REVO Insurance is one of Italy’s most innovative and technology-forward insurers, covering specialty business risks for small and medium companies. With their developers focused on refining their own core products, an identity surface spanning two systems became too much work to maintain. Here's how Descope helped REVO move its broker and agent logins off Keycloak, add a simple and secure MFA layer for customer verification, provide a single portal for accessing all applications, and put a lean team in control without having to write a single line of code.
About REVO Insurance
REVO Insurance is an Italian insurer built around specialty lines of coverage, addressing risks that don't fit traditional policies. Its primary customers are small-to-medium businesses and professionals with non-standard, niche, or specific commercial risks (like agriculture, surety bonds, marine, aviation, and financial lines) rather than mass-market personal insurance.
REVO sells through a network of brokers and agents, and they run more of their own underwriting and claims on in-house technology than most insurers of a similar size. That distinct model shapes REVO’s unique identity needs, especially when it comes to who is logging in with one of their channels.
These users include two main groups:
Direct employees of REVO Insurance
Brokers and agents who sell REVO policies
REVO wanted to add stronger auth for their employees while simplifying and modernizing their agent logins. The team that owned identity was skilled yet lean, which meant the solution needed to address the engineering burden without adding extra complexity.
The maintenance challenge with open-source identity
REVO ran employee login on Microsoft Entra and put Keycloak federation in front of the access its brokers and agents used to reach REVO's internal applications. The Keycloak side posed challenges across three fronts:
Using the open-source solution resulted in a federation setup that was expensive to run.
Any changes, fixes, or upgrades leaned heavily on DevOps work handled by a team with other priorities.
It was hard to introduce new functionality, protocols, and integrations with other tools.
That was a high cost for a team that valued agility. Because of Keycloak’s DIY nature, even a small change could mean pulling in developers with non-identity priorities and waiting until they had the cycles to address it. Descope research shows this is a common challenge across all organizations: 46% postponed CIAM improvements to deal with other pressures, while 37% delayed engineering roadmaps to address auth gaps.
Fabio Spagnuolo, IT Security Operations Manager at REVO Insurance, said:
"Even the most capable engineering team has bandwidth limits. We needed to be able to elevate security, add new options and build or change a login flow quickly, without pulling developer focus from our core product. Descope Flows made that possible."
The Descope experience
Descope offered REVO the flexibility their experienced engineers valued while saving precious cycles that would’ve been spent manually writing auth logic. REVO’s Descope deployment would also augment their employee Entra logins within the same solution, consolidating internal and external broker auth.
Moving broker login off Keycloak. Descope fully replaced the Keycloak federation the brokers and agents used to reach REVO's applications. A one-time scripted migration moved the users over in a single pass, carrying their custom attributes, application assignments, and roles, while preserving existing custom attributes and the underlying attribute-based access control (ABAC) and role-based access control (RBAC) models.
A portal the security team runs. Brokers and agents now sign in and land in Descope's Applications Portal Widget, which REVO customized heavily to match its own branding. They replaced access screens REVO would otherwise have had to build and maintain. REVO configures the portal and the login flows behind it without needing to write code.
Descope shipped features to meet REVO’s specific needs, including support for multiple domains on a single project, and portal access for users outside standard tenant structure. Building in Descope Flows also let REVO move logic that used to run as external calls directly into the login journey, allowing them to iterate in-house.
Strong identity without dev overhead
REVO's Descope implementation delivers a solution with less overhead, more agility, and MFA augmentation included under the same roof:
Less to maintain: Moving off Keycloak eliminated the DevOps upkeep, freeing their team to focus on refining rather than catching up with identity needs.
A more agile identity solution: With no-code Flows and the portal widget, REVO quickly builds and adjusts login journeys and access screens instead of waiting on borrowed engineering time.
Fabio Spagnuolo, IT Security Operations Manager at REVO Insurance, said:
"Even small changes to our identity setup used to take more time and effort than we wanted. Descope lets us tweak the screens our agents land on, and the flows behind them, in an afternoon."
Descope is a flexible drag & drop customer and agentic identity platform that helps organizations easily add authentication, authorization, and identity management to their apps, AI agents, and MCP servers. Customers use us for initiatives such as passwordless authentication, SSO, identity federation, strong MFA, fraud prevention, and agentic identity.
To get started with Descope, sign up for a Free Forever account. If you have questions about our platform, book time with our auth experts.
