We are implementing IDAM for an organisation with 300 employees and 100,000 customers. Some of the employees are customers, some of which are using their corporate account.
There are ~50 web applications in total, 5 of them allow both customers and employees to log in (others are either for customers or employees).
What are the risks in mixing both customers and employees in the same IDAM (same directory services, same IdP etc.)? As a point of reference, what do the tech giants do (for example do google employees have the same DS,IdP for employees and customers using gmail)?