Converged access control

Converged access control means that the badge that opens an office door and the login that opens a company's computer systems are issued and controlled by the same identity system. There is one record for each person. That record decides which doors the person may open and which applications they may use. The industry also calls this converged physical and logical access: "physical access" means doors and rooms, and "logical access" means computer systems.

Here is how it works in general. When a new employee joins, the HR system creates their record. The company's identity system reads that record and gives the person the access their job needs: a login, a code for multi-factor authentication (MFA), and a badge. The badge may be a plastic card or a digital pass on the phone. At each door, a reader sends the badge's details to the physical access control software, which opens the door only if the person's record allows it. When the person moves to a new team, one change updates both the doors and the systems. When they leave, one change disables both, on the same day. Every door opening and every login is recorded against the same person.

Why combine them? In many companies, the door system and the computer systems are run by different teams, with different lists of people. A person who has left may still be able to walk into the office for weeks, because nobody told the security desk. One record closes that gap. It also lets the company compare the two kinds of record. A login from a desk inside the building, by someone whose badge was not used to enter that day, is worth checking.

Take, for example, an employee who resigns. On the last working day, the identity governance system removes their applications, and the same change stops their badge at the front door.

Consider a contractor who must work in a server room for three days. The identity system gives the contractor that one door and the systems inside, and both end automatically on the third evening.

Say a company is fitting out a new floor. Security system design software plans every door reader and camera before installation, so that each new door can be added to the same access rules.

How is converged access control different from single sign-on (SSO)? Single sign-on lets a person sign in once and open many applications, but it covers only computer systems. Converged access control brings the doors under the same identity and the same rules. It applies the idea of least privilege to both: each person gets only the doors and the systems that their job needs.