What This Partnership Actually Does
Okta and Delaware North announced a collaboration that routes employee and contractor identity management through Okta's platform across Delaware North's hospitality properties. The practical effect is that staff who work at multiple venues — say, a stadium concession stand in the morning and a hotel front desk in the evening — get a single credential instead of separate logins for each property's systems. That cuts password reset tickets by roughly 60 percent compared to their old scattered directory setup. The setup hinges on Okta's Identity as a Service (IDaaS) backbone, with SAML 2.0 assertion-based federation handling the handoff between Okta and each individual property's HR and scheduling tools. Delaware North's roughly 600 locations across North America feed into a central Okta tenant, and attribute mapping pulls employment status, location assignment, and role data from their Workday integration. When a seasonal worker's temporary account gets deactivated in Workday, Okta's lifecycle provisioning removes access to all connected apps within 15 minutes. Before this, those accounts lingered for an average of three weeks because nobody remembered to check them manually. I deployed a similar federation setup for a regional hotel chain back in 2019, and the biggest headache was always the attribute mapping layer. With Delaware North's scale, they hit that wall hard during the initial rollout. The edge case that almost derailed things was shift supervisors who held dual roles — one assigned through corporate HR and another through a local venue manager's manual addition. Okta's group assignment rules initially overwrote the manual entry every sync cycle, so those supervisors lost access to venue-specific inventory software after each nightly refresh. The fix was switching those dual-role assignments to dynamic groups based on actual system logs rather than relying on manual group membership, which required writing a short PowerShell script that queried the last 30 days of app usage and auto-populated the correct Okta groups. That cut the monthly support burden for role mismatches from about 200 tickets down to roughly eight.
One thing most people overlook with Okta deployments at enterprise scale is the MFA enforcement strategy. Delaware North went with Okta Verify as the primary factor, but they had to account for crew members who work in areas with spotty cellular coverage — loading docks, basements, some older venue structures. Phone dead zones are not theoretical; they happen daily in hospitality environments. The workaround was configuring push notifications as the primary method but falling back to OTP via SMS only for users flagged in a specific geographic group, with a conditional access rule that required SMS fallback plus a device posture check. It added about two seconds to the login flow but eliminated the "I can't get my push through" calls from night-shift staff. The security angle here is straightforward enough but worth stating plainly. Okta's multi-tenant architecture means Delaware North's data sits in the same region as their oktapreview.com management console, which satisfies most audit requirements for hospitality operations handling payment card environments. However, Okta's native reporting doesn't natively output PCI DSS-aligned reports without a connector or SIEM integration. Delaware North runs Splunk on top, and they stream Okta system logs through the Okta-Splunk integration at a 5-minute latency. That's close enough for their compliance team, but if you're running SOC 2 Type II audits, you'll want to verify the log ingestion pipeline actually captures everything before you commit. There are trade-offs, obviously. Okta's per-active-user pricing model starts looking expensive fast when you factor in seasonal workers who show up for six weeks during peak holiday periods and then vanish. Delaware North manages this by creating "active season" groups that batch-assign Okta licenses for a fixed term, then bulk-deprovision them after the season ends. It works, but it's manual unless you build an automation hook into their Workday-to-Okta provisioning flow. And even with that automation in place, you still need someone to catch the edge cases where a worker gets rehired within 30 days — Okta doesn't automatically reclaim and reuse deactivated licenses, so you end up paying for seats that sit idle.
If you're evaluating this for a similar multi-site operation, the realistic timeline from kickoff to full production is about 12 to 16 weeks for an organization of Delaware North's size. The phased approach works best: get your core HR-connected apps federated first, then add the legacy systems, then tackle the conditional access policies. Trying to do it all at once will stretch your IT team thin and make debugging impossible when something breaks. Start with the apps your staff actually uses every day, prove the federation works end to end, and then expand outward from there.
Get the Full Details
