Reducing “work about work” while securing a global organization
Work management platform Asana helps users, teams, and AI to collaborate effortlessly. While the larger organization is dedicated to connecting and enabling global teams, the company’s IT team mirrors this core mission internally, focusing on providing simple, secure, and collaborative solutions for employees. This is particularly true as they design and manage identity infrastructure. “Identity is at the heart of Asana’s security and lifecycle story. It’s a crucial pillar of how we operate as a business, and we believe it should be the simplest, easiest experience for our end users,” says Tucker Perry, head of IT systems engineering.
Since its founding in 2008, Asana's rapid growth from a scrappy startup to an enterprise organization outpaced its identity infrastructure. Ultimately, growing pains from this transition became a security and operational headache for Asana's IT team. Identity was fragmented and was left to individual teams to manage. Onboarding and offboarding employees, which involved manual provisioning across more than 345 applications, could take hours and were prone to errors. This lack of centralized identity management not only made the IT team’s job a constant battle against manual tasks, but it also posed significant compliance challenges with standards, such as ISO and GDPR.
The team recognized that a major shift was needed to propel the organization to the next stage. “We needed a one-stop-shop to manage access, policy enforcement, and oversee who has access to what,” Perry shares. This search for a modern, scalable identity infrastructure brought them to Okta.
From manual chaos to compliant, day-one productivity
To scale their team without the same old headaches, the Asana team integrated their HR platform, Workday, with Okta to unify identity and establish a single source of truth. With Universal Directory and Lifecycle Management working together, the team can fully automate joiner, mover, and leaver activities. Rather than spending hours per person manually granting application access, new employees have instant, secure access to all of the tools they need the moment they log in. “From an IT perspective, automating with Okta ensures we're not a blocker for onboarding and offboarding,” says Johan Dowdy, global head of IT and IT security. “For our end users, it means they can be immediately productive on day one.”
Customizable role-based access controls (RBAC) enable Asana to delegate access to specific applications, minimizing the risks associated with compromised credentials or insider threats. Users who no longer need access are automatically deprovisioned, ensuring that only those with a need have access to the necessary applications. On the backend, the team no longer relies entirely on Super Admin to manage access; automated controls with Okta limit access to those who need it and reduce errors associated with manually managed controls. “Okta keeps everything secure, and it's designed so our team can be incredibly mobile,” Perry says. “Our salesforce can be anywhere in the world, and people can still access it within our boundaries.”
Meanwhile, employees with rightsized permissions can easily access their applications via Single Sign-On. Eliminating the need for multiple passwords and inconsistent password policies not only improves overall security, but it also means employees can quickly and efficiently access the tools they need to be productive from day one. “No one wants to dig through a wiki or a how-to guide to find the apps they need,” Dowdy shares. “Now, every employee knows that if they need a specific application, they can go to Okta, see, and access what they need with a click of a button.” Asana also secures these applications with an additional layer of security beyond passwords. With adaptive Multi-Factor Authentication, the company offers flexible factors along with WebAuthn to meet and exceed modern security standards without introducing friction for employees.
Creating a robust identity ecosystem with an extensible platform
In addition to keeping accounts secure, the IT team relies on Okta’s extensibility to deliver on their enablement strategy. Okta serves as a hub for employees across the organization to securely interact with identity to quickly and easily meet their needs. “Okta is the facilitator of our self-service options,” Dowdy adds. “We want as many of our platforms as possible to be self-service, and having a single identity solution that connects across those platforms makes that feasible.”
Beyond individual users requesting access, larger groups such as the people team can manage identity-related tasks through other applications. For example, when necessary, they can trigger a fully automated offboarding workflow from a slash command in Slack. Since Slack is one of Asana’s communication channels, connecting it directly to Okta also ensures the team is alerted in real time when administrative access privileges change. “Bringing Okta and Slack together means I can be notified of unusual activity that might be completely benign,” Perry says. “If that activity is ever malicious, I can trust that I’ll see it, and my team can take steps to respond quickly.” Systems like these enable Asana to handle more requests at scale, freeing up time for both employees and the IT team, who would otherwise have to manually attend to requests while keeping the organization secure.
Empowering IT to focus on innovation and growth
With Okta automating the tedious, manual work of identity management, Asana’s IT team can scale and keep its sights on the organization's future. “Okta is a force multiplier for us,” Perry shares. “We hire talented people, and through automations, we get to apply their skillsets to interesting problems.”
By enabling these employees to refocus, the team can prioritize new projects. For example, they’ve now automated the process of supporting team members whose devices are either lost or damaged. Rather than having the IT team clear sessions and manually restore access to apps individually, users can simply reset their Okta password and MFA, then resume work on a new device.
The time saved from these automations has also been reinvested directly into the team, as members spend more time on learning and development opportunities, improving employee retention and satisfaction. “The time we save trusting identity to Okta allows us to upskill our teams,” Dowdy says. “We have former IT support members who now work within our identity team, and it’s because we can offer them opportunities to grow instead of just entering data.”
Continuing to scale identity alongside evolving security standards
With a solid identity infrastructure in place, Asana can focus on adopting new best practices and continuously improving its identity program to take the business to the next level. This evolution from startup to a structured, systemic enterprise organization is supported by technology partners like Okta, which help Asana’s IT team scale without having to build new solutions themselves. The team can trust that when they need new solutions to secure their next stage of growth, they can turn to Okta. “When we're asked to update our identity needs, we know that Okta will help us,” Dowdy says. “We don’t have to find a workaround or build a manual process from scratch like we did as a startup. Okta is our one-stop shop for resolving those issues now.”
The team sees more opportunities within the existing Okta ecosystem, such as Device Access, to protect Asana’s most important data. “Our partnership with Okta is constantly evolving,” Perry says. “The platform is the best in its class.”
About Asana
Asana is a leading work management platform for human + AI collaboration. Over 170,000 customers rely on Asana to align teams and accelerate organizational impact. Whether it’s managing strategic initiatives, cross-functional programs, or company-wide goals, Asana helps organizations bring clarity to complexity—turning plans into action with AI working alongside teams every step of the way. To learn more, visit www.asana.com.
