---
title: "Identity is the real lock-in"
url: "https://sovereos.com/blog/identity-is-the-real-lock-in"
description: "Companies worry about moving their documents. The thing that actually holds them in place is the directory every other system trusts to say who you are."
---

# Identity is the real lock-in

August 6, 2026·2 min read·SovereOS

When a company thinks about changing platforms, it thinks about files and mail. Those are the visible things, and they are also the portable ones — mail exports, documents export, and neither is where the difficulty is.

The difficulty is the directory: the system that holds who works here, what they are allowed to do, and which every other system trusts when it asks whether you are you. Move that and everything else follows. Fail to move it and nothing else really moves either.

## Why it holds everything

**Every application trusts it.** Single sign-on means each system delegates the who are you question. That is genuinely good architecture and it also means the directory is a dependency of everything at once.

**Groups became permissions everywhere.** A group created for one purpose is now used by six applications to decide access. Those uses are undocumented and discovered by breaking them.

**Joiners and leavers run through it.** The one process that must not fail, because a leaver who retains access is a security incident and a joiner who cannot log in is a wasted week.

**Devices are enrolled against it.** Laptops and phones are tied to identity for management and encryption. Moving identity means re-enrolling every device, which means touching every person.

## What makes it worse than it needs to be

The lock-in here is partly inherent — some of it is just what happens when everything depends on one thing — and partly manufactured.

Attributes that exist only in one vendor’s schema and have no equivalent elsewhere. Conditional access rules expressed in a proprietary policy language. Group membership that cannot be exported with its history. Licence bundles that make the directory nominally free while making anything else expensive. Each is defensible on its own, and together they are a moat.

## What owning it looks like

Not necessarily running your own directory server in a cupboard. Owning it means four specific things:

**The authoritative record is yours.** People, roles and groups exist in something you control, and other systems synchronise from it rather than being the source.

**The protocols are standard.** Standards-based authentication, so an application trusts a token rather than a vendor. This is what makes replacement possible without touching every app.

**The policies are readable.** Access rules written as something you can export, review and recreate — not a configuration screen whose contents exist only in one console.

**The leaver process is documented and tested.** Because it will be the thing an auditor asks about, and because it is the process where an unowned directory hurts most.

## The order that works

Identity first, then everything else. It is the least visible part of a migration and the one that determines whether the rest is possible, which is exactly why it tends to be scheduled last and then abandoned.

A company that owns its identity can move mail, documents and applications one at a time, at its own pace, and can change its mind halfway. A company that does not owns nothing in practice, whatever the rest of the contract says — because every other system is only ever one federation setting away from being unreachable.

-   identity
-   SSO
-   directory
-   migration

## Keep reading

-   [Your continuity plan is one person](https://sovereos.com/blog/your-continuity-plan-is-one-person)
-   [Nobody in your company can price the exit from your own IT](https://sovereos.com/blog/nobody-can-price-the-exit)