Identity transformation powers a UK critical infrastructure first

UK Power Networks delivers electricity to millions of homes and businesses across London, the Southeast and East of England. As one of the UK’s largest electricity distribution network operators, resilience runs through everything it does.

That resilience depends on more than the physical network. It also relies on the systems, processes and controls that protect the organisation every day.

Identity and access management is one of those foundations, and it is one Kocho has helped UK Power Networks build for well over a decade.

A partnership spanning three generations of identity technology

Kocho’s relationship with UK Power Networks began back in 2012, implementing the organisation’s original identity solution using Microsoft Forefront Identity Manager (FIM). As requirements evolved, Kocho upgraded the environment to Microsoft Identity Manager (MIM), which went on to serve as the backbone of identity and access management across the business for many years.

Over that time, MIM connected core systems, supported user lifecycle processes and helped ensure people had the right access to the systems and services they needed.

When UK Power Networks planned the next generation of identity management, Kocho entered the formal RFP process with experience of the existing environment and a clear view of how it could evolve. Following that process, Kocho was appointed to deliver the move from Microsoft Identity Manager to Microsoft Entra.

The result was a full transformation from Microsoft Identity Manager to Microsoft Entra, complete with modern identity governance and administration (IGA), delivered as part of one of the most significant cyber resilience programmes in the UK energy sector.

Why identity modernisation became a regulatory priority

The programme was driven by a specific and pressing need.

Following the October 2023 Ofgem Cyber Reopener, and in response to the expanded scope of the Network and Information Systems (NIS) Regulations, UK Power Networks set out to meet the Cyber Assessment Framework (CAF) Enhanced Profile.

The organisation had already attained the CAF Basic Profile.

Enhanced Profile, however, sets a higher bar, reflecting the level of cyber security and resilience expected of organisations that face more capable, better resourced and more determined attackers.

Meeting it would require improvements across the business, with identity and access management a central component to its achievement.

Building clearer governance and control with Microsoft Entra

Rather than simply recreating the existing environment on a new platform, UK Power Networks used the move to Microsoft Entra to strengthen how identity was managed across the organisation.

Working with Kocho, the programme delivered improvements across five identity initiatives:

Crucially, this work applied across all UK Power Networks sites, each treated as equally critical to the continued delivery of service to the public. Extending consistent, modern access control across the business.

Unlocking the capabilities of Microsoft Entra

Microsoft Entra gave UK Power Networks a single, strategic platform bringing identity management, governance and access control together.

Capabilities such as lifecycle workflows, entitlement management, access reviews, conditional access and privileged identity management allowed the organisation to modernise processes that had previously relied on manual effort, reduce standing privilege and gain far greater visibility and control over who had access to what, and why.

The emphasis throughout was practical:

• The right people with the right access
• Consistent controls over sensitive systems
• Access decisions that could be governed and reviewed with confidence.

The identity contribution to a sector-first resilience achievement

The identity transformation formed one of nine workstreams within UK Power Networks’ wider cyber resilience programme.

UK Power Networks deliberately structured the programme this way, bringing together specialist partners across different disciplines, each focused on a distinct area, all working towards a single goal. Kocho’s role was to lead the identity transformation, working alongside the other partners and the organisation’s governance team.

That identity work contributed directly to three CAF outcomes moving from unmet to met at Enhanced Profile:

• B2.a Identity Verification, Authentication and Authorisation
• B2.c Privileged User Management
• B2.d Identity and Access Management

Together with the wider programme, this helped UK Power Networks become the first Critical National Infrastructure network operator in the UK to achieve CAF Enhanced Profile, a significant milestone for the organisation and for the sector.

For Kocho, it demonstrated something equally important: the ability to deliver a complex, enterprise-scale identity transformation while collaborating effectively within a large, multi-partner programme, an increasingly important capability on major enterprise engagements.

A strong foundation for what comes next

Technology, threats and regulatory expectations will continue to evolve. So will the organisations responsible for the UK’s critical services.

By modernising its identity platform and aligning identity management with its wider cyber resilience objectives, UK Power Networks has strengthened a core part of the controls that protect its operations, while setting a benchmark for the sector.

What began in 2012 as a single identity implementation has grown into a partnership that now spans FIM, MIM and Microsoft Entra, and has helped deliver one of the most notable cyber resilience achievements in UK Critical National Infrastructure.

For UK Power Networks, it reflects an ongoing commitment to resilience, security and operational excellence.

For Kocho, it demonstrates the value of long-term partnership, deep identity expertise and a shared focus on outcomes that matter.