As digital learning has shifted institutions worldwide, Instructure has become a dominant force in the edtech industry. Acquiring six new brands and the explosion of virtual learning have made Instructure’s solutions essential for institutions worldwide. This rapid pace of development created operational complexity, prompting the team to evaluate how to scale their security architecture without increasing operational overhead. They recognized that to protect sensitive learner data, they needed to move beyond fragmented, manual processes that diverted crucial resources.
To address these challenges, Instructure sought a solution that could scale alongside their team, evolve with changing requirements, and provide unified visibility across their entire tech stack. They partnered with Okta to integrate their disparate identity security functions into a single, cohesive identity security fabric. This unified approach enabled them to orchestrate security outcomes and automate complex identity processes, driving efficiency while maintaining rigorous data security.
Navigating bottlenecks in manual identity management
While Instructure’s manual identity tasks helped build a secure foundation, exponential growth pushed the processes to their limits. Maintaining manual oversight was no longer sustainable as they continued to scale and defend against increasingly sophisticated security threats.
In this era of rapid growth, support tickets increased as more employees requested access. “From justifying the need and chasing manager approvals to updating permissions, our access request process used to be a series of manual hurdles,” says Dowis Toillolo, IT help desk manager.
Instructure solved this by automating these hurdles within their identity security fabric. Today, more than 66% of the help desk’s access-related tickets are processed entirely by Okta, allowing the team to focus on strategic initiatives rather than right-sizing permissions. This transformation addressed a common challenge: without a unified platform, teams are forced to stitch together disparate processes, resulting in operational inefficiencies.i
This overhead extended to critical lifecycle and governance functions. Previously, deactivating a single account required a complex chain of Jira tickets, manual data exports, and spreadsheet tracking—a process that cost a system administrator a full day of work every week. By offloading these repetitive, tedious tasks to the Okta platform, the team has reduced manual offboarding time by 90%.
Manual security access reviews for compliance standards, such as SOC2, were also a major drain, pulling two senior IT staff from high-value security initiatives for an entire month. Even after weeks of effort, a 60% response rate forced the team to spend hours on manual follow-ups. “People view access certifications as an obstacle,” says Ashley Taylor, IT security analyst. “We needed to transform this from a hurdle into a process that is simple and efficient for everyone involved.”
Weaving security through every step of account management
As employee counts continued to multiply, Instructure shifted their attention toward greater automation to further secure workforce onboarding. By weaving together Okta Identity Governance (OIG), Workflows, Lifecycle Management, and Identity Threat Protection (ITP), the team built an extensive system that orchestrates security across the entire identity journey. With over 558 Workflows, the team crafted a deeply connected identity security fabric that automates and protects their workforce at scale.
When new hires are entered into the HR system, they are automatically granted access to "birthright" applications through Okta based on their role. This includes employees who joined via acquisitions, drastically reducing the time required to integrate them into the Instructure environment. “Okta makes it possible for us to onboard hundreds of users at once during an acquisition,” says Andrew Herrera, system administrator. “We just add the company’s applications and users to Okta, and we’re done.”
This consolidation has also allowed Instructure to implement phishing-resistant authentication. By utilizing FastPass, employees can access their apps securely with a fingerprint, helping the company move toward a passwordless future that reduces potential vulnerabilities. These interconnected activities form a frictionless, orchestrated identity security process that grants and revokes access instantly.
Creating a fully-integrated security fabric with a “well-oiled” governance machine
Where governance was once a grueling, manual task, the Instructure team has turned it into a well-oiled, automated machine. By leveraging data and the visibility provided by OIG, the team has transformed a compliance exercise into a proactive security function. This updated process has also driven the response rate from application managers to more than 99%, thanks to official emails and improved simplicity.
The tedious work of importing, exporting, and manual ticket creation is now handled entirely within their identity security fabric. “As beta testers for OIG, we worked closely with Okta to steer the product, and it’s become one of our most valuable tools,” Taylor says. While the team previously supported only six manual access certification campaigns per year, they now run more than 75 campaigns and complete them 97% faster. “We’ve been able to automate most of our access campaign work,” says Taylor. “It now takes one of us a day of work instead of two of us spending a full month of our time.”
The same identity fabric has also driven down costs through software rationalization and license management. With access requests and reviews centralized in OIG, the IT team gained visibility into how licenses are used across the business. “We realized we could consolidate based on the usage numbers we saw from our reports in OIG,” Herrera says. “We were able to limit our licenses for large vendors to as-needed requests, which saved us more than $200k in annual costs.”
Securely scaling with end-to-end protection and visibility
Beyond automating governance, Instructure’s identity security fabric helps ensure a secure journey through continuous, real-time protection. By replacing vulnerable passwords with phishing-resistant authentication via FastPass, the team established a foundation for secure workforce onboarding from day one. To extend this, they added ITP to monitor active sessions and prevent session hijacking and other advanced threats. “Identity Threat Protection covers attack vectors like session hijacking or impossible travel without impacting users,” Herrera says. “If a user is logged out due to a false positive, they simply use their fingerprint with FastPass to get right back to work.”
This orchestrated identity security enables Instructure to move beyond fragmented tools, driving deeper security outcomes. “We’ve historically used log data as a manual pulse check,” Taylor says. “If ITP flags an identity as high-risk, we now have the ability to automatically lock the account and trigger re-authentication or access certification.”
Protecting growth through ongoing access and identity security
As Instructure continues to innovate, the team is designing even more interconnected onboarding and day-one access Workflows. This includes a "just-in-time" access model that grants users access to specific applications only as needed during training. This approach will further drive software rationalization efforts, minimizing license sprawl while ensuring that new users have access only to the tools they need, when they need them.
By continuously weaving new capabilities into their identity security fabric, Instructure is prepared for the next phase of growth. “Our success has come hand-in-hand with Okta’s growth,” Herrera says. “Mature companies need partners whose platforms complement growth and are flexible enough to adapt to business needs. Leveraging Okta has made securing, managing, and governing identities at scale doable.”
About Instructure
Instructure is shaping the future of learning by delivering a future-ready ecosystem that helps learners thrive in tomorrow’s landscape. Our vision is to drive a future where education technology seamlessly amplifies human potential, empowering people to excel in a perpetually changing world. Instructure is setting potential in motion by connecting educators, institutions and learners across K–12, higher education and the workforce—enhancing experiences at every age, every stage and every pivotal transition.
