Identity and Access Management (IdAM)

⁠⁠⁠Requirements

The National Indigenous Australians Agency (NIAA) is seeking a specialist ICT supplier to design, implement, and transition a modern Identity and Access Management (IdAM) capability as part of its transition from PM&C shared ICT services.

This procurement will establish a secure, sovereign, and NIAA-controlled IdAM capability within NIAA’s Azure environment, replacing the current highly customised and partially legacy identity environment and removing dependencies on PM&C-managed identity services.

The engagement requires the supplier to deliver end-to-end IdAM services, including current-state assessment, requirements definition, solution design, implementation, integration, migration, testing, and transition to business-as-usual operations.

This is not a like-for-like migration. The supplier is expected to assess the existing environment and design a future-state capability, including options analysis and recommendation of an appropriate identity solution aligned to NIAA’s operational, security, and governance requirements.

The future capability must support a cloud-native, scalable identity architecture, aligned with Microsoft technologies (including Entra ID where appropriate), and designed to meet Australian Government security and compliance requirements for a PROTECTED environment, including PSPF, ISM, and Essential Eight Maturity Level 2.

Key requirements include:

• Decoupling from shared services: Safely remove NIAA’s dependency on PM&C identity infrastructure and services while maintaining continuity of access across corporate and line-of-business systems.
• Current-state assessment and options analysis: Analyse identity sources, lifecycle processes (Joiner/Mover/Leaver), integrations, and dependencies, and provide solution options with costings and recommendations.
• Target architecture and design: Develop a future-state identity architecture and detailed design, including identity data flows, role and attribute strategy, governance controls, and a plan to modernise Single Sign-On and retire legacy ADFS dependencies.
• Identity lifecycle and governance capability: Implement an Identity Governance and Administration (IGA) capability, including automated provisioning and deprovisioning, access requests and approvals, privileged access controls, and audit logging.
• Integration and migration: Integrate with a diverse portfolio of corporate and business systems using appropriate methods (e.g. API, SCIM, SFTP, orchestration), and deliver a detailed migration and sequencing strategy to support safe transition.
• Testing, cutover and transition: Deliver testing, pilot and phased onboarding, cutover planning (including rollback), and post-implementation hypercare support.
• Operational readiness and handover: Provide documentation, training, support processes, and knowledge transfer to enable NIAA to operate and sustain the capability in a BAU environment.

Delivery must follow a structured three-phase approach (Design, MVP, Optimisation), including defined deliverables and formal acceptance at each stage to ensure effective governance, risk management, and value for money.

This capability is a critical dependency within NIAA’s ICT transition program, underpinning identity lifecycle management, authentication, and access control across multiple enterprise systems. Successful delivery will provide a sustainable, secure, and modern identity foundation to support NIAA’s ongoing operations and future digital initiatives.