One of the most significant opportunities for universities looking to modernize Identity and Access Management (IAM) is moving from multiple accounts per person to a Single Digital Identity.
Historically, many universities have maintained separate accounts for individuals based on their relationship with the institution, such as student, staff, researcher, contractor, or alumni accounts. While this approach often emerged from genuine legacy constraints, it has created increasingly complex identity environments in which individuals may have multiple usernames, credentials, and accounts. Introducing a Single Digital Identity model addresses this challenge by providing each individual with one username, UPN, and primary account, with their different relationships to the university represented through roles and entitlements.
This blog explores the case for adopting a Single Digital Identity approach within higher education, the benefits it can deliver, and the challenges universities may face when moving away from long-established legacy arrangements.
Universities manage some of the most complex identity lifecycles of any organization, with an individual potentially joining the institution as an applicant, becoming a student, taking on employment, continuing as a researcher, and eventually becoming an alumnus — sometimes holding several of these roles simultaneously. However, many university systems were not designed to support this complexity and instead assumed that an individual would belong to a single population or role at any given time. This has historically led to separate accounts being created for students, employees, researchers, and other groups.
While this approach may have addressed specific system limitations, it has created a wider Identity and Access Management (IAM) challenge: the same person may be represented several times across the digital estate with each identity having its own credentials, permissions, data, and lifecycle. As a result, it can become more difficult to establish who an individual is, understand the full extent of their access, and determine which account should remain authoritative when their relationship with the institution changes.
A Single Digital Identity offers a different approach, allowing the natural transitions within a university identity lifecycle to be managed through one authoritative identity. In practice, it means that changes to roles, affiliations, entitlements, applications, licenses, and security policies replace the creation, migration, or retirement of separate accounts.
This simplifies joiner, mover, and leaver processes, reduces the need for manual reconciliation, and, importantly, allows individuals to retain continuity of their digital presence as their relationship with the university evolves. When an individual's circumstances change, the institution can update their roles and associated access without creating a new identity. For individuals who hold multiple roles simultaneously, it also provides a way to manage those roles within a single identity while ensuring that associated access remains visible and appropriately governed. In this way, a Single Digital Identity provides a more coherent, secure, and manageable identity environment across the institution, rather than simply reducing the number of accounts.
In higher education settings, maintaining multiple identities for the same individual poses a significant security challenge. Unsurprisingly, increasing the number of accounts, credentials, and access permissions that must be managed makes it harder to apply consistent security controls and maintain clear visibility of an individual's overall access. Multiple identities can result in issues like dormant or forgotten accounts, inconsistent MFA enforcement, differing password policies, excessive or duplicated privileges, and accounts remaining active after an individual's relationship with the institution has changed.
Each additional identity also increases the number of credentials and authentication pathways that need to be protected and monitored, expanding the institution's overall attack surface and creating greater opportunities for inappropriate or unauthorized access. The problem becomes more difficult when the same individual holds several identities that are managed separately, as security teams may have to correlate multiple accounts before they can understand a person's full level of access.
A Single Digital Identity provides a clearer and more complete view of an individual, making it easier to apply security controls consist across all of their access to university systems. Measures such as password requirements, conditional access, and account monitoring can be applied uniformly, regardless of the roles or affiliations associated with the individual. This is particularly valuable for people who hold multiple roles simultaneously, such as a postgraduate researcher who is both a student and an employee and may therefore legitimately require a broader range of access. Crucially, that access can still be viewed, understood, and reviewed as a whole, rather than being fragmented across separate identities.
By reducing this fragmentation and providing a single, consistent view of an individual's identity and access, the benefits extend beyond security and governance to the everyday experience of the people using university services.
As well as presenting a security risk for institutions, fragmented identity models also create unnecessary complexity for users. This can lead to confusion over which account or credentials to use, correct systems and services, and a greater reliance on support teams to resolve account and access issues. For example, an individual with separate staff and student accounts may need to remember several usernames and passwords, respond to repeated MFA challenges, and work out which identity should be used for a particular system.
As the number of accounts increases, users are more likely to adopt less secure authentication habits, such as reusing passwords, choosing simpler passwords, or relying on whatever sign-in method is easiest to manage. Responsibility for authentication also becomes fragmented across several accounts, making it harder for both the user and the institution to maintain a consistent level of security. This often leads to authentication problems and users accessing services through the wrong account. For the institution, these issues create additional service desk activity and administrative effort.
A Single Digital Identity provides a more straightforward sign-in experience by managing authentication through one primary identity. More importantly, bringing an individual's roles, access, and responsibilities together under one identity gives the university greater visibility and oversight, rather than requiring information to be understood across multiple, disconnected accounts.
Effective identity governance depends on having a clear view of who has access to systems and data, why that access has been granted, and whether it remains appropriate. When the same individual holds several identities, this view can become disjointed, with one account appearing correctly configured while additional access, data, or ownership remains attached to another account belonging to the same person. This can make access reviews and audits more difficult, while also creating practical challenges when an individual's role changes.
A Single Digital Identity brings an individual's roles, entitlements, and digital history together under one primary identity, providing governance and audit teams with a clearer basis for reviewing access, understanding how permissions hr time, and establishing ownership of data and records. It can support access certification, segregation-of-duties analysis, audit traceability, and regulatory compliance, while reducing the need to correlate multiple usernames across different systems. For the institution, this creates a more complete record of who had access to what and how their relationship with the university changed over time.
For most universities looking to move to a Single Digital Identity model, it will not be as simple as merging a few accounts. Identity information is typically distributed across student information systems, HR platforms, research systems, and other services, with different systems often holding their own records and varying information about the same individual. As a result, establishing a single, authoritative view of each person requires an understanding of how identities are created, linked, and managed across the wider digital estate.
A practical starting point is to identify where duplicate identities are creating the greatest security, operational, or user-experience challenges. This may include student employees, postgraduate researchers, visiting academics, and individuals transitioning from study into employment, as these groups can highlight where the existing model creates duplicated access, additional administration, or confusion for users. Understanding these scenarios can help the institution identify where a Single Digital Identity would deliver the greatest immediate benefit while also informing the longer-term approach.
Higher education institutions can then assess key areas of the current identity landscape, including:
Which systems create or hold the authoritative identity record
Where the same individual has more than one account
How student, staff, and research records are linked
Which roles and affiliations determine access
Which systems continue to require separate accounts
Which email, files, licenses, and other data are associated with existing accounts
How password, MFA, and other security controls are currently applied