An Identity and Access Management (IAM) project on campus can feel like a Sisyphean task: Just when access rights have finally been sorted out, the semester ends--and users change roles, leave campus, or require new processes. IT departments face a constantly changing technical landscape: (1) integrating new applications and retiring old ones; (2) complying with privacy rules; and (3) dealing with vendor churn. This article presents best practices that can help overcome such challenges and turn the seemingly endless IAM labor into an IT triumph.