University SSO Rollout and MFA Fatigue
Northgate University has 38,000 active accounts across students, faculty, and 1,200 service accounts. It is replacing LDAP plus RADIUS with a SAML identity provider for 42 SaaS applications and a new VPN. The pilot group of 500 staff reports 1,900 MFA push prompts in 48 hours; 37 users approved a prompt they did not initiate. The help desk can reset MFA in 8 minutes per call but has no way to distinguish a compromised account from a lost phone. The ERP system still authenticates with a shared 'svc_erp' account used by four batch jobs. The board wants SSO for all staff in 30 days and a single sign-on experience. The IAM team proposes number matching and moving service accounts to workload identity, but the ERP vendor supports only static credentials.
1. The CISO asks whether to pause the SSO rollout until MFA fatigue is fixed. Recommend a course of action with reasoning.
Read the worked answer
Do not pause the entire rollout; pause high-risk application cutovers. The 1,900 prompts and 37 approvals are an active MFA fatigue incident, not a pilot inconvenience. First force re-authentication and session revocation for those 37 users, and require help-desk identity proofing, such as video or manager confirmation, for MFA resets. Enable number matching and rate limiting immediately; disable push for privileged roles. Continue SSO for low-risk apps such as room booking, but keep ERP and VPN on the old path until MFA is fixed because SSO would concentrate blast radius. This balances the 30-day board deadline with risk: a full pause leaves users on LDAP and RADIUS with weaker MFA, while an unchecked cutover could let one approved push reach payroll and clinical systems. Report weekly approval rates and reset anomalies to the board.
2. Evaluate RBAC versus ABAC for the 42 SaaS applications, and propose how to handle the svc_erp shared account.
Read the worked answer
Use RBAC for coarse entitlement and ABAC for context. The 42 apps need role bundles such as student, faculty, bursar, and help desk to avoid role explosion, but high-risk actions such as grade changes or payment approvals should evaluate attributes: department, shift, device compliance, and location. Implement least privilege in the IdP, not separately in each app, and review roles quarterly. For svc_erp, the shared static password is the real issue. Move the four batch jobs to separate workload identities if the vendor supports headers or certificates; if not, vault the credential, rotate every 30 days, restrict source IPs to the four batch hosts, disable interactive logon, and alert on any use outside the batch window. Document the vendor limitation as an exception with a migration date. Break-glass: two sealed admin accounts with hardware tokens, monitored and never used routinely.