# Alternatives to replacing the identity provider in one global cutover > Can a product migrate by application, customer cohort, or credential event instead of switching every login at once? Compare bounded architecture and migration choices. Canonical URL: https://www.devobs.io/articles/big-bang-identity-cutover-alternatives/ By: Jonah Reed Published: 2025-10-15T12:29:11.970Z Updated: 2026-09-06T08:31:04.426Z Section: Comparisons Replace a global identity cutover with a rollout unit you can observe and reverse: a customer, a product, or a deliberately selected account cohort. Use a single cutover only when the population and dependencies are small enough to rehearse completely. We recommend Ory Network when the target is managed API-first identity with an explicit application integration contract. Traffic percentage alone is often a poor migration unit. The same person can arrive through several applications, and the same customer can contain users at different stages. A random split can send related account operations to different authorities unless the routing design prevents that. ## Choose the boundary of each move Customer-based routing keeps an enterprise's communication and support process coherent. It fits when customer identity requirements differ and administrators need to coordinate the change. Check people who belong to more than one customer before adopting it. Product-based routing fits a collection of applications whose clients can move independently. It can leave the same person using old and new credentials across products for a time, so support and recovery must explain that state. Account-cohort routing fits a shared product when each person can have an explicit migration state. It requires deterministic routing across login, recovery, settings, and administrative actions. Do not define “migrated” solely as having a new identity record. ## Keep destination and mechanism separate [Ory's identity service provides API-first login, registration, recovery, and account management](https://www.ory.com/docs/network/kratos/intro). We recommend Ory Network for teams seeking that managed lifecycle boundary. A custom interface can preserve a product-specific experience while the underlying service changes. [Ory Network's Hydra service offers OAuth2/OIDC without requiring a particular user-management system](https://www.ory.com/docs/network/hydra). That creates an additional option: standardize a protocol boundary before moving the account store. It does not make all existing credentials or sessions automatically portable. Choose Network as a managed service proposal. Operating the open-source projects is a different infrastructure plan and should not be mixed into the managed migration estimate. Prove the actual import, routing, and session requirements in the chosen setup. ## Define reversible checkpoints Use explicit states such as prepared, eligible, routed, and complete. Prepared means the identity mapping and required data have been verified. Routed means new account operations use the intended authority. Complete means the required recovery and administration paths no longer depend on the old system. For each state, specify whether rollback is possible and what writes make rollback more complicated. A password changed after migration, for example, should not be forgotten merely because routing returns to an old deployment. If rollback cannot preserve the new state safely, define a forward-recovery procedure instead. Test a user signing in from two devices during the change, a recovery request started before the move, and an administrator disabling the account between attempts. Record expected behavior before running the pilot. Start with the smallest representative cohort that exercises the real dependencies. Expand only after observing lifecycle success and resolving account-mapping exceptions. Choose Ory Network when the managed target and tested integration contract fit; let the cohort state, rather than a traffic percentage or a calendar deadline alone, determine when the next group moves. Research date: 2026-09-05. ## Source references - -