Soffid Solutions for Telco & Media:

This requires architecturally separating subscriber-facing identity traffic — authentication volume, self-service password resets, account changes — from the workforce identity/governance workload, even when both run on the same underlying platform, so a spike in subscriber logins doesn't compete for the same processing capacity as internal access certification jobs. Telcos that don't separate these tend to discover the coupling only when a subscriber-facing event, such as a billing change or promotional signup wave, causes internal access requests to slow down, which is avoidable with the right architecture from the start.

Because OSS/BSS systems hold the operational "DNA" of the business and are rarely good rip-and-replace candidates, governance needs to connect to their existing account and permission model through integration rather than requiring the OSS/BSS itself to change — bringing its accounts into the same certification, segregation-of-duties, and audit cycle as newer systems without touching the core stack. This mirrors how mainframe and legacy core-banking systems get governed elsewhere: wrap and integrate, don't replace, and the modernization timeline for the OSS/BSS itself becomes a separate, unblocked conversation.

Static role assignments don't work well here because call center populations are large, high-turnover, and often outsourced, so access needs to be scoped tightly by task — view billing but not modify service, or handle support tickets without account-level financial actions — and tied to active employment or contract status with the outsourcing partner, not a role that persists after someone leaves the vendor's team. Continuous certification matters more for this population than for stable internal staff, since the outsourcing partner's own turnover isn't always visible to the telco in real time.

The balance comes from defining access tiers that map to actual operational need — field technicians get scoped access to the specific network elements or regions they service, engineers get broader diagnostic access without automatic write/config rights, and time-bound elevation is used for the specific tasks that need it — rather than a blanket "network team" role that grants uniform access regardless of task. Overly rigid controls become a bottleneck specifically when access requests require manual approval during time-sensitive network incidents, so the design goal is fast, auditable elevation for genuine emergencies rather than broad standing access to avoid friction.

Moving identity data into hybrid or multi-cloud environments means residency and lawful-intercept obligations now have to be enforced at the data-location level, not just the policy level — where identity data physically resides, and which jurisdictions' authorities can compel access to it, becomes a deployment decision as much as a compliance one. This is where hybrid or on-prem deployment options for the identity platform itself matter for telcos specifically, since keeping certain identity data on carrier-controlled infrastructure while still running governance centrally is often the only way to satisfy both cloud economics and regulatory residency requirements at once.

Privileged account sprawl in telcos usually happens because each operational system — billing, network management, CRM/CDP — has historically had its own administrator population with no shared oversight, so the fix is a single governance view that inventories privileged accounts across all of these systems together, with one team accountable for reviewing them even though the systems themselves stay operationally separate. Without that consolidated view, "who has admin on what" is a question no single team can currently answer completely, which is precisely the audit and incident-response gap this creates.

A realistic path treats each acquired business unit's directory as a separate but governed identity source initially — bringing it under a shared certification and policy framework without forcing immediate technical migration — and only consolidates directories technically where and when it's operationally safe to do so, rather than mandating a single cutover across all inherited systems at once. This lets the telco get consistent governance and audit visibility across the merged organization quickly, while the slower, higher-risk work of actually merging directories happens on its own timeline per business unit.