Elanco puts user experience front and center with connected Microsoft Zero Trust

All over the world, people who love their animals turn to Elanco for the medications, vaccines, and therapeutics that keep pets and farm animals well. Driven by purpose and guided by its values of integrity, respect, and excellence in everything it does, Elanco is a company of impassioned innovators. Its employees are also community champions who share thousands of hours every year to volunteer on local improvement projects.

Its spinoff from parent company Lilly in 2019 presented Elanco with a unique opportunity to rebuild IT from the ground up, including a new architecture, technologies, processes, and talent. This unprecedented release from the weight of legacy and technical gave Elanco the chance to make a quantum leap forward and create a modern IT ecosystem.

Teams from the cybersecurity and IT areas came together to build a platform based on Microsoft Security that enhances, not hinders, productivity and the employee experience. They implemented the security components of their Microsoft 365 E5 license: Conditional Access to enforce access policies within Azure Active Directory (Azure AD), Advanced eDiscovery to collect content relevant to internal and external investigations, and the full Microsoft Defender security suite.

Contemplating from a blank slate

When Murtaza Nisar, Chief Information Security Officer, and Matthew Bull, Chief Technology Officer, were hired at Elanco, they looked forward to a unique chance to create the system they would want to inherit years down the line. Like so many things in life, opportunity came hand in hand with some constraints. “We were presented with a blank sheet of paper, but not a blank check book,” says Bull. He and Nisar wanted to establish a forward-looking ecosystem that would power future innovation at Elanco—one that was tightly connected for greater efficiency to enable doing more with less. 

A company that it had acquired during the security stack deployment offered the security team further challenges, underscoring the need for a connected approach. “Microsoft offered an incredibly valuable, holistic ecosystem that elevates collaboration and productivity,” Nisar says. “We would never have reached this level of maturity if we’d bought 50 independent security tools and spent the time needed to integrate them—that’s incredibly powerful, especially with our small team.” He prized the blank page before them. “We often described our project as a quantum leap forward,” Bull adds. “How do I take what was going to be a 10-year journey for some other companies and make that my starting point? In the end, it took us months.”

Nisar points to the intrinsic qualities that he and Bull appreciate about the company behind the solutions. “Like us, Microsoft values innovation and collaboration, and that’s reflected in the connected security tool stack it created,” he says. “That interoperability made it much easier to deploy Microsoft Security solutions.”

Starting with identity

Elanco was eager to begin its Zero Trust journey, and Nisar knew that moments like the one before him and Bull are exceptional. “This was our chance to get ahead of the Zero Trust strategy as we built an infrastructure from scratch that’s highly secure by design,” he recalls. “Our key priority was to prioritize Zero Trust controls that add a lot of value and set us up for success.”

The Elanco team deployed Microsoft Defender for Identity to help protect their on-premises identities, which Nisar regards as the key to security. It added Microsoft Endpoint Manager to provide the contextual information that is vital to optimizing protection. “Security needs to be balanced with usability,” he explains. “At Elanco, identity is more than usernames and passwords—we regard it as the cornerstone of security. With Microsoft tools like Intune, Conditional Access, Endpoint Manager, and the other E5 security tools, we can assess the context of each sign-in attempt to provide both improved security and a frictionless employee experience.”

That means enforcing Conditional Access policies in Azure AD to make context-aware access decisions and organizational policies for an automated but intelligent matrix that helps protect the organization.

Elevating security practices to an art form

This granular, creative approach is the result of a prudent philosophy rather than a set of arbitrary rules. “We’re always working toward a pragmatic balance between security and productivity,” says Bull. “When you adopt a Zero Trust mentality where everything is hostile, it changes your whole approach to information security.” Elanco security teams now rely on interconnected Microsoft Security solutions to easily adjust policies and practices across the company’s IT landscape.

Elanco employees use the Microsoft 365 suite of productivity apps. The ties between security and productivity solutions like Microsoft Teams accelerate productivity while also helping to make security stronger and easier. “We maximize our return on investment because of the broad range of applications and security capabilities under the banner of our Microsoft 365 E5 licenses,” says Bull. “We plan to continue maximizing our use of those capabilities and adding to them in upcoming Microsoft releases.”

Enjoying security threaded through the whole landscape

Born in the cloud, Elanco was perfectly positioned for the pivot to remote work during COVID-19. It adapted almost instantly, and Teams, already the preferred Elanco collaboration solution, was key to keeping everyone in touch and on track. The interoperability between Microsoft productivity applications and its security solutions meant less stress for the Elanco security team—and peak employee satisfaction. “One key pillar of any data security program is having a good information classification policy,” says Bull. “Operationalizing that can be challenging in some areas, but Teams makes that easier through its interoperability with SharePoint and other collaboration tools.”

For Bull and Nisar, the success of the rapid rollout came down to a connected tool set that underscores their commitment to providing the best possible user experience. “We build trust by showing that we care about the user experience,” says Nisar—a point that Bull enthusiastically endorses. Nisar’s seen too many scenarios where overzealous security teams have created a robust but difficult-to-use security model. “That approach doesn’t increase security,” he explains. “Conversely, when people find that security policies make their jobs harder, they’ll look for ways to evade them. I think the user experience and information security need to be intrinsically tied together. Our Microsoft tooling strikes the balance we need to keep employees productive while also helping keep Elanco safe.”

With a busy 18 months behind them, both men are proud to have created a future-ready IT landscape for a worldwide enterprise in a critical industry during disruptions caused by COVID-19. “This has been a once-in-a-lifetime journey and I’m incredibly proud and humbled by my team’s accomplishments,” muses Nisar. “I don’t think many companies have gone through a separation IPO and an acquisition during a complete greenfield security rollout. Oh, and we had to continue normal operations during a global pandemic because the world needs our products.” Bull agrees. “The last 18 months have been a remarkable journey,” he says. “We rebuilt an entire IT landscape—productivity, collaboration, HR, cloud, and security—from the ground up. That’s only possible with the phenomenal work of our internal team in deploying the innovative Microsoft stack.”