External identity governance

External users often need access to the organization's systems, but they are not always covered by the same processes as employees. External identity governance is about clarifying responsibility, validity and follow-up for consultants, partners, suppliers and other collaborators.

Use case

External users such as consultants, partners, suppliers and other collaborators often need access to the organization's systems and resources.

Unlike employees, external users are usually not covered by the organization's ordinary HR processes. This makes it harder to ensure who is responsible for the user, why the access still exists and when it should be removed.

Organizations therefore need to manage external identities with clear controls. This can include ensuring that:

• every external user has a responsible sponsor or contact person
• access is connected to a valid assignment or agreement
• entitlements remain only as long as they are needed
• external identities can be verified before access is granted
• responsibility relationships and access are reviewed regularly
• external users can be identified during audits and follow-up

The result is better control over external users, reduced risk of lingering access and clearer evidence for follow-up.

How Fortified ID supports this

Fortified ID Control can be used for registration, management and follow-up of external identities. Forms can support registration and changes, while self-registration can be used when the external user initiates the process.

Approval Flows can ensure that sponsors and other responsible people review and approve access. Delegated administration can allow the business to manage external users within defined boundaries, while Schedules and access certification can be used for recurring review of assignments, responsibilities and access.

Reporting and Auditing can provide evidence for following up external users, sponsors and access decisions.

Fortified ID Access can complement the process when external identities need to be verified or when access to sensitive resources must be protected. eID, strong authentication and step-up authentication can be used depending on risk level and business requirements.

Examples

• Consultants who need access during a time-limited assignment
• Suppliers who need access to specific systems or resources
• Partners who need access to shared services or portals
• External users who register themselves and verify their identity with eID
• Sponsors who regularly need to confirm that external users still have a valid assignment
• Review and certification of external users before audits or follow-up