This case study provides an inside look at how this not-for-profit health system’s seamless migration from Okta to Entra lead to $1.5M in annual savings and improved security posture.
Meet the Client
With over 50,000 employees across the United States and Latin America, this leading international nonprofit health system is a major player in the Health & Life Sciences industry. With a deep commitment to delivering high-quality, patient-centered care while maintaining rigorous security and compliance standards across its digital infrastructure, they knew modern identity was key.
The client was struggling with a multifaceted identity modernization challenge. Their existing identity provider, Okta, supported over 58,000 user accounts and 150+ applications across SAML, OIDC, and RADIUS protocols. The organization knew it needed to transition to Microsoft Entra to consolidate identity management, reduce licensing costs, and align with their broader Microsoft ecosystem.
The Challenge
Despite knowing the organization needed to transition to Microsoft Entra, the road to migration was anything but straightforward, with several challenges preventing them from making the move to Microsoft Entra:
SCALE & COMPLEXITY
- The client had over 58,000 identities and more than 150 SSO applications that needed migration.
CITRIX ENVIRONMENT CONSTRAINTS
- Citrix sessions were not trusted on-site, which would cause repeated MFA prompts and loss of user profiles and favorites. This behavior, confirmed by Citrix, posed a significant risk to clinical workflow continuity.
VENDOR COORDINATION
- Live cutovers had to be orchestrated across several critical third-party applications, including Concur, Inkling, CensiTrac, and BNY Mellon.
IDENTITY REMEDIATION
- The client’s ongoing M&A activity meant fragmented organizational units and domains that all had to be consolidated into a single migration-ready structure prior to making the move.
GUEST & CONTRACTOR ACCESS
- Misalignment between expected guest access capabilities and Entra’s MFA enrollment model required custom architecture and design intervention.
The Solution
Microsoft recommended Cyclotron as the preferred partner based on our proven track record of success with complex identity migrations and our proprietary Okta-to-Entra migration platform, Cyclotron Beam. Beam leverages sophisticated automations and stringent security methodologies to reduce migration time and labor by more than 60%, making it an ideal fit for the client’s aggressive timeline and high-stakes environment.
The client partnered with Cyclotron to execute a full-scale migration from Okta to Microsoft Entra, including a Beam-powered migration of all identities and applications organization-wide (excluding South America tenants), identity remediation, Okta defederation planning, application wave planning, and organizational change management (OCM).
The migration presented several technical hurdles that required close coordination and rapid problem-solving. One of the most complex challenges involved Citrix trust behavior and Primary Refresh Token (PRT) inconsistencies, which led to unexpected MFA prompts and disrupted user sessions. Near the go-live window, VPN group policy changes introduced additional variables. Cyclotron worked closely with the client to mitigate these issues, ensuring continuity for clinical staff.
Coordinating live vendor cutovers across more than 200 applications required meticulous planning and execution, with Cyclotron facilitating seamless transitions for critical systems. Additionally, the guest access model posed unique challenges, particularly around contractor workflows. Cyclotron architected a custom solution that aligned Entra’s capabilities with the client’s operational needs, ensuring secure and compliant access for non-employee users.
The complexity of this migration demanded not only technical precision but also deep collaboration. Over the course of the engagement, Cyclotron coordinated over 100 meetings with stakeholders across the client’s different teams, without a single meeting cancellation. Feedback from the client’s team reflected genuine appreciation for Cyclotron’s consistency and responsiveness, the strategic partnership and expertise our team brought to every meeting with technical and leadership teams alike, and our ability to mobilize quickly and adapt to complex hurdles throughout the project.
The Client Impact
Measuring Outcomes Across the Entire Enterprise
In less than 7 months, Beam automation enabled the client to complete what would have taken an estimated 18 months with traditional migration methods. Now, over 64,000 identities and 203 applications, 30% more than originally scoped, were migrated seamlessly in a fraction of the time, with high data integrity and reduced operational risk during cutover.
In addition, the migration with Cyclotron Beam delivered significant strategic and operational benefits.
THE BENEFITS
Cost Savings:
- 3 months after this migration wrapped, the client cancelled their $1.5 million annual renewal Okta contract.
Security Posture:
- MFA enrollment exceeded 40% during the go-live window, with continued growth expected.
Operational Efficiency:
- Consolidation onto Microsoft Entra simplified identity management and reduced help desk burden.
Compliance Assurance
- Cyclotron maintained full compliance with all data protection requirements, with no HIPAA or PHI incidents occurring during or as a result of the migration.
The project positively impacted teams across Enterprise IT, Clinical Informatics, Help Desk, and vendor IT partners, maintaining momentum and minimizing disruption throughout the migration.
This migration illustrates how automation, technical expertise, and collaborative execution can enable large-scale identity transitions in even the most complex and high-stakes environments—without compromising security, compliance, or continuity of care.
Ready to Migrate?
Let’s get into action. If your organization is considering a move from Okta to Microsoft Entra, or simply wants to understand what Beam migration could look like in your environment, get in touch or schedule a migration assessment at cyclotronbeam.com/get-in-touch.