A full implementation typically takes 4–6 months from discovery through go-live, depending on complexity. Organizations with simple directory structures and 3–5 connectors may complete in 3–4 months. Those with complex role models, many legacy integrations, or geographically distributed teams may take 6–9 months.

The timeline breaks down roughly as follows:

• Discovery & Assessment: 2–4 weeks
• Architecture & Design: 3–5 weeks
• Core Build & Integration: 6–10 weeks
• Testing & UAT: 3–6 weeks
• Go-Live & Knowledge Transfer: 2–4 weeks

Overlap between phases (parallel work streams) can shorten the total calendar time. Phased rollouts—where you implement connectors or features incrementally—also affect duration.

Yes, many organizations prefer a PoC first. A typical PoC scope might include discovery, a simplified architecture for 1–2 connectors, and a basic midPoint instance in your test environment. This usually takes 4–8 weeks and costs roughly 30–40% of a full implementation.

A PoC serves several purposes:

• Validates that midPoint meets your technical requirements
• Lets your team experience the platform and operational model
• De-risks the full implementation by identifying integration challenges early
• Provides concrete data for budget and timeline planning of the full project

We can discuss a PoC scope in your initial consultation.

Your core contribution is expertise and decision-making authority from your organization:

• Stakeholder availability: Key people from IT, HR, security, and operations for discovery, design review, and testing.
• Business requirements & process documentation: How identities currently flow through your organization (joiner, mover, leaver, role changes, approvals).
• Access to existing systems: Network access, credentials, and documentation for the systems you want to integrate (AD, HR system, databases, APIs, etc.).
• Test environment & data: A staging environment where we can build and test the midPoint platform, plus test data (anonymized user records, test account credentials).
• Approval authority: Clear decision-making channels so we don’t get stuck waiting for approvals.
• Infrastructure & support: Database, servers, networking, backups, and change control processes to support production deployment.

We provide the midPoint expertise, methodology, and hands-on delivery. You provide domain knowledge, environment access, and decision authority. It is a partnership.

During the first 2–4 weeks after go-live, we provide on-call support to address any issues that emerge in production. We help troubleshoot, document fixes, and ensure your operations team is confident running the system.

After that initial support window, support options are flexible:

• Fully independent: Your operations team manages the system, with on-demand consulting available if you hit blockers.
• Managed support retainer: Fixed monthly support hours for questions, minor enhancements, system monitoring, and proactive optimization.
• Break-fix consulting: You reach out as needed; we scope and deliver based on hourly rates or fixed packages.

The deliverables and knowledge transfer we provide during the implementation are designed to set your team up for independence. We also document all configurations and decisions so any competent identity engineer can maintain the system.

Yes. One of midPoint’s strengths is flexibility and extensibility. After go-live, you can:

• Add new connectors to integrate additional systems (e.g., add a second HR system, add a specialized database).
• Modify the role model, governance rules, or approval workflows as business requirements evolve.
• Extend the platform with custom code, scripts, or connectors for specialized scenarios.

We design the initial architecture to anticipate common additions (e.g., room for 5–10 connectors, scalable role model, well-structured codebase). We also document the architecture and all customizations so future changes are manageable and low-risk.

Many of our clients add connectors or features incrementally in the year following go-live, either with our support or independently with their own teams.

Some systems are difficult to test safely (e.g., production HR systems, highly regulated databases, legacy systems without staging environments). We use several strategies:

• Connector design review: We design the connector in detail with your subject matter experts before any code is written. This catches issues before implementation.
• Staged rollout: We build the connector in a test environment, then implement it against a real staging copy of the system, then carefully schedule production activation with your operations team standing by.
• Documentation & automation: We provide detailed technical documentation, runbooks, and (where possible) automated monitoring and alerting so you and your system owner can validate behavior in production with minimal disruption.
• Parallel run & rollback: For critical integrations, we run the connector in read-only or shadow mode first to validate behavior before fully activating it.

The key is planning. We discuss integration risk in the architecture phase and adjust timelines and testing strategies accordingly.

Scope changes are normal and expected during large projects. Our approach is to manage them transparently:

• Document the change: We capture what is changing and why.
• Assess the impact: We analyze the impact on schedule, effort, and cost.
• Get approval: We present the change request to your project sponsor for approval and sign-off.
• Adjust the plan: We update the timeline and deliverables accordingly.

This process keeps surprise cost and schedule overruns from happening. We do not silently expand the project.

That said, the phase-gated methodology is designed to catch many potential requirements early, during architecture and design, before we start building. So by the time we reach core build, scope is usually stable.

Cost depends primarily on:

• Scope: Number and complexity of connectors, size of role model, custom logic required.
• Complexity: Simple deployments integrating 3–4 standard connectors cost less than complex environments with many legacy integrations or custom business logic.
• Your involvement: Organizations that provide timely access, clear requirements, and quick approvals see faster delivery and lower cost.
• Timeline: Phased implementation over 6 months may have different labor patterns than a compressed 3-month implementation.

A typical small-to-medium implementation (5–7 connectors, defined role model, standard approval workflows) in a T&M engagement runs 1,500–2,500 billable hours over 4–6 months. A fixed-scope phase for Core Build & Integration might be €80k–150k. A full start-to-finish implementation might range from €150k–350k depending on the above factors.

We provide a detailed cost estimate and timeline after the discovery and architecture phases, when scope is clear. There are no surprises.

Yes, and many organizations prefer phased approaches for budget, resource, or risk reasons. A phased implementation might look like:

• Phase 1 (Months 1–3): Discovery, architecture, and core build of the first 2–3 priority connectors (e.g., AD and HR system).
• Phase 2 (Months 4–6): Add 2–3 additional connectors (e.g., email, VPN, specialized database).
• Phase 3 (Months 7–9): Enhance governance, add advanced workflow, integrate additional systems.

Phased implementations spread cost and resource commitment over time. They also let you prove business value early, which helps justify additional phases.

The architecture and design work we do in Phase 1 anticipates the full scope, so adding connectors in later phases does not require rework of the core system.