Omnichannel Retail SSO

Modern luxury retail is omnichannel by necessity: an associate checks stock in the POS, looks up an online order in the e-commerce backend, pulls a client’s history from the CRM, and arranges a transfer in the inventory system — sometimes within a single client interaction. At this retailer, each of those systems demanded its own login. Associates lost minutes per sale to re-authentication, and IT lost visibility into who was actually signed in where.

The retailer wanted one session that carried an associate seamlessly across every channel, anchored to a single source of truth.

The challenge

Four systems meant four credential sets, four password-reset queues, and four places to forget to revoke access when someone left. The omnichannel promise — one fluid experience for the associate and the client — broke against a wall of repeated logins.

Worse, the fragmentation made security guesswork. With sessions scattered across independent systems, no one could answer cleanly who had an active session in which channel, and offboarding meant chasing accounts across four backends.

What Veripass deployed

Veripass delivered single sign-on across the POS, inventory, e-commerce, and CRM. The retailer’s corporate directory in Microsoft Entra ID remained the source of truth; Veripass federated to it over OIDC, and each downstream system trusted the Veripass session rather than maintaining its own login. An associate authenticated once and moved across all four channels without re-entering credentials.

Account lifecycle ran through SCIM from the corporate directory, so a new hire appeared across every channel from one provisioning event, and an offboarded associate lost every session at once. Adaptive MFA applied at sign-in, escalating over email or phone TOTP when a session originated off the store network.

• Single sign-on across POS, inventory, e-commerce, and CRM
• Entra ID federation over OIDC with the corporate directory as source of truth
• SCIM provisioning and deprovisioning for unified account lifecycle
• Adaptive, step-up MFA over email and phone TOTP
• Context-aware policy by channel, role, and network location
• RBAC via claims, capabilities, roles, and access profiles
• API keys for machine-to-machine traffic between retail systems
• Immutable audit trail of authentication across all channels

Authorization stayed channel-aware through layered claims, capabilities, roles, and access profiles, so the same session granted the right surface in each system without over-provisioning. Machine-to-machine traffic — inventory syncs, order webhooks — authenticated with API keys instead of borrowing a human session.

Outcome

Associates dropped from four logins to one, reclaiming minutes on every multi-channel interaction and keeping their attention on the client rather than on login forms. IT collapsed four credential lifecycles into one provisioned from the corporate directory, so onboarding and offboarding became single events.

Security finally got a clean, consolidated audit trail of authentication across every channel — and the omnichannel experience the retailer had promised its associates stopped breaking at the login screen.