Alumni Lifelong Identity

Graduation is supposed to be a beginning, but for identity systems it is usually an ending: the student account is deactivated, and with it goes access to transcripts, library resources, the alumni portal, and continuing-education tools. The graduate becomes a stranger to the institution that just spent four years getting to know them. A university wanted the relationship to continue without forcing alumni to start over.

The challenge

The university’s identity model assumed an active enrollment. When a student graduated, their account was deactivated and their access evaporated. Alumni services then issued brand-new, disconnected credentials, so graduates re-registered from scratch and the institution lost the continuity between “student” and “alumnus.” Worse, deactivated student accounts lingered with stale entitlements, and the handoff between the student directory and alumni systems was manual and lossy.

The university wanted one identity that persisted across the transition, re-scoped rather than rebuilt.

What Veripass deployed

Veripass treated the identity as the durable object and enrollment status as an attribute of it. At graduation, the person’s identity was retained and transitioned to an alumni profile rather than deactivated. Access was re-scoped, not revoked-and-reissued: student-only entitlements were removed and alumni entitlements granted through the same model of claims, capabilities, roles, and access profiles, so the graduate kept one continuous identity while their access changed to match their new relationship.

SCIM drove the transition automatically off the authoritative record, so the lurch from student to alumnus stopped being a manual handoff. Alumni continued to authenticate through federation over OIDC, and where the institution offered Google Workspace alumni accounts those federated cleanly. Context-aware policy applied adaptive step-up MFA over email or phone TOTP for sensitive alumni surfaces such as transcript requests or donation management.

Every transition and access change landed in an immutable audit trail, so the lifecycle from applicant to alumnus stayed reconstructable end to end.

• Durable identity retained across the student-to-alumni transition
• Re-scoped access via claims, capabilities, roles, and access profiles
• SCIM-driven automatic transition off the authoritative record
• Federation over OIDC, including Google Workspace alumni accounts
• Immutable audit trails spanning the full identity lifecycle

Outcome

Graduates now keep a single, lifelong identity. The disruptive re-registration disappeared: an alum signs in with a credential continuous from their student days, and their access simply reflects their new status. Stale, deactivated student accounts stopped accumulating, because the identity transitions rather than terminates.

The institution gained an unbroken relationship with its graduates, anchored to one identity that carries them from application through enrollment and into a lifelong alumni connection — with an immutable record of every stage along the way.