How unis can deliver secure digital access to their diverse communities

Australian universities are under more pressure to deliver secure, frictionless digital experiences to a diverse population of students, staff, researchers, alumni and partners.

Legacy systems and homegrown authentication tools that once got the job done are now liabilities. They are costly to maintain, difficult to secure, and increasingly out of step with what a digitally fluent student cohort expects.

The sector cannot afford to get this wrong. Education remains the top five sectors by volume of data breach notifications to the Office of the Australian Information Commissioner (OAIC). In 2025, education accounted for over a third (36 per cent) of the data breaches reported.

A stark reminder that identity sits at the centre of exposure to cyber risk is how recent attacks in the education sector persistently compromise vital student data – such as names, contact details, and identification numbers – across education institutions globally. Having visibility over who is accessing what is no longer optional.

A newer version of the same problem is now emerging across campuses: the decentralised rollout of agentic AI. Individual faculties, research teams, and departments are using their own AI agents largely outside the visibility of central IT. These agents often hold powerful database credentials and operate at machine speed, with none of the built-in accountability a human user has.

Here are five key considerations for those rethinking their Identity and Access Management (IAM) approach.

1. Simplicity beats a custom build

Building a bespoke IAM system in-house is tempting, but it’s expensive to build and even more expensive to maintain over an institution's lifetime. 

Before adopting our single cloud identity platform, Flinders University was running around 250 administrative systems, patched together with ageing directories, and fielding close to 3,000 password reset requests a year.

Off-the-shelf platforms that are purpose-built for educational institutions can integrate legacy, modern and cloud applications without months of custom development. Flinders now handles fewer than 400 resets annually, saving its IT team real time and budget.

The goal of an IAM is to make the technology invisible so students can focus on their studies. Flinders’ own commencement process was once so cumbersome that staff had nicknamed it ‘87 Steps to Flinders.’ 

After consolidating identity onto a single platform, new students, staff and casual academics can now activate their accounts in under 60 seconds, a small change that creates lasting first impressions.

2.  Bring every division into the room early

Faculties, campuses and research units all have different identity needs, from student records, HR systems, guest researcher access, shared library to lab accounts. 

Global institution the University of Notre Dame found this out by managing identity across more than a dozen distinct user types including students, faculty, alumni, donors, service accounts, shared accounts, even external researchers accessing shared file systems and library collections.

Engaging stakeholder groups from the outset, rather than retrofitting their requirements after the fact, is the key factor to a smooth rollout. In this case, it allowed the university to identify edge cases early, such as status changes like student-to-alumni transitions.

3.  Treat security as foundational, not bolted on

Universities are prime targets for phishing and credential-based attacks, as they hold a valuable mix of student records, research data and financial information.

A modern IAM approach offers encryption, multi-factor authentication, and continuous visibility into who is accessing what, and from where. It needs to be built in from day one.

Notre Dame, migrating away from a homegrown system running more than 200 servers, discovered within the first 10 minutes of going live that its community was authenticating from more than 80 countries. The visibility had simply been unavailable under its previous fragmented set-up, and that immediately strengthened its ability to monitor and respond to unusual access patterns.

4. Govern AI agents like any other identity

Institutions need to get ahead of the proliferation of AI agents on campus and gain better control over what these agents can connect to and what they can do.

The modern identity security approach must govern AI agents and machine identities alongside human identities. This involves putting gates in place to discover threats operating outside sanctioned channels, scoping agent access down to only what’s necessary, and building in execution-time kill switches so a rogue or compromised agent can be shut down before it does damage.

5. Start small, move fast, and let your users make the case for you

Resist the urge to wait for a fully scoped perfect implementation plan otherwise there’s a risk that institutional inertia will swallow it. 

Flinders rolled out its first 10 integrated applications to 38,000 users inside a 10-week window, while Notre Dame cut over 18,200 students, faculty and staff to single sign-on and adaptive multi-factor authentication in just two days, timed deliberately over a quiet weekend before the start of the academic year.

Early visible wins build the internal case and give users the confidence for the larger migrations that follow. It allows the institutions to turn their own users into advocates for further investment.

A foundation for what’s next

As the threat landscape continues to evolve, institutions are turning to unified identity platforms for discovery, access, and credential lifecycle, with the flexibility to bridge legacy environments under one roof. 

For the higher education sector, it has never been more important to establish the right foundation to consolidate governance across the full campus identity landscape. 

Mike Reddie is vice president and general manager, ANZ, at Okta.

Do you have an idea for a story?
Email rcox@intermedia.com.au