Authentik

Replacing an identity provider can lock users out of many systems at once. Inventory every application connected to authentik, including its protocol, attribute mapping, groups, and recovery path. In a staging environment, migrate one low-risk app and test ordinary login, denied access, account disablement, and MFA recovery.

Review session lifetime and logout behavior across devices, then check audit records for each event. Keep a break-glass administrator account independent of the new provider during the trial. Do not retire old connections until application owners confirm that permissions are unchanged. A successful sign-in screen alone does not prove the authorization model survived.