Identity_Services_RFI_Entra.docx

Request for Information (RFI) Microsoft Entra Identity Services – Advisory, Design, and Implementation Support

1. Purpose of the RFI Pinellas County Business Technology Services (BTS) is issuing this Request for Information (RFI) to gather information from qualified vendors with demonstrated expertise in Microsoft Entra Identity Services. The objective of this RFI is to better understand available approaches, methodologies, and vendor experience in supporting large, complex, multi-agency identity environments. Information collected through this process will inform future planning and potential procurement activities. This RFI is for informational purposes only and does not constitute a solicitation or a commitment to purchase services.

2. Background Pinellas County operates a diverse and federated identity ecosystem supporting multiple constitutional offices, justice agencies, external government partners, and third-party applications. The County is standardizing Microsoft Entra as its primary identity platform while maintaining interoperability with Okta, legacy identity systems, and external tenants, including government and justice-focused environments.

The County seeks vendors capable of providing strategic advisory services, architectural design, implementation support, and operational guidance across identity governance, authentication modernization, federation, security, and automation. Vendors should demonstrate experience operating at enterprise scale, particularly within government or regulated environments.

3. Areas of Interest Foundation, Enablement, and Tenant Strategy The County is interested in vendors that can support foundational enablement activities, including delivery of Microsoft Entra Identity training at both administrator and advanced administrator levels. Vendors should describe their approach to knowledge transfer and operational readiness. The County is also evaluating the design and implementation of a separate Entra test tenant to support preview features, early-access validation, and safe experimentation. Experience configuring cross-tenant access and synchronization is essential, including cross-tenant synchronization, federation, and multi-tenant Azure AD Connect or Cloud Sync architectures. These capabilities must support ERP systems and like-to-like testing scenarios across tenants.

Administrative Model and Access Control Pinellas County seeks guidance on designing a scalable and secure administrative model within a flat Entra directory. This includes the use of Administrative Units to enable delegated administration, such as agency-specific scopes and separation of sensitive functions like LAPS. Vendors should describe how they approach logical separation using Administrative Units and/or resource segmentation. The County is also interested in the development of a clear RACI and permissions model spanning Endpoint teams, Operations Center staff, the central Identity team, and agency IT administrators. Reducing reliance on Global Administrator roles and implementing Entra RBAC roles strategically is a key objective.

MFA and Authentication Modernization The County is actively modernizing authentication and intends to fully remove SMS as a multi-factor authentication method. Vendors should describe their experience validating and deploying stronger MFA options such as YubiKeys, Windows Hello for Business, FIDO2, Microsoft Authenticator, and Temporary Access Pass. Solutions must accommodate different MFA requirements based on stakeholder or agency needs and ensure compatibility across Entra and Okta federation scenarios, including multi-tenant authentication flows.

Self-Service and Identity Automation Pinellas County is seeking to expand self-service identity capabilities while maintaining security and auditability. Vendors should outline their experience implementing VPN-less self-service password reset with writeback. The County is also interested in workflow-driven access request solutions integrated with Privileged Identity Management (PIM) to eliminate standing privileges and enforce just-in-time access.

Federation and External Collaboration Beginning in March, the County plans to expand cross-tenant federation with other counties, courts, and external agencies. Vendors should describe their experience configuring Entra B2B federation, managing guest identity lifecycles, defining licensing strategies, and automating cleanup of external accounts. Experience planning for Government Cloud (GCC) integration is desired. Where required, vendors should also be able to maintain interim Okta-to-Entra federation for legacy or smaller applications.

Group and Access Management The County is evaluating governance models that restrict group creation to the central Identity team while delegating group membership management to agency IT under defined guardrails. Vendors should describe how they protect sensitive groups, such as those granting cloud platform or privileged access, from unauthorized modification. The establishment of dynamic group standards, including rule design, naming conventions, and base group structures, is of particular interest, especially for Clerk of Court use cases.

Conditional Access and Session Controls Pinellas County is planning the phased implementation of advanced Conditional Access policies, including geo-based controls such as U.S.-only access and stepped-up MFA, with a target timeframe of Summer 2025. Vendors should describe how they design session lifetime policies that support operational realities such as storm response and emergency access. Experience integrating existing authentication approaches currently in use across agencies—such as Windows Hello, YubiKey, Duo MFA, and Authenticator App—is important. Vendors should also address newer Conditional Access use cases identified through security audits, including device-based MFA enrollment and differentiation between managed and unmanaged devices.

Custom Domains and Okta Migration The County seeks vendor input on planning and executing the transition of federated domains to managed domains within Entra. This includes validating Password Hash Sync readiness and authentication reliability. Vendors should also describe their approach to designing Conditional Access policies that meet agency-specific requirements, such as time-based access or specialized MFA requirements for constitutional offices.

Security Monitoring, Logging, and Governance Pinellas County is interested in improving identity security monitoring by configuring alerts for sensitive identity events, including administrative changes, application registrations, and MFA resets. Vendors should describe their experience designing centralized Entra log retention strategies, including alignment with Azure subscriptions, resource groups, and retention policies.

Subscription and RBAC Governance The County seeks guidance on defining a subscription-level RBAC and IAM governance model that aligns Azure subscription permissions with Entra identity roles in a consistent and auditable manner.

Application Registration and API Management Vendors should describe security best practices for application registrations, including governance models for granting API permissions and mitigating risks associated with excessive or poorly scoped access.

Legacy Identity System Transition Pinellas County maintains integrations with justice systems and legacy identity platforms, including Odyssey and NetIQ. Vendors should describe their experience replacing or integrating with these systems using Entra-based identity automation. Experience enabling Entra Domain Services to support legacy LDAP and Kerberos workloads in the cloud is also desired.

SCIM and On-Premises Integration The County is evaluating SCIM-based provisioning for on-premises applications. Vendors should describe their experience with SCIM connectors and where Azure App Proxy is appropriate for supporting these integrations.

Advisory and Emerging Requirements Finally, the County is interested in vendors that can provide advisory services for unplanned or emergent identity issues that arise during modernization efforts. Vendors should describe examples of foundational identity considerations or risks that were identified during similar engagements that were not initially anticipated.

4. Vendor Response Information Vendors responding to this RFI should provide a general company overview, relevant certifications and partnerships, and experience supporting public-sector or government clients. Responses should describe comparable Microsoft Entra Identity engagements, particularly those involving multi-tenant environments, federation, and justice or regulatory constraints. Vendors should outline their delivery methodology, whether advisory, implementation-focused, or hybrid, and may include sample deliverables such as architecture diagrams, governance models, or RACI frameworks. Information about key personnel and their qualifications should also be provided.

5. Closing This RFI is issued solely for planning and information-gathering purposes. Pinellas County reserves the right to modify its approach, issue a future solicitation, or take no further action based on the information received. No pricing or cost information is requested as part of this RFI.