Since SMU implemented Single Sign-On (SSO) in 2012, accessing SMU services has become more efficient by reducing the need to sign in repeatedly to every service. This is thanks to the Shibboleth identity provider (IdP), which receives the SSO authentication request, verifies your identity, and grants access without requiring you to provide an additional login during that session. Over the past twelve years since turning on SSO, many improvements have been made with authentication technology, such as biometric authentication, passkeys, and passwordless authentication. In addition, Microsoft has introduced new services that are very relevant to SMU, some of which require a change to our SSO service. OIT plans to stay ahead of these advancements and to introduce new features as they become available.
In August 2024, OIT announced that SMU would be moving to a new form of user authentication. Our new SSO provider, Microsoft Entra ID, would require users to sign in using their NetID rather than their SMU ID number. Realizing this would be a significant change for most of the user populations, including alumni and parents, OIT initiated an aggressive communication campaign. We needed to make the entire SMU community aware of the coming change but also wanted to encourage everyone to adopt the new logon format even before the move to Entra ID in December.
Planting the Seeds for Change
In July 2023, IAM Lead Tommy Doan reached out to Associate CIO of Infrastructure David Nguyen. “I’ve got a bold idea I need to discuss with you.” He explained that Microsoft’s future for authentication protocols requires the use of Entra ID for SSO, and that SMU needed to start planning for a massive change in how it implements our SSO service. This would be a significant change in terms of effort and impact, and would initiate a strategic move to pivot SMU away from Active Directory toward the Microsoft cloud. By October 2023, a project plan had been submitted to move SMU to Entra ID for SSO service.
After meeting with Leadership and University Governance, the Entra ID Implementation Project was approved and kicked off in the Spring of 2024. This project impacted not only students, faculty, and staff but also anyone signing into SMU services, such as alumni, authorized payers, and retirees. The goal was to migrate to Entra ID as the primary SSO solution, which would be the first phase, and allow the University to take advantage of enterprise-grade security and management capabilities.
Growing a Plan
The project had several key deliverables, such as securely synchronizing password hashes to Entra ID, creating a lookup page where users can find their NetID, an extensive communication campaign about NetID, and, of course, the technical changes to make Entra ID our new SSO provider.
Since Entra ID requires users to enter their NetID, awareness about the NetID was a significant component of the project. The project team began collaborating with other areas within OIT to create the MyProfile page, which allows users to easily look up their profile information, including their NetID. After a few weeks of internal testing and revisions, the page was announced. Tommy highlighted, “The MyProfile.SMU page was crucial to the success of the project.”
To help increase visibility for the page, a new tile was added in my.SMU to allow quick access to the MyProfile.SMU page. While users had been able to use their NetID to sign in to services for some time, awareness of this functionality was low, and it was now time to raise that awareness.
Since notifications would be required for such a large number of people, individualized email communications containing NetIDs were delivered by University affiliation. For example, former students and retirees received three direct communications starting in November. Parents and Student Authorized users received four notices beginning in October. Faculty, staff, and students received many types of notifications, including regular email messages, monthly updates in the OIT Newsletter, regular posts and reels on social media, and displays around campus on digital signage. In total, over a hundred thousand email messages were sent throughout the course of the project.
OIT recommended that users update their password managers and begin using their NetID for SSO logins before the switch happened on December 26, 2024. This would help establish the habit of using the NetID before it became a requirement. After that implementation date, the SMU ID number was no longer a valid username for SSO logins.
Starting in December, a NetID countdown clock and informational video were added to signs across campus as a final communication push to encourage users to start using their NetID. This massive communication campaign helped reduce the number of logon-related problems when users returned from Winter Break in January.
Setting the Foundation
“There really isn’t a good time to change how everyone signs in,” reflected David Nguyen, but the goal was to complete the switch by the end of the year—both an ambitious and challenging timeframe. This schedule allowed for other related projects to move forward without further delay. OIT received quite a bit of feedback and opinions about the project schedule, and after careful consideration, the Leadership narrowed the change date down to three options, one of them being a contingency date. In the end, December 26, 2024, was selected as the most opportune time that would represent the least disruption to campus operations and to the user community, especially in the unlikely event that the change might not go as expected.
The Launch
At 12:01 a.m. on December 26, several members of OIT signed on and began the process of moving the University to Entra ID for SSO service. The servers were updated, and the team tested and retested for the initial launch. A little after 2 a.m., Entra ID was working flawlessly, and systems were accepting NetID logins. At 8 a.m., multiple OIT service admins began confirming that their managed services had experienced no adverse impact, and by 8:30 a.m., we were ready to announce that NetID was required for user authentication for all SMU online services.
To help users adjust to or overcome challenges with the new authentication format, the IT Help Desk was made available for two days during the Winter Break to answer questions and to help troubleshoot any problems resulting from the change. During the break, the IT Help Desk fielded more than 500 calls and tickets.
The Return to Campus
One significant impact of the change to our new SSO provider was that all users would be prompted to log on again to SMU services, such as my.SMU and Canvas, and this time would, of course, require the NetID. This included logging in again on mobile devices that connect to campus Wi-Fi and email services. Users with Teams-enabled desk phones would also need to sign in again using a device login code.
The weekend after the change, Chief Information Officer Michael Hites was on campus and noticed that all of the phones on his desk had been signed out. While it had been made clear that users would need to sign in again to all services, it was determined that the impact on desk phone users may not have been adequately featured in the communications campaign. An additional email notification was drafted, approved, and scheduled to appear in employee inboxes on the first day after Winter Break.
Upon returning from break, “The IT Help Desk received very few reports of technical or usability issues related to the NetID project, but we did get many questions about the timing of the change,” commented Help Desk Manager Evan Jewell. “My support team relayed that a significant amount of discussion was put into the timing of the change, its relation to the academic calendar, the overall impact to campus, and technical difficulty for our user community.”
Summary
We realize this was a significant change for the community, so we would like to thank all of you for your flexibility and support. Our move to Entra ID for SSO service has enabled some very significant new opportunities for the University, so stay tuned for some exciting announcements coming soon!
