The Legacy IAM to Modern IAM Migration Playbook 2026

Most enterprises in 2026 don't have modern IAM. They have some modern IAM layered on top of legacy IAM that was never fully retired. A cloud IdP is deployed, but half the applications still authenticate against Active Directory directly. An IGA platform is licensed, but joiner-mover-leaver still runs through tickets to system admins. MFA is enabled, but for a subset of systems using SMS OTP that doesn't resist phishing. Access reviews complete on schedule, but reviewers rubber-stamp entitlement lists nobody actually examined. The result is the worst-of-both-worlds — modern IAM cost with legacy IAM operational reality.

The migration from legacy IAM to modern IAM isn't a single project; it's a coordinated multi-phase transition that most organizations start and few complete. The gap between started and completed is where the operational pain lives. This piece is the 2026 enterprise reference on the 5-phase migration playbook that actually finishes the job — what each phase does, why the order matters, and where the migration typically stalls.

The companion pieces cover the layers each phase composes. The HRIS-Driven Lifecycle piece covers Phase 1 in depth. The SSO Architecture piece on ICC covers Phase 2. The Phishing-Resistant MFA piece on ICC and Adaptive Authentication piece on ICC cover Phase 3. The AI Access Certification piece and Best IGA Solutions piece cover Phase 4. The ISPM piece and ITDR piece cover Phase 5. The Maturity Model piece covers where each phase lands on the 5-stage maturity ladder.

Five phases, one bridge. The construction order matters — each phase depends on the operational baseline the prior phase produces.

The five markers of legacy IAM in 2026

Before scoping a migration, honestly locate where your organization is. Legacy IAM has five operational markers. Count how many apply.

Marker 1: Joiner provisioning takes days or weeks. New hires arrive on day one and don't have all their required access. IT builds access piecemeal as needs surface — Slack Monday, email by end of week, production system access sometime the following week if there's a ticket. New hires can't be productive for their first few days because the tools aren't ready.

Marker 2: Leaver deprovisioning is inconsistent. When employees leave, access removal happens manually and inconsistently. Someone in HR notifies IT; IT files tickets to system owners; system owners remove access when they get to it. Some access persists for days, weeks, or months. When auditors run the "who has access that shouldn't" check against the HR termination roster, the results are uncomfortable.

Marker 3: Access reviews are annual and rubber-stamped. Reviews happen because the compliance calendar demands them, not because the reviews actually improve access hygiene. Reviewers receive long lists of entitlements, click "approve" on most of them without engagement, and satisfy the compliance requirement without producing the review outcomes the requirement was intended to produce.

Marker 4: MFA is partial and SMS-based where deployed. Multi-factor authentication is enabled on the systems the security team identified as high-risk (the ones that got flagged after an audit finding or an incident). Other systems still authenticate with passwords alone. The MFA that IS deployed uses SMS one-time-passwords, which don't resist modern phishing attacks — attackers can intercept SMS via SIM swaps, phishing kits capture the OTP in real-time, and push-notification MFA gets bombed until users approve to make it stop.

Marker 5: Entitlements are managed through tickets or spreadsheets, not workflow. Access requests file as ITSM tickets. Approvals happen via email or Slack DM. Provisioning is manual. The "identity catalog" is a spreadsheet in the compliance team's SharePoint that's perpetually behind reality. When a new SaaS application enters the environment, it takes a few months before it shows up in the catalog if ever.

Scoring your posture:

• 0-1 markers: predominantly modern IAM. The migration is mostly done; focus on the risk-evaluation layer.
• 2-3 markers: partial legacy state. Migration is mid-flight; identify the highest-leverage next phase and execute.
• 4-5 markers: predominantly legacy. The IAM investment made so far hasn't produced the operational outcomes it was expected to. The playbook applies from Phase 1.

Most enterprises land in the 3-4 marker range in 2026. The migration is real work, but the operational lift at each phase is substantial when executed in the right order.

Five risk patterns compose into one operational profile. The migration playbook retires each pattern at the mechanism level; policy statements alone don't move any of these needles.

Legacy IAM vs modern IAM by dimension

Dimension	Legacy IAM	Modern IAM
Source of workforce truth	Manually-maintained spreadsheet or AD	HRIS (SuccessFactors, Workday, ADP, UKG) with SCIM/API integration
Joiner provisioning	Ticket-based, days-to-weeks	HRIS-triggered, same-day or pre-start
Mover handling	Manual, entitlements accumulate	Automated diff-and-substitute
Leaver deprovisioning	Manual, days-to-weeks delay	Real-time triggered, closed within 24h at 99th percentile
Authentication	Per-application passwords	Federated SSO with IdP-issued tokens
MFA	Partial deployment, SMS OTP	Universal phishing-resistant (passkeys, FIDO2, ICC)
Access request	ITSM ticket to system admin	Self-service portal with workflow approval
Entitlement catalog	Spreadsheet	IGA platform with real-time state
Certification	Annual rubber-stamp	Quarterly (or 6-month for CDE) with reviewer engagement instrumentation
Privileged access	Standing admin rights	JIT elevation with session recording
Service accounts	Undocumented sprawl	Cataloged NHI with owner, scope, rotation
Posture management	Ad-hoc audit response	ISPM continuous evaluation
Threat detection at identity layer	None or after-the-fact	ITDR real-time behavioral
Help desk volume for routine access	30-50% of tickets	Under 5%
Audit position	Scramble per cycle	Continuous readiness

Every row shifts. The cumulative operational lift is what makes the migration worth the multi-year effort.

The 5-phase playbook

The playbook is ordered because each phase depends on the operational baseline the prior phase produces. Executing out of order produces expensive tooling stacks that don't deliver the outcomes the tools were purchased for.

Phase 1 — HRIS-driven lifecycle foundation

The highest-leverage single move most organizations can make. The HRIS becomes the authoritative source of workforce identity; joiner-mover-leaver events propagate to IAM through SCIM push, delta synchronization, and full reconciliation.

Operational outcome: joiner provisioning completes same-day (typically pre-start), mover events diff-and-substitute entitlements automatically, leaver deprovisioning closes within 24 hours at the 99th percentile.

What gets retired: ticket-based joiner-mover-leaver provisioning; manually-maintained "who works here" spreadsheets; the entire class of "IT didn't know they left" audit findings.

Implementation depth: the HRIS-Driven Lifecycle piece covers the integration architecture (SCIM 2.0 push, OData delta sync for SuccessFactors, Report-as-a-Service for Workday, webhook streams, full reconciliation) and the schema mapping discipline that survives HRIS upgrades.

Common stall point: the schema mapping is harder than expected. Field renames, value-set changes, contractor-vs-employee handling, dual-role users — the corner cases dominate the integration work. Budget accordingly.

Phase 2 — Federation and SSO

Users authenticate once at the IdP; downstream applications trust the IdP token. Federation retires per-application credential management.

Operational outcome: users have one identity across the enterprise application landscape rather than 45 per-app accounts; help desk volume on password resets drops dramatically; new SaaS applications integrate through federation rather than requiring separate user provisioning.

What gets retired: per-application password stores; the "user has 45 passwords" pattern that produces credential-reuse and phishing susceptibility; per-application credential-reset workflow.

Implementation depth: the SSO Architecture piece on ICC covers the federation architecture (OIDC + SAML composition, JWT bearer for service-to-service, token binding, session management for distributed workforces).

Common stall point: legacy applications that don't federate. Some line-of-business applications from the 1990s-2000s era don't support SAML or OIDC. Options include vendor-provided SAML wrappers, third-party federation gateways, or acceptance that certain systems remain on separate credentials with additional compensating controls.

Phase 3 — Phishing-resistant MFA everywhere

MFA extends from the security team's priority systems to universal coverage, and the credential class shifts from SMS OTP to phishing-resistant credentials.

Operational outcome: every authentication event at the IdP boundary requires phishing-resistant MFA; SMS OTP is retired; password-only authentication is eliminated for any system of consequence.

What gets retired: SMS OTP (doesn't resist SIM swapping or real-time phishing); password-only authentication on critical systems; MFA gaps that leave attack paths open.

Implementation depth: the Phishing-Resistant MFA piece on ICC covers the credential class (passkeys, hardware FIDO2 keys, smart cards, the Identity Challenge Card for deviceless segments). The Adaptive Authentication piece on ICC covers the risk-based composition that reduces user friction on low-risk sessions.

Common stall point: deviceless workforce segments. Manufacturing operators, healthcare clinicians at bedside, contact center agents at shared workstations, defense workforces in classified environments — segments where smartphones aren't operationally available for MFA. The Avatier Identity Challenge Card provides deviceless FIDO2 authentication that satisfies phishing-resistant MFA requirements without smartphone dependency.

Phase 4 — IGA workflow and AI-augmented certification

Entitlement management transitions from tickets or spreadsheets to workflow with documented approval, and periodic certification with reviewer engagement instrumentation catches accumulated over-privilege.

Operational outcome: access requests flow through self-service portal with automated approval routing; certification campaigns complete on schedule with reviewer engagement evidence; audit position becomes continuous rather than periodic scramble.

What gets retired: ticket-based access request; spreadsheet-based entitlement management; annual rubber-stamp certifications; the class of audit findings that come from "we couldn't produce evidence of the review."

Implementation depth: the Best IGA Solutions piece covers platform-level evaluation. The AI Access Certification piece covers the AI-augmented certification pattern. The Access Review Auditor Wants piece covers the review discipline. The Shadow IT Provisioning piece covers the ticket-system integration that keeps shadow paths from bypassing the workflow.

Common stall point: catalog discipline. The IGA platform needs a clean identity catalog with every entitlement owned and justified. Legacy environments often have entitlement sprawl that the catalog has to absorb. Budget catalog cleanup as a real work stream, not an incidental activity.

Phase 5 — ISPM and ITDR risk-evaluation layer

Beyond workflow automation, the program now evaluates risk continuously. ISPM catches drift between certifications; ITDR watches for behavioral anomalies.

Operational outcome: posture findings surface between review cycles; behavioral anomalies produce real-time alerts; the program transitions from Stage 3 (Workflow-Driven) to Stage 4 (Risk-Driven) on the maturity ladder.

What gets retired: the assumption that "we ran the workflows so we're compliant" — replaced with continuous evidence.

Implementation depth: the ISPM piece covers the posture-audit layer. The ITDR piece covers the threat-detection layer.

Common stall point: the operational baseline from Phase 4 has to be genuinely stable. ISPM and ITDR deployed on unstable IGA workflow produce noise. Complete Phase 4 before layering Phase 5.

Where migrations stall

Three failure modes recur across 2026 stalled migrations.

Failure 1: Phase-skipping. Organizations deploy IGA (Phase 4) before HRIS-driven lifecycle (Phase 1), or MFA (Phase 3) before federation (Phase 2), or ISPM (Phase 5) before certification is mature (Phase 4). The out-of-order deployments produce expensive tooling that doesn't deliver the intended operational outcomes. The mitigation is discipline about the phase order.

Failure 2: Incomplete Phase 1. The HRIS integration covers 60% of the workforce but not the remainder (contractors from a different system, subsidiaries on separate HRIS, acquired companies not yet migrated). The 40% gap defeats the automation because manual processes have to handle exceptions, and the exceptions become the operational norm. The mitigation is completing HRIS integration coverage before moving to Phase 2.

Failure 3: Legacy system holdouts. Some legacy applications resist federation, some legacy processes resist workflow, some legacy access patterns resist certification. The migration completes for 80% of the environment and the remaining 20% becomes a permanent legacy island. The mitigation is explicit decisions about legacy holdouts — either invest in bringing them into the modern IAM envelope or accept the compensating controls needed to leave them out.

The mainframe migration path

Enterprises still running RACF, ACF2, IBM iSeries/AS400, or other mainframe-era access control face a specific migration question: rip-and-replace or federate-and-modernize? The 2026 modern pattern is federate-and-modernize — treat the mainframe as an authoritative legacy system while extending modern IAM discipline over it.

The pattern:

• The RACF/ACF2/iSeries user population becomes federated identities in the IdP through connectors
• MFA is added at the federation layer (before mainframe access) rather than at the mainframe itself
• The modernized IAM layer (HRIS-driven lifecycle, IGA workflow, certification) governs the mainframe-scoped entitlements alongside cloud and SaaS entitlements
• Direct mainframe access without federation is retired progressively (fastest for administrative access; slower for entrenched line-of-business access)

The mainframe investment is preserved; the modern operational discipline extends to cover mainframe access. Avatier has deep mainframe integration adjacency — the posts on demystifying RACF and RACF vs ACF2 mainframe access control cover the integration context.

The 2026 reference path

Honestly locate your organization. Count the 5 markers of legacy IAM. If you're at 3+ markers, the migration is worth prioritizing. If you're at 4-5, it's urgent.

Execute the 5 phases in order. HRIS-driven lifecycle first — it's the highest-leverage single move and it produces the operational baseline the other phases depend on. Federation and SSO second. Phishing-resistant MFA third. IGA workflow and certification fourth. ISPM and ITDR fifth.

Complete each phase before starting the next. Phase-skipping produces expensive tooling that doesn't deliver operational outcomes. Discipline about phase order is what separates completed migrations from perpetually mid-flight ones.

For mainframe holdouts, federate rather than replace. The modern IAM layer extends over mainframe access without requiring rip-and-replace of the mainframe investment.

Point auditors at the Trust Center for Avatier's own posture. The Avatier Trust Center with the SecurityScorecard grade view — SOC 2 Type II with zero exceptions, ISO/IEC 27001:2022, PCI DSS v4.0.1, CSA STAR Level 1, NIST 800-53 Rev. 5 aligned, CISA Secure-by-Design Pledge signatory.

Legacy IAM to modern IAM migration is the load-bearing operational shift for enterprise identity programs in 2026. The phases are settled, the architecture is well-understood, the tooling is mature. The discipline to execute in order is what determines whether the migration finishes.