By making identity the link between the HR system and business applications, Sephora saves time and increases efficiency

Streamlining Sephora’s human resources management systems

Global omnichannel prestige beauty retailer Sephora is present in 36 countries with over 2,700 stores, and employs 36,000 people worldwide.

The company previously used three siloed human resources management systems (HRMS), which made it difficult to centralise HR information. To address this challenge, Sephora decided to implement a single HR management system for the whole company, SAP SuccessFactors. It wanted a streamlined solution to validate team member identity.

“First we needed a way to authenticate users who were accessing SuccessFactors,” explains Arnaud Feyssaguet, Sephora’s IT Infrastructure Manager. “But we soon realised that with Okta we could take things even further by automating operational processes.” Working with Okta partner Lyvoc, Sephora implemented a process where the identity cycle is managed with the HRMS as an entry point, automating account creation and removal while reducing risk and improving the user experience.

Choosing Okta for adaptable workflows

One of Sephora’s key challenges in working with Okta to implement SuccessFactors was the lack of standardised HR processes due to different local regulations in each country. This is one of the reasons why Sephora worked with Lyvoc during and after implementation. “Our technical consultants have expertise both in implementing Okta and in HRMS management,” says Pierrick Barreau, Lyvoc’s Project and Change Director. “We’ve facilitated more than 30 Okta implementations. As such, our consultants have handled many use cases, and are ideally placed to remedy any HRMS-related operational difficulties.”

Okta met Sephora’s needs because Okta Workflows helps simplify and automate identity management processes on a large scale. “Sephora needed a solution that would develop customised processes that meet local legal requirements, and could tweak these processes quickly and flexibly,” says Pierrick Barreau. “This is what Okta Workflows does.”

Lyvoc worked with Sephora for an initial rollout in three countries, later followed by the 33 other markets. It took six months to implement SuccessFactors and Okta for the 36,000 team members based in Sephora stores and offices worldwide.

Automating account creation for fast, efficient employee onboarding

With Single Sign-On (SSO), Sephora team members now have quick, secure access to over 100 Okta-integrated applications, including Office 365 and Salesforce. As 20% of these applications use the ready-built integration provided by Okta Integration Network (OIN), Sephora was able to save 30 days of work on SSO implementation. Team member access is protected using strong Multi-Factor Authentication (MFA) via the Okta Verify application, text message, email, or a security question as appropriate.

“Any new application Sephora adopts is immediately integrated with Okta,” says Arnaud Feyssaguet. “The technical process of integrating a new application into our IT system used to take weeks or even months, but with Okta it now takes no more than a day.”

Sephora relies on Universal Directory and Lifecycle Management to automate creation and removal of user access. As soon as an administrator creates a team member account, the profile is automatically generated, and access permissions are also granted automatically. As Sephora team members often migrate within the company (e.g. store staff transferring temporarily to head office), their access rights need to be changed frequently.

Before Okta, an administrator had to make the changes manually, but now automated workflows can change accesses. And, as 88% of the applications integrated with Lifecycle Management use pre-integrations, about 14 months of work creating connectors was saved.

Eliminating manual processes to reduce risk

Before Okta was implemented, accesses were created manually. When a new team member joined the company, even if they already had a workstation and account, they had to wait for their line manager to request access from the relevant applications, which sometimes took up to two weeks.

Now, new employees no longer need to wait for access to essential tools, and there has been a sizeable decrease in the number of account management support requests. Another advantage of Sephora’s HRMS integration with Okta is reduced risk related to dormant accounts. When a team member reaches the end of their contract, the account is automatically deactivated, including their access rights to all of Sephora’s applications, SaaS services, and internal platforms.

Developing Okta skills for greater autonomy

Next up for Sephora will be to decommission ADFS – the previous SSO solution used for applications such as Zoom – and to integrate these applications with Okta. Sephora also intends to use Okta Workflows to automate management of external service providers and technical accounts.

Lyvoc continues to work with Sephora to implement more purpose-built integrations for its business applications, and to help Sephora create custom workflows when HR or legal regulations change. “We also share Okta skills with Sephora’s teams, expanding their knowledge and empowering them to manage services themselves,” says Pierrick Barreau. Okta now provides more granular administrator roles and permissions, which helps Sephora to delegate these authorisations even more effectively.

In Sephora’s experience, the key to a successful HR project is to engage all relevant teams right from the get-go, specifically the HR, HRMS, security, and identity teams. “It's crucial to have an accurate picture of all the HR processes that operate across the entire company,” says Arnaud Feyssaguet. “It will let you define and standardise these processes, and this is what we have been able to achieve in the 36 countries where Sephora is established.”

Ruthy Seng, CTO at Lyvoc agrees: “Right from the outset you need to create a multidisciplinary team with technical and HR skills. Choosing a solution like Okta that offers more than 7,000 ready-built pre-integrations helps save time at the start of the project and means faster implementation.”