Achieving Zero-Impact Retail Identity Migration

There’s little doubt that the COVID-19 pandemic and its aftereffects have had a dramatic impact on the retail sector, with many retailers seeing a marked uptick in traffic through their digital channels as consumers embrace the freedom of shopping from anywhere at any time. The eCommerce share of total sales continues to rise by roughly 7.5% annually, and hybrid shopping has taken off, with consumers shopping at least partially online 55% of the time.¹ This increase in digital interaction tends to go hand in hand with a requirement for a modern, best-of-breed Customer Identity and Access Management (CIAM) platform in order to truly capitalize on the upsell and cross-sell opportunities that come from increased consumer stickiness and personalization.

While many retailers agree that legacy identity systems – often tightly coupled with existing CRM or ecommerce platforms – reduce agility and negatively impact user experience, it can seem daunting to embark on a migration project, particularly when the impacts of migrating a large existing customer base to that new platform are considered. Nevertheless, migration is often a necessary first step in fulfilling other key digital transformation initiatives.

Read on to see how retailers can alleviate these concerns and tackle the migration process with confidence – without leaving a single customer behind.

Many of the retailers we have spoken to tend to describe a common starting state; typically, they will have a legacy customer database or directory, frequently on-premises, encompassing a large number of users, many of whom may be considered “inactive” in that they have not purchased anything in 12 months or more. Data quality is typically questionable, especially for those customers who do not interact regularly. The business faces two potentially competing agendas – how to avoid bringing across a large volume of stale data for customers that may be unlikely to ever come back, versus the desire to provide an absolutely seamless migration experience free from downtime for loyal customers who interact regularly.

Let’s explore these points further:

Inactive Customers

Not all of the user identities typically stored in legacy systems need to be migrated. It is likely that customers who are inactive and haven’t bought anything in some time will not return unless some attempt is made to re-engage them. A migration to a new identity platform can provide a vehicle for re-engagement, potentially through a targeted email campaign offering a voucher or small discount to any customer that signs in and confirms their current details. Retail businesses need to decide the point at which they cut their losses with inactive users while focusing on a smaller, more active, and more engaged customer base on the new platform, rather than simply bringing across every user record from the old system.

It is safe to assume that a large percentage of inactive customers will have forgotten their login credentials in any event, so it’s important to create a smooth account recovery process post-migration, ideally offering self-service capabilities to reduce friction as much as possible.

Active Customers

One of the golden rules of online retail is that authentication increases friction, and that friction in turn increases abandonment. For active customers, this translates to a hard requirement not to introduce any account recovery or password change process as part of a migration to a new CIAM platform. The goal is to allow active customers who know their credentials (or better still, already have a long-lived authentication session) to continue to interact and spend money without even noticing that the IAM system has changed. Upgrading is important to the end-user experience, but customers don’t need or want to know that the identity provider has changed – they just want to shop as they did before.

Retailers can deliver a smooth migration free of downtime by taking advantage of the following unique capabilities provided by the PingOne for Customers platform. 

Customer Journey Orchestration

Every journey for every customer is powered by the PingOne DaVinci orchestration platform, which provides unparalleled flexibility and agility to retailers aiming to create, test, and optimize tailored customer experiences. From hundreds of prebuilt connectors into existing CRM and ecommerce platforms, to pixel-perfect control over every aspect of UI, DaVinci handles integration complexity behind the scenes while minimizing front-end complexity for the consumer.

Just-In-Time Migration

Many retailers opt to take a just-in-time or “lazy” approach to migrating customers, using DaVinci to provide a login journey that handles migration from old to new behind the scenes.

The above image provides an example of how the flow logic would typically work: the first time a user logs in after the upgrade, they will be authenticated against the old system via a backend API call, thus proving ownership of the account password. Should the authentication succeed, provisioning into the PingOne platform directory happens automatically with the same password. Subsequent logins will be performed directly against PingOne. 

This approach minimizes friction for active users, while also removing the complexity associated with big bang data migration as well as password migration. Instead of migrating customers all at once or in batches, each customer is migrated as they arrive. 

Lazy migration does require that both old and new systems run in parallel and works well in a scenario where the retailer wishes to allow a window for active user migration in order to “clean up” the customer base and avoid bringing across stale account information.

Co-Existence via Synchronization

The PingOne Identity Platform additionally includes the Ping DataSync component, which allows retailers to configure and run uni- or bi-directional synchronization pipelines between legacy customer data stores and the PingOne Directory.

DataSync supports both initial snapshot migration – for migrating all user records at a point in time – as well as ongoing scheduled synchronization tasks to keep both repositories aligned. With support for a wide variety of standard password hashing and encryption algorithms, we can even migrate user password hashes directly from old to new, thus allowing for uninterrupted logins via the new platform. 

The benefits of Data Sync are that all user profiles, whether active or inactive, can be migrated using a single approach; however, this does imply fewer opportunities to perform clean up of the user base.

Full Migration

For situations where a decommissioning deadline affects availability of the legacy system, a full migration of data at a point in time may be required. This option has benefits in terms of ongoing operational simplicity, but is typically an exercise that needs to be carefully planned as part of a cutover process in order to minimize disruption. As described above, it is often possible to fully migrate all customer profile attributes in one go, including password hashes, provided these use a standard hashing algorithm.

Progressive Profiling

In line with the goal to decrease friction, many retailers prefer to collect user profile information only on an as-needed basis; initial registration is typically lightweight, with only as much information gathered as is strictly necessary to fulfill an order and collect payment. The PingOne platform allows for progressive profiling user journeys, making it possible for additional information to be solicited from a user at any point in any journey. This approach fits well with both lazy migration as well as coexistence synchronization, as customers can be asked to confirm or update any incorrect profile information that may have been brought across from the old system.

Account Recovery

It is important to provide as many options as possible for inactive customers to re-engage through regaining access to their accounts. The PingOne platform allows retailers to define account recovery journeys that offer flexibility and choice to the end user; typically through delivering a one-time link or passcode to a known email address or mobile number, although the flexibility of the DaVinci platform allows for many other options as well.

Many of our retail customer have successfully migrated to the PingOne Identity Platform using an approach similar to the following:

Phase 1: Initial cut-over, both systems run in parallel

Just-in-time migration included in authentication flow: Any customer that logs into the platform after the cut-over will follow a lazy migration flow that will migrate their user details from the old system to the new behind the scenes. 

Account recovery flow: Implement an account recovery flow based on email or SMS that allows customers who have forgotten their passwords to set a new one directly in the PingOne system.

Progressive profiling: include progressive profiling logic in the authentication flow in order to fill in or clean up any migrated data as needed.

Phase 2: Preparing for legacy system decommissioning (typically three to six months later)

Synchronization of remaining accounts: Implement a DataSync pipeline to migrate any remaining accounts to the new system. The business can make a decision based on when each account was last accessed as to whether very old/stale accounts should be migrated, or should simply be deleted.

Re-engagement campaign: If contact details are available (and consent is in place), the business could opt to launch a campaign targeting those customers who have not yet migrated. The campaign would include a call-to-action with an incentive to either log in, or follow the account recovery flow.

Phase 3: Migration complete

Decommission legacy system: At this point, all active customers can be considered as migrated and the old system can be turned off. Any inactive customer who returns after this point will follow the account recovery flow in order to regain access to their account.

At Ping Identity, we believe in the power of digital identity as an enabler for better customer experience and ultimately increased digital revenue for retailers. Our retail identity solutions can help you acquire and retain customers, react more quickly to market changes, and control fraud costs. Contact your Ping Identity Account Representative for more information and a demonstration of our platform, or sign up for a free trial today.

1. CapitalOne Shopping Research