photos, licensing, and account hygiene operate as a single, predictable workflow.
Onboarding begins in the HRIS. A validated payload triggers a Logic App that creates the identity, enriches it with required metadata, and pushes it into the hybrid identity layer. From there, the identity flows automatically through cloud and on‑prem directories, CRM, internal people apps, safeguarding systems, learning platforms, finance systems, and reporting pipelines. One workflow now drives identity propagation for nearly two hundred connected systems.
Key characteristics of the identity fabric include:
- A single onboarding trigger that fans out across cloud, on‑prem, CRM, and internal apps
- Consistent metadata enrichment across multiple identity planes
- Automated propagation into ~200 connected systems
- A design that prioritises resilience, clarity, and recoverability
Metadata and Hybrid Identity Engineering
To support internal applications, the identity model required metadata fields not natively supported by Entra. A custom Azure Function App was built to map and inject these attributes, ensuring they remained consistent across cloud and on‑prem environments. Due to a longstanding Microsoft bug, these attributes are invisible in Entra and only visible in on‑prem AD — a constraint the system was deliberately engineered to accommodate.
Hybrid identity forms the backbone of the solution. Azure‑based AD synchronises with on‑prem AD through carefully controlled rules, attribute flows, schema extensions, and OU filtering. Any change to this configuration risks breaking onboarding, photo synchronisation, CRM registration, internal people app updates, and dozens of dependent systems.
High‑risk components of the hybrid identity layer include:
- Attribute flow logic
- Schema extensions
- OU filtering
- Sync direction and precedence
- Runtime upgrades and connector behaviour
These elements were engineered with precision to ensure stability across the entire estate.
A Bespoke Photo & Licensing Engine
Photo synchronisation proved to be one of the most complex challenges. Vendor documentation was outdated, deprecated, and incompatible with modern Entra. The working solution had to be reverse‑engineered.
The final ecosystem includes a Function App and two PowerShell 7 automation scripts running on a dedicated identity server. Together, they manage photo freshness, prevent overwriting new images, avoid stale defaults, maintain licensing hygiene, and ensure that only valid, active accounts are processed.
The photo and licensing engine handles:
- Photo freshness detection
- Prevention of stale or default photo overwrites
- Active account hygiene
- Automatic licence assignment and removal
- Prevention of ghost accounts
Externally, this appears as “photo sync”. Internally, it is a full identity hygiene and licensing subsystem.
Graph API as the Operational Heartbeat
All automation authenticates through a privileged Entra application with high‑level Graph API permissions. This application is the heartbeat of the entire ecosystem. If its key expires, identity creation, photo sync, licensing updates, metadata propagation, and internal people app updates all stop instantly.
Critical Graph scopes include:
- User.ReadWrite.All
- Directory.ReadWrite.All
- Group.ReadWrite.All
- ProfilePhoto.ReadWrite
- Licensing and custom attribute scopes
The system includes operational safeguards, monitoring, and clear diagnostic pathways to prevent outages.
Operational Reliability by Design
The identity server maintains rolling logs, human‑readable diagnostics, and separate outputs for each automation component. When something breaks, the logs point directly to the cause. Daily scheduled tasks ensure consistent execution, and the environment is designed so that support teams can diagnose issues quickly without needing to understand the entire architecture.
A Three‑Month Engineering Effort
This identity ecosystem spans HRIS, cloud identity, hybrid identity, CRM, custom applications, Graph API automation, PowerShell, Azure Functions, and more than forty downstream systems. It required deep engineering knowledge across multiple vendors, identity planes, and integration patterns. The result is a stable, resilient, enterprise‑grade identity automation platform that the organisation now relies on for every onboarding, every photo, every licence, and every metadata update.
