Implementation_of_Microsoft’s_Identity_&_Access_Management_(IAM)_Solution.pdf

RFP TSD-20261923

IMPLEMENTATION OF MICROSOFT’S IDENTITY &

ACCESS MANAGEMENT (IAM) SOLUTION

County of San Mateo

455 County Center, 3rd Fl undefined

Redwood City, CA, CA 94063

RELEASE DATE: February 25, 2026

DEADLINE FOR QUESTIONS: March 12, 2026

RESPONSE DEADLINE: March 26, 2026, 1:00 pm

RESPONSES MUST BE SUBMITTED ELECTRONICALLY TO:

https://secure.procurenow.com/portal/smcgov https://secure.procurenow.com/portal/%7bproject.government.code%7d

County of San Mateo

Implementation of Microsoft’s Identity & Access Management (IAM)

Solution

1. Introduction

2. Scope of Work

3. Evaluation Phases

4. Requirements, Documents, and Local Business Preference Ordinance

Attachments:

A - Attachment_A_Implementation of Microsofts Identity Access Management (IAM) Solution

B - Attachment_B_Price_Proposal_Template

C - Attachment_C_References_Template

D - Attachment_D_Standard_Contract_Template

E - Attachment E_Technology Security Assessment

F - Attachment_F_SMC_Local_Preference_Self-Attestation_Form

1. Introduction

1.1. Summary

The County of San Mateo (County) Technology Services Department (TSD) is seeking proposals from qualified vendors to assess, configure, and implement Microsoft’s Identity & Access Management (IAM) solution, in support of the County’s identity lifecycle management.

1.2. Timeline

Release Project Date February 25, 2026

Pre-Proposal Meeting (Non-Mandatory) March 5, 2026, 1:00pm

Time: 1:00pm-1:15pm This meeting is to address administrative questions only regarding OpenGov.

No technical or specific questions to the RFP will be answered at this meeting.

Microsoft Teams meeting Join:

https://teams.microsoft.com/meet/23721219859307

?p=UH4OgnOJmxu0qQUerj Meeting ID: 237 212 198 593 07 Passcode: qH2Ew2X7

Dial in by phone +1 628-212-0105, 137654930# United States, Corte

Madera Phone conference ID: 137 654 930#

Question Submission Deadline March 12, 2026, 1:00pm

Proposal Submission Deadline March 26, 2026, 1:00pm https://teams.microsoft.com/meet/23721219859307?p=UH4OgnOJmxu0qQUerj https://teams.microsoft.com/meet/23721219859307?p=UH4OgnOJmxu0qQUerj

2. Scope of Work

2.1. Project Scope and Documents

See Attachments.

https://procurement.opengov.com/portal/smcgov/projects/230353/document?section=2184876

3. Evaluation Phases

3.1. Phase I

No. Evaluation Criteria Scoring Method Weight (Points)

1. Evaluation of Technical Proposal

45% - Method and Approach

• Apparent understanding of the scope of services to be provided

• Appropriateness of the proposed solution/services

30% - Experience and Organizational Capacity

• Qualifications and experience of both the proposer and key personnel

• Experience with other public agencies

• Organizational resources and staff, apparent ability to meet any required timelines or other requirements

25% - Price

10% - Preferential Points

• Where price is not the sole evaluation factor for a solicitation (e.g., in the case of a "best-value" solicitation), five percent (5%) of the total evaluation points awardable will be added to the proposal score for each

Local Business or Local Non-Profit score for evaluation purposes. In the event of a tie between a Local

Business or Local Non-Profit and another bidder, the Local Business or

Non-Profit shall be awarded the

Contract, assuming agreement on other contract terms.

• An additional three percent (3%) preference shall be given to a Local

Business or Local Non-profit (for a total of eight percent (8%) of total points awardable) if the proposer is a

Small Business or Small Non-Profit, or an additional 5 percent preference

(for a total of ten percent (10%) of total points awardable) if the proposer is a Micro Business or Micro Non-

Profit.

0-100 Points 110 (100% of Total)

3.2. Phase II

No. Evaluation Criteria Scoring Method Weight (Points)

1. Evaluation of Demonstration/Interviews of elevated proposals

40% - Core Features & Functionality

• Demonstrate IAM integration and ability to create and disable accounts based on information derived from the system or record (Workday and

Service Now).

• Present IAM portal and demonstrate ability to submit change requests for existing workforce members and have the IAM workflow engine obtain approval for changes from designated system owners/approvers and then complete changes in an automated fashion, including required completion notifications and instructional materials as needed for the user to begin accessing the system without direct assistance.

• Ability to integrate with Workday to on/offboard workforce members, demonstrating the level of integration and a clear understanding of the user fields provided by Workday as the system of record which is then used to populate downstream identity provider platform (IdP) records.

• Demonstrated ability to transfer workforce members from one department to another (cross domain) while maintaining same account name and data stores, essentially replicating the user information in another OU or affiliated domain.

• Demonstrated ability to transfer workforce members from one department to another (cross domain) while doing so using the same account name but not retaining access to previous position data stores.

• Demonstrated ability to transfer workforce members from one department to another (same or cross domain) with a new account name

Points Based 100 (100% of Total) and not retaining access to previous position data stores.

30% - Usability and Automation

• Demonstrate how requesters or TSD service desk members request user access changes and changes to system access authorization levels.

• Show how the respondents solution will increase workflow milestone-based lifecycle communication to users, requesters and approvers when onboarding, offboarding, transfers, or access change scenarios.

• Demonstrate how workflow will obtain data owner approvals on access and authorization level requests.

• For seasonal, temporary workforce members or contractors and vendors, demonstrate how accounts can be set for automated expiration with functionality to renew the accounts by account sponsors without direct intervention by TSD workforce members.

• Clearly show how requests for approval can escalate to other approvers if approval requests are expired or left unattended.

30% - Integration and Extensibility

• Advise the County on the minimum data sets required to perform all functions included in the IAM platform.

• Demonstrate what the respondent’s solution and strategy is to implement

SAML SSO integration for external partners while minimizing access disruptions.

• Demonstrate how the respondent’s solution and approach will as much as possible replicate the SSO applet publication format for workforce members to minimize user impact to a migration to Entra SSO.

• Inform on how the respondent will implement seamless MFA migration from existing SSO to new SSO.

• Demonstrate how existing security group schema can be leveraged to maintain system and resource access and authorization levels for integrated and third-party applications.

4. Requirements, Documents, and Local Business Preference Ordinance

4.1. Minimum Qualifications and Requirements: The Proposer has a minimum three (3) years’ experience implementing the requested solution, performing similar services as those detailed in this RFP.*

The Proposer confirms the minimum qualification is met, and the proposal contains a detailed response.

☐ Please confirm

*Response required

4.2. Minimum Qualifications and Requirements: The Proposer has a minimum three (3) successful implementations for government agencies of similar size and requirements within the last five (5) years.*

The Proposer confirms the minimum qualification is met, and the proposal contains a detailed response.

☐ Please confirm

4.3. Minimum Qualifications and Requirements: Provide evidence of the insurance requirements for each of the checked categories as outlined in Section IV-Insurance. The Proposer understands that expired certificates will not meet this requirement.*

The Proposer confirms this minimum qualification is met, and a copy of the Certificate of Insurance

(COI) has been uploaded. The Proposer has reviewed the COI, and confirms all coverage limits meets or exceed the RFP requirements

☒ General Liability (Including operations, products and completed operations, as applicable.)

$1,000,000 - per occurrence for bodily injury, personal injury and property damage. If Commercial General Liability Insurance or other form with a general aggregate limit is used, the general aggregate limit either must apply separately to this project or must be twice the required occurrence limit.

To be carried at all times during the term of the Contract

☒ Automobile Liability $1,000,000 - per accident for bodily injury and property damage.

To be carried at all times during the term of the Contract

☒ Workers’ Compensation As required by the State of California

To be carried at all times during the term of the Contract

☒ Employers’ Liability $1,000,000 - each accident, $1,000,000 policy limit bodily injury by disease, $1,000,000 each employee bodily injury by disease.

To be carried at all times during the term of the Contract

☐ Professional Liability (Errors and Omissions) $1,000,000 - per occurrence.

To be carried at all times during the term of the Contract

☒ Cyber Liability $5,000,000 per occurrence for Privacy and Network Security, $1,000,000 per occurrence for Technology Errors and Omissions

To be carried at all times during the term of the Contract and for three years thereafter.

Upload Certificate of Insurance (COI)

4.4. Minimum Qualifications and Requirements: Provide evidence the proposer is registered, active, and in good standing with SAM.gov and is not barred from public contracting by any federal or state authority. Incomplete registrations will not meet this requirement. (Part 1)*

The proposer must be registered, active and in good standing with the System for Award Management

(SAM.gov) at the time of proposal submission. To meet this requirement, the proposer must provide the following:

• SAM.gov Unique Entity Identifier (UEI) Number

• Proof of Active and Valid Registration with SAM.gov

• Failure to provide proof of active SAM.gov registration will result in the proposal being deemed non-responsive.

• SAM.gov assigns a unique 12-character alphanumeric Unique Entity Identifier (UEI) to entities during the registration process. However, to meet this minimum qualification, SAM.gov

Registration Status must also be listed as “Active Registration”.

• Incomplete registrations will not meet this requirement.

Please provide your firm's SAM.gov UEI Number.

*Response required

4.5. Minimum Qualifications and Requirements: Provide evidence the proposer is registered, active, and in good standing with SAM.gov and is not barred from public contracting by any federal or state authority. Incomplete registrations will not meet this requirement. (Part 2)*

The Proposer must upload proof of active SAM.gov registration. The proof must be a screenshot, printout, or PDF directly from the SAM.gov website and must show the following details, confirming the registration is active at the time of proposal submission:

• Company name

• UEI number

• Active registration status

• Registration expiration date

(Upload proof of active registration)

4.6. Proposal: Comply to the proposal content requirements stated in Attachment A, Section 2.2.*

(Do not include pricing in this area)

*Response required

4.7. Attachment B: Price Proposal Template*

The Proposer confirms Attachment B: Price Proposal Template has been completed and uploaded.

(Upload Attachment B)

*Response required

4.8. Attachment C: References*

The Proposer confirms Attachment C: References has been completed and uploaded.

(Upload Attachment C)

*Response required

4.9. Attachment D: County Standard Contract Template (Part 1)*

If requested redlines are not submitted, the proposer confirms their acceptance to the terms and conditions in the County's Standard Contract Template without modifications.

If requesting redlines for County's consideration, proposer has included them with the proposer's submission. Please refer to #10 for instructions on how to upload.

☐ Please confirm

*Response required

4.10. Attachment D: County Standard Contract Template (Part 2)*

Proposer's requested redlines to the County Standard Contract Template are submitted for County's review and consideration. Proposers should not rely on the County's agreement to modified terms.

(Upload proposed redlines. Microsoft Word is preferred)

*Response required

4.11. Attachment E: Technology Security Assessment*

The Proposer confirms Attachment E: Technology Security Assessment has been completed and uploaded.

(Upload Attachment E)

*Response required

4.12. Procurement Preference for Local Businesses and Local Non-Profits

The board of Supervisors adopted the Local, Local Small and Micro Business ordinance on November 19, 2024. The purpose of this ordinance is to promote a strong local economy by giving preference to local businesses, and local small and micro businesses, to the extent consistent with the law and interests of the public.

4.12.1. Is the Proposer a San Mateo County "Local Business"?*

As Defined by Chapter 2.89.020 of the San Mateo County Ordinance Code, a “Local Business” means any for-profit business which has its principal place of business, or is headquartered, in San Mateo

County.

☐ Yes

☐ No

*Response required

When equals "Yes"

4.12.2. If the Proposer is a San Mateo County local business,*

Please download the below documents, complete, and upload. If this designation is not applicable, please leave blank.

• Attachment_F_SMC_Local_Pref...

*Response required

4.12.3. Is the Proposer a "Non-Profit?*

A Non-Profit is defined as a tax-exempt public charity organization (within the meaning of section

501(c)(3) of the Internal Revenue Code) that is formed for purposes other than making a profit, is exempt from paying federal income taxes on the income generated for their exempt purposes.

☐ Yes

☐ No

*Response required

When equals "Yes"

4.12.4. If yes, is the Proposer a San Mateo County "Local Non-Profit"?*

As Defined by Chapter 2.89.020 of the San Mateo County Ordinance Code, a “Local Non-Profit" means a tax-exempt public charity organization (within the meaning of section 501(c)(3) of the

Internal Revenue Code) that is formed for purposes other than making a profit, is exempt from paying federal income taxes on the income generated for their exempt purposes, and has its principal place of business, or is headquartered, in San Mateo County. If this designation applies to the proposer, a self-attestation form must be completed and provided with this response.

Please download the below documents, complete, and upload. If this designation is not applicable, please leave blank.

• Attachment_F_SMC_Local_Pref...

*Response required

4.12.5. Is the Proposer a "Small" or "Micro" Business located in San Mateo County?*

As Defined by Chapter 2.89.020 of the San Mateo County Ordinance Code:

“Local Small Business” means any business which holds a Small Business Certification awarded by the

California Office of Small Business and Disabled Veteran Business Enterprise Services (OSDS), and has its principal place of business, or is headquartered, in San Mateo County.

https://government-project.s3.us-west-2.amazonaws.com/230353/ea04bd34-03aa-42fe-b3f6-99792d8e2b29_Attachment_F_SMC_Local_Preference_Self-Attestation_Form.pdf https://government-project.s3.us-west-2.amazonaws.com/230353/f318ad97-b0e4-47c9-9f41-c26a5be892b4_Attachment_F_SMC_Local_Preference_Self-Attestation_Form.pdf

“Local Micro Business” means any Small Business certified by the OSDS which is automatically designated by the OSDS as a Micro Business due to gross annual receipts falling below the OSDS-designated dollar amount, and has its principal place of business, or is headquartered, in San Mateo

County.

☐ Yes

☐ No

*Response required

When equals "Yes"

4.12.6. If the Proposer is a small or local business located in San Mateo County,* please provide the OSDS provided Certification ID. Include the Proposer's name and the RFP title and number in each filename.

*Response required

4.12.7. Is the Proposer a "Small" or "Micro" Non-Profit located in San Mateo County?*

As Defined by Chapter 2.89.020 of the San Mateo County Ordinance Code:

“Local Small Non-Profit" means a Local Non-Profit with an annual revenue of $1,000,000 to $2,500,000 according to its most recently filed IRS Form 990, and has its principal place of business, or is headquartered, in San Mateo County.

“Local Micro Non-Profit" means a Local Non-Profit with an annual revenue of less than $1,000,000, according to its most recently filed IRS Form 990, and has its principal place of business, or is headquartered, in San Mateo County.

☐ Yes

☐ No

*Response required

When equals "Yes"

4.12.8. If the Proposer is a "Small" or "Micro" Non-Profit located in San Mateo County,*

Please provide your latest filed IRS form 990. A filing from the last two calendar years is acceptable.

Include the proposer's name and the IFB title and number in each filename.