Merkur Versicherung: Role-Based Identity & Access Management with Garancy

From Individual Tickets to Centralized Access Rights Management

Founded in Graz in 1798, Merkur Versicherung AG is Austria’s oldest insurance company. At the same time, the company has continuously evolved its processes and IT landscape. During the pandemic, for example, Merkur already had its “eWorkplace” in place – a digital workplace where correspondence is received electronically and routed to the appropriate employees via workflows.

As the number of applications grew, so did the demands on access rights management. For every system, it must be clearly defined who is allowed to access what – and for how long.

Before Garancy was introduced, access rights were managed through the Jira ticketing system. Business departments submitted individual tickets for the permissions they required, which were then implemented by administrators of the respective target systems.

The problem was that access rights were assigned to individual users rather than based on roles. Every request required a separate ticket, and there was no centralized overview showing who had which permissions at any given time.

This created additional work, particularly during external audits. The required information had to be gathered from individual systems and the ticketing platform.

From a security perspective, Merkur therefore needed a centralized solution that could provide transparency into who has which access rights – while making it just as easy to reliably grant those rights as it is to revoke them.

Flexible Integration as a Key Selection Criterion

In 2019, Merkur Versicherung decided to introduce a centralized IAM solution. Together with an external consulting company, it evaluated the market. Of the ten vendors initially considered, three were shortlisted. Garancy ultimately emerged as the preferred solution.

One of the key selection criteria was the ability to integrate with the insurer’s individual IT landscape. In addition to Microsoft Active Directory and other connected systems, Lotus Notes, eWorkplace, and the internally developed Merkur Information System (MIS) all needed to be integrated. In particular, connecting the company’s custom-developed core insurance software played a decisive role.

Roles Instead of User-Specific Permissions

In parallel with the introduction of Garancy, Merkur Versicherung developed a new role model. Existing systems and access structures were thoroughly analyzed and streamlined.

Which access rights to folders, files, and systems were still actually required? Which permissions had accumulated over time but were no longer needed? And which needed to remain in place?

The new role model provided the foundation for answering these questions systematically.

Since Garancy was introduced, new permissions have been assigned based on roles. The relevant role information is maintained in the Infoniqa HR system. Details such as department and job profile form the basis for two fundamental role types: an organizational role and a business role.

The organizational role represents an employee’s department, while the business role describes their specific responsibilities. IT defined these roles in coordination with system owners and the responsible business departments.

Instead of manually creating users in individual applications via tickets, Infoniqa transfers the role profiles to Garancy, and the IAM system assigns the corresponding access rights.

As part of regular recertification, managers review whether roles and permissions continue to match each employee’s responsibilities.

Self-Service: Managers Take Control of Team Access

In addition to the core organizational and business roles, Merkur Versicherung uses functional roles. These allow managers to grant or revoke additional, granular access rights for individual employees – for example, for specific projects or temporary cover. In total, Merkur Versicherung has created around 1,000 roles.

Business departments were gradually integrated into the new access rights management process. Line managers can now manage access rights for their teams directly through the Garancy portal without involving IT in every change.

This is particularly useful for short-term substitutions. Where a Jira ticket previously had to be created and processed by IT, the relevant functional roles can now be managed directly through the portal.

This gives business departments greater flexibility while reducing recurring administrative work for IT.

Automated and Time-Limited Access Rights

The role-based model also helps Merkur Versicherung prevent inappropriate access rights from remaining in place when employees change departments or leave the company.

Garancy also makes it possible to define start and expiration dates for roles. If, for example, a project-related permission should only remain valid for a specific period, its subsequent revocation can be handled automatically. This eliminates the need to create a separate manual ticket for the change.

With Garancy Access Intelligence Manager, IT can also analyze access rights and the associated risks. The solution provides dynamic 360-degree monitoring as well as a historical view of access rights data.

This enables IT to generate reports on access structures, identify potential access risks, and perform multidimensional analyses.

Bringing HR, Business Operations, and IAM Together

The benefits of automation are particularly evident during onboarding. Previously, it could take several days before new employees had all the accounts and access rights they needed. A manager first had to create a ticket, which was then processed by the responsible IT administrators.

Today, the process begins directly in the HR system. As soon as HR enters a new employee’s data, the relevant information is passed through the IAM system to the downstream processes.

Garancy therefore serves as the interface between HR, business operations, and system administration. Changes originating in HR can flow directly into access rights management.

The advantages of this approach are also evident during organizational change. Following Merkur Group’s acquisition of Nürnberger Versicherung AG’s Austrian business in 2022, around 120 employees were to be integrated into the group. The corresponding roles first had to be prepared. Once the new employees were registered in the HR system, Garancy could assign the appropriate permissions based on those roles.

IAM Implementation Completed Entirely Remotely

Merkur Versicherung’s IT landscape is operated in an external data center. The Garancy specialists also implemented and configured the IAM solution there and provided the required training.

The implementation was completed entirely remotely. Technical challenges also had to be addressed when integrating individual target systems – for example, when applications did not initially support access via a standard interface.

Greater Transparency for Audits and Access Governance

One of the key benefits of the centralized IAM platform is greater transparency into existing access rights. For audits, information no longer has to be painstakingly gathered from different target systems and tickets. Instead, centralized access rights management provides the foundation for more transparent and traceable reviews.

At the same time, role-based access assignment, regular recertification, and time-limited access rights support the implementation of IT security and Governance requirements. Garancy Access Intelligence Manager also gives IT the tools to systematically analyze access structures and identify potential risks.

Scalable IAM for a Growing Organization

Merkur Versicherung’s success story demonstrates how a historically grown, user-specific approach to access rights management can be transformed into a centralized, role-based IAM structure.

Garancy connects HR data, roles, and permissions with the relevant target systems. Managers can independently manage defined access rights for their teams, while IT gains a centralized view of access structures and potential risks.

This gives Merkur Versicherung the foundation for more efficient processes, greater transparency, and access rights management that can flexibly adapt to organizational change.