“The Next Evolution in User Authentication”: Nelnet’s Journey to Zero Standing Privileges

See how Nelnet protected 5,464 associates and 15 million customers without replacing a single system.

Nelnet is a NASDAQ-listed technology and education services company headquartered in Lincoln, Nebraska. Serving millions of customers across industries including student loan servicing, K–12 tuition payments, banking, and solar energy, they operate in highly regulated environments. Their security obligations are significant, and their identity challenge was anything but simple.

One Identity Problem, Many Moving Parts

For Nelnet, their workforce spans permanent employees, system administrators, project-based collaborators, and application power users, each with different access needs and risk profiles.

When the project’s work began, multi-factor authentication (MFA) adoption was inconsistent, and privileged accounts were permanent rather than time limited. Users handling large volumes of sensitive PII had no high-assurance authentication controls, and there was no simple path to extending MFA to customers.

The threat landscape was evolving faster than their existing controls could handle, and corporate leadership wanted a unified solution, not another layer of complexity.

High-Assurance Access, Without the Overhead

VO worked directly with Nelnet’s cyber and identity architects, alongside Microsoft, to map every access scenario before a line of configuration was written. The result was a verifiable credential deployment that addressed each user type without replacing the Microsoft infrastructure Nelnet already ran on.

System administrators now operate from a single account, requesting elevated rights dynamically when needed, backed by biometric verification and automatically revoked when the task is complete. Project and guest users access Nelnet tenants via MFA-enabled verifiable credentials through a controlled issuance process. Power users handling sensitive PII can authenticate with high-assurance, biometric-backed MFA.

No standing privileges. No exceptions.

Proven Results

Nelnet eliminated standing privileged accounts entirely. Access that previously required ITSM tickets to grant and revoke is now automated, just-in-time, cryptographically verified, and fully auditable.

High-assurance MFA now covers every sensitive access scenario across the organization, from internal admins to external partners. VO is now the foundation of Nelnet’s broader passwordless strategy, with a clear path to extending the same approach to their 15 million customers.

• Zero standing privileged accounts remaining post-deployment
• Just-in-time access across all admin, partner, and power user environments
• One unified authentication experience across workforce, partners, and customers

Ready to eliminate standing privileges at your organization?

See how VO’s verifiable credential platform can close your identity gaps, without replacing the infrastructure you already rely on. Contact CampusGuard to learn more or request a demo.