Rebuilding IAM for enterprise admins

The situation

Okta was closing enterprise deals on a console built for smaller companies.

The administrative surfaces had been designed for an admin managing a few hundred users. The accounts Okta was now winning had tens of thousands, nested org structures, and compliance teams auditing every permission change. The same screens were being asked to do a job an order of magnitude larger.

It showed in the places that cost money: onboarding time in enterprise implementations, support volume on the four highest-traffic admin flows, and — the one that reached the executive staff — deals where a competitor demoed better against the same requirements.

There was a second audience on the same platform. ISVs publishing to the Okta Integration Network, and the developers wiring Okta into their own products, hit the same surfaces from the other side. Their onboarding was a separate problem with the same root: a set of screens that assumed you already knew the model.

What was at stake

Renewal risk
Admin experience was surfacing in 1 of every 4 enterprise renewal conversations as a stated concern.
Implementation cost
Enterprise onboarding ran 14 weeks, most of it spent teaching admins around the console rather than through it.
A frozen roadmap
Four squads were each patching the same surfaces independently, so every fix made the next one harder.

My scope

I owned the design strategy for the admin console across four squads, while it kept working the whole time.

What I owned: The design strategy for the admin surface end to end — entitlements, role management, the OIN publishing flow ISVs use to ship an integration, and developer onboarding — plus the sequencing of what got rebuilt in what order and the case to the executive staff for the funding. I designed the entitlements and role-management flows myself; they were the model everything else had to agree with.
What I influenced: Each of the four squads had a designer owning their surface outright — flows, specs, and the working relationship with their PM and engineering lead. My part was the seams, where one surface had to agree with the next.
Who I worked with: Six designers: four embedded in squads, one on the design system, one on research. Each squad's PM and engineering lead, and the IAM product leadership group.
Who I reported to: The Director of Design, with a dotted line into the IAM product leadership group I sat in weekly.
How I was measured: Task completion time on the four highest-volume admin flows, enterprise implementation time, and — informally but persistently — whether the four squads stopped diverging.

The hard call

We rebuilt underneath live tenants instead of behind a migration.

The clean version of this project is a new console behind a flag, a migration window, and a cutover. Engineering wanted it. It is easier to build, easier to test, and easier to demo.

I argued against it. Our largest customers could not take a cutover on our schedule — an identity console is the thing you touch when something has gone wrong, and asking a security team to relearn it on a date we picked was a request they would refuse. A migration would also have meant a long period where the old console kept receiving fixes, which was the exact problem we were trying to end.

So we rebuilt surface by surface, in place, on the live product. It cost us: every change had to be safe next to screens that had not been rebuilt yet, and the design system had to absorb both vocabularies at once. The design system designer spent most of two quarters on that seam alone. That was the trade — a slower, uglier build, in exchange for never asking a customer to stop working.

An identity console is what you open when something has already gone wrong. That is not a screen you get to move on your own schedule.

How the work got made

Four squads had been drifting apart. I built the three things that held them together.

A critique with a decision at the end
Weekly, 60 minutes, two pieces of work maximum. Every critique ended with a named decision and an owner. Before this, the team had a review meeting that generated opinions and no record of what had been settled.
The system as a contract, not a library
A component entered the system when two squads needed it, not when one designer built it. That rule cut the amount of near-duplicate work the design-system designer was arbitrating, and it made "is this in the system?" a question with an answer.
Research on a rota
One researcher, six designers, so I put the sessions on a rota — every designer sat in on admin research once a month, whether or not it was their surface. The point was shared evidence: arguments about what admins do got shorter when everyone had watched the same sessions.

The part I would not compromise on was that squad designers made their own calls. My review was at the seams — where one squad's surface met another's — because that was where the divergence had happened, and it was the only place where a view across all four was genuinely better than the owner's.

The craft

What the rebuilt surfaces actually do.

The through-line across all four surfaces: an admin at enterprise scale is almost never looking at one object. They are looking at a set — every user matching a condition, every policy touching a group — and deciding what to do to the whole set. The old console was built around the single-object page. The rebuild is built around the set.

Directory. Filtering builds a set; the set is the thing you act on. The preview panel shows what a change will do before it is applied — the single most requested behaviour in research.

Policy builder. Every policy shows its evaluation trace: which rule matched, in what order, and who it affects right now. Admins were previously reconstructing this by hand in spreadsheets.

Audit. Built for the compliance reviewer rather than the admin — a different reader, on the same data, which is why it is a separate surface and not a tab.

Accessibility was a hard gate rather than a review step. Every surface is keyboard-operable end to end, every state carries a text equivalent, and the bulk-action patterns were tested with screen-reader users before they shipped — a console that an admin cannot operate without a mouse is a console some admins cannot do their job in.

Impact

What changed, for the business and for the craft.

Business

-32%: Admin task time, across the four highest-volume flows
-27%: Support volume on rebuilt surfaces
9 wks: Enterprise implementation time, down from 14

Craft

64: Shared components, consolidated from 212 one-off variants
0: Migration windows asked of customers

The number I care about most is the last one. We shipped a rebuild of the core administrative surface of an identity product without once asking a security team to stop what they were doing.

What I'd do differently

Two things I got wrong.

I underestimated the seam
One designer held the design system across two vocabularies for two quarters. That was a structural cost of the in-place rebuild, and I should have planned for it from the start, and argued for a second designer on the system, instead of treating it as a system role that happened to get busy. It was the closest anyone on the team came to burning out, and that was my sequencing, not their capacity.
I built the executive case too late
I made the argument for funding after we had evidence, which felt rigorous and cost us a quarter. The evidence was not going to change the decision — the console was visibly failing enterprise deals. I would now make the case early on the strength of the business risk and use the research to shape the plan rather than to justify it.

The interesting parts are confidential.

The rest of this one needs a password.

Okta was closing enterprise deals on a console built for smaller companies.

Renewal risk

Implementation cost

A frozen roadmap

I owned the design strategy for the admin console across four squads, while it kept working the whole time.

We rebuilt underneath live tenants instead of behind a migration.

Four squads had been drifting apart. I built the three things that held them together.

A critique with a decision at the end

The system as a contract, not a library

Research on a rota

What the rebuilt surfaces actually do.

What changed, for the business and for the craft.

Two things I got wrong.

I underestimated the seam

I built the executive case too late