One Identity Manager Reviews

Like any other identity manager product, the best use cases for One Identity Manager are where you need to use a lot of business logic, and you'll have to configure the processes the way the business wants. In my opinion, One Identity Manager is the best product for business logic and administration. The solution is pretty scalable and can be used in finance, health care, and higher education. One Identity Manager would help if you have an SAP in your environment. It's a top product related to active directory and integration.

The most valuable feature of One Identity Manager is its object-oriented architecture. According to this architecture, every element written inside of the system is an object and can be granularly given to someone. The solution's control is amazing. Another great feature of One Identity Manager is its ability to delegate responsibilities to different types of people through granulated access.

One Identity Manager is an incredibly powerful product, but sometimes people need something simpler. The solution should come up with a lighter version so people can buy different versions. I want to see more analytics and not just analytics in terms of reports but actionable analytics.

I have been using One Identity Manager for about 14 years.

One Identity Manager's technical support is pretty good.

One Identity Manager is the best product in the market.

We are implementing OneLogin right now.

Overall, I rate One Identity Manager ten out of ten.

The purpose of One Identity Manager is to implement identity and access management tools. For on-premises use, we must connect various target systems and trusted sources with the central identity and access management tools. This involves integrating Workday or other HR management systems with One Identity Manager and linking authentication sources, such as Active Directory or Azure AD, with One Identity Manager. Additionally, One Identity Manager has a specialized connector library for SAP solutions.

This solution can be deployed on the cloud and on-premise.

One Identity Manager connects SAP accounts to employee identities under governance from the connections that are provided. 

For customers who already have an SAP system in place, the availability of readily available, specially-designed connectors is crucial. This would be highly beneficial for all clients with SAP systems.

The solution delivers SAP-specialized workflows and business logic. 

This vendor provides end-to-end solutions that cover a wide range of areas related to user administration and governance, such as identity governance and administration, identity management, access management, and cloud-based solutions. They are also one of the few vendors to offer complete privileged account management solutions. Recently, they acquired OneLogin, which adds customer identity and access management to their comprehensive offering.

One Identity has solutions for all needs related to the IDE and privileged identity.

One Identity Manager provides a Web UI interface for users, which is currently being modernized through their latest initiative UI. Looking at their roadmap, we can expect to see more advanced UI from One Identity Manager in the future, reflecting ongoing product improvement.

Customizing One Identity Manager to fit specific needs is moderately difficult. With the help of experts, customization is possible, although it may not be a straightforward process. While it is not extremely difficult, it does require some level of expertise to carry out successful customization. One Identity Manager offers various tools for different customization requirements. Having the appropriately skilled resources available can greatly facilitate the customization process.

We make use of the solution's business rules to map our company structure for dynamic application provisioning. The importance of the business rules functionality lies in its ability to assist business analysts in designing organizational approval and provisioning policies. When gathering requirements, business analysts can utilize business rules to create effective policies that meet their needs and achieve their goals.

Connectors are available for both on-premise solutions and cloud-based applications or systems. One Identity Manager offers Starlink connectors specifically for connecting to cloud-based solutions. Although I have not personally worked with this offering, I am aware that it is available.

One Identity Manager helps to minimize gaps in governance coverage across test, dev, and production servers. They offer a feature that allows for the import and export of work, which is useful for moving content between different environments.

Reducing gaps in operations is crucial, not just for identity management but for any product. One way to achieve this is by synchronizing test, dev, and production environments as closely as possible. While it may not be feasible to replicate production exactly, having a miniature model that closely resembles it can greatly reduce gaps and potential problems. This concept applies to all identity and access management products when implementing them. The closer your test or dev environment is to production, the better you can reduce gaps and find potential problems that could arise in production. By identifying these issues in the test or dev environment, you can address them before they occur in the production environment.

The solution has helped create a privileged governance stance to close the security gap between privileged users and standard users.

The critical capabilities of any identity management product are operational activities such as providing access, provisioning, and deep provisioning. These tools are essential to efficiently manage identity and access. However, I am a bit confused about how licensing works with these capabilities.

The solution aids in simplifying application governance aspects such as making decisions regarding application access, ensuring application compliance, and conducting application audits.

The application governance requirements are being taken into consideration while designing and implementing streamlined solutions, which prove to be helpful.

One Identity Manager provides a dedicated module that enables us to set up a test station as per specific requirements. These test stations can be reviewed by the respective managers and their subordinate application orders based on roles. There is also a notification system in place to keep users informed.

In One Identity Manager, there is a module for review and attestation cycles. Whenever this cycle is triggered, notifications are sent to the respective parties who need to take action on their subordinates or evaluate role members. All of these features are available in One Identity Manager and can help fulfill business requirements. Moreover, One Identity Manager can indirectly assist in managing compliance auditing by tracking all actions, such as who performed them and when. This can be beneficial during external or internal audits as it helps in generating reports.

The solution positively impacted our operations and business by allowing us to streamline account provisioning for new hires and employees transferring between departments. When a new member joins my department, their line manager can request the creation of their account in advance. The request is then approved by concerned approvers and notifications are sent out. This reduces the onboarding time for new employees and ensures a smooth transition when an employee moves to a new department. Access can be removed or granted as per the requirements of the new department and line managers can request these changes through the portal, further simplifying the process.

The zero trust model can be implemented based on our understanding of the requirements. We need to design the business policies, rules, role membership, dynamic role membership, group memberships, etc., based on our understanding of zero trust. We need to set up the rules and policies according to the zero trust model and then implement them to achieve our business objectives. This includes designing policies based on departments, roles, job titles, and locations. By doing this, we can effectively implement the zero-trust policy.

The most valuable feature of One Identity Manager is it simplifies user-account provisioning and administration. One Identity offers a comprehensive range of solutions that cater to almost every aspect of the identity and access management domain. Their solution suite includes a login solution for access management that can be seamlessly integrated with your IGS solution. Additionally, they offer a dedicated tool for IGA that fulfills all your identity and assessment requirements. In addition, they have a solution called One Identity Safeguard for identity management and access management, which is gaining increased importance. With One Identity, you can obtain end-to-end solutions from a single vendor, whereas with other vendors, you would need to combine various vendors to achieve the same result. 

The tools within One Identity Manager are distributed, meaning there is no unified platform that covers all development, configuration, and installation details. Instead, there are separate tools for each requirement, such as object browser designer, manager tool, synchronization editor, report designer, job queue, and DBQueue. While these tools have built-in functionality, it can be tedious to learn and implement them all. This is in contrast to SharePoint, where all requirements related to role management, workflows, provisioning, and connector configuration can be implemented in one portal. In the case of One Identity Manager, different tools need to be used for each respective requirement. For example, the sync editor is used for connector configuration and related synchronization, while the job queue and DBQueue are used for monitoring jobs.

One Identity Manager is currently in the process of modernizing its UI, which I hope will result in a more user-friendly interface for its Identity Manager. However, it is uncertain whether they have plans to consolidate their various tools into a unified system to simplify configuration and tasks.

It is important to note that this modernization effort is a long-term goal, given that this solution has been in the industry for over 20 to 30 years. Despite its age, it remains one of the leading solutions in the market and is recognized by Gartner and other similar institutions as a top solution.

I have been using One Identity Manager for approximately one year.

The solution is stable in my usage. Since the setup is distributed, there are several components in the environment. Regular monitoring allows us to take appropriate actions when necessary. The solution is stable and scalable according to the available data and comparisons with other vendors' products, as evidenced by reports from Gartner and other evaluators such as Scooping Your Coal. Based on a comparative analysis of multiple products, including those of leading competitors, I have come to this conclusion. These analysis reports are typically released annually.

I rate the stability of One Identity Manager a seven out of ten.

One Identity Manager loads various identity and access management tools, it necessitates multiple instances for applications, web servers, and job server services. Therefore, the installation requires a substantially distributed setup but overall it is scalable.

I rate the scalability of One Identity Manager a seven out of ten.

I have not used the support from the vendor. One Identity has various support sites, such as the support center and community sites, which can help address any questions or issues related to One Identity products. However, my experience with these sites is limited, and I cannot provide more detailed information.

Installing One Identity Manager can be considered moderately difficult, but not overly so since it is based entirely on the Microsoft Windows platform. In comparison to other software installations, it is moderate in difficulty and should not be too challenging to complete.

The deployment timeframe for One Identity Manager varies depending on the size and scope of the project or proof-of-concept. It is difficult to provide a specific estimate without knowing more about the project requirements. Generally, it can take anywhere from three to six months to complete the deployment based on the project scope.

If you want to showcase the functionality of One Identity Manager, the solution provides a cloud environment to its partners with a pre-installed setup. You can use this environment to demonstrate to the customer for a limited time of about one week. This is a quick and easy way to showcase a few use cases that align with your project scope. However, the actual implementation timeframe will depend on the specific project requirements.

I rate the initial setup of One Identity Manager a seven out of ten.

Typically, the installation and configuration of One Identity Manager are handled by a specialized team, while the development and configuration of individual tools to meet business requirements are done by other parties. For installation and configuration alone, it may require at least two individuals with the necessary expertise to ensure a successful setup.

The requirement for maintenance and support varies depending on the situation. If it's a 24/7 operation, then three resources would be needed to cover all three shifts. However, the need for resources depends on the different aspects of maintenance, such as infrastructure installation, configuration, daily health checks, and level three support, which involves the development and making of changes. Typically, organizations have dedicated teams for these three areas, team members should be assigned accordingly based on this information. The tool is comprehensive and able to meet identity and access management needs. However, it can be complex as it contains multiple tools to address requirements in specific areas.

I rate One Identity Manager an eight out of ten.

Currently, we are using the One Identity Manager solution for user feeding from the HR database to target systems such as Microsoft Active Directory, Microsoft Exchange, and other protocols and servers. In our organization, One Identity's main use case is user feeding, user onboarding, and user offboarding.

We have created job flows for users, and One Identity listens to our HR database to see if there are any changes. It detects any changes and then synchronizes with the target systems or feeds the target systems. We have created a custom workflow based on our organization's requirements, and then we are managing our users with One Identity.

One Identity has a single sign-on solution. If you want to use single sign-on or auth providers in your organization, you can use it, but currently, we are not using it for the single sign-on features. We are using it for privileged accounts. We have created custom rule sets for access reviews, attestation, etc. We have also created flows for the segregation of duties and job rotations. We are handling these operations or regulations with One Identity.

We are completely working with an on-prem solution. As per Turkish financial regulations, we can't use cloud services for financial services. That's why we didn't test any scenarios related to the cloud and any software on the cloud. We are currently using its latest version.

It's very easy to implement for privileged accounts and for our regulations. It's a competent solution that we can use for our regulations and requirements.

We use its business roles to map company structures for dynamic application provisioning. We are implementing and developing our business roles for business needs. One Identity mainly manages our business roles to do all the business and use financial tools in our bank. It's critical for our business. If this solution is not working properly, our main functions and our main operations will not continue because all access rules are managed with One Identity. Some roles will not be able to do their daily tasks. Currently, One Identity is managing the roles for credit approval, credit preparation, and credit final approval. Without it, they cannot do their daily tasks, and they cannot approve credit.

For IM services, we are completely working with One Identity auto-flow jobs. Our help desk, or our user administration teams, are not involved in any subsidiary company's employees' processes. We delegate activities related to user onboarding and offboarding to their HR teams. They start the onboarding process with their own portal running on One Identity, and then, auto tasks and auto flows are managing the operations to the target systems. Our operations teams are not involved in this process, so there is no overhead in managing users.

We have many regulations for access reveal, user onboarding, user offboarding, user rotation, and user re-organization tasks. For example, if users move to another department, One Identity manages the activities for data operations, such as removing some groups and adding new groups. It happens automatically with One Identity. We need to meet these regulatory requirements, and it helps with that.

We can also see historical operations and modification logs with One Identity. If we need information about any activities, we can create an identity-based custom report for users or an object-based report for groups. We can create a report to see what happened, what changed, and which modifications happened in our systems. We can provide detailed reports to our auditors. It has powerful reporting tools for auditing activities.

One Identity Manager completely helps us with our operations. We are relying on One Identity for our operations. We don't want to touch Microsoft AD, Microsoft Exchange, or other target systems. We don't want to touch them, log in to them, or operate anything on these servers. Our master database and our master platform for modifications is One Identity.

It has helped to close the security gap. If any unauthorized change happens on our target systems, or a suspicious change happens in our target systems, the One Identity platform overwrites these operations because the master database is One Identity. If there are any security vulnerabilities, or if there are any suspicious activities that are identity-based or related to our privilege groups, One Identity will ignore and overwrite that with the master data.

Identity Manager has been managing our application authorization tables. All of the authorization tables and all the access-revealing features are managed with One Identity. These tasks are delegated to us, and we are providing One Identity's reports for the auditing activities and requirements.

Changes are being synchronized with applications. If there are any changes on One Identity access tables, it'll affect the applications directly.

It has helped to achieve an identity-centric Zero Trust model. We can manage and we can feed from one database to all target systems. We have distributed target systems. We have more than 10 target systems, and we are effectively using One Identity tools for managing and seeing from one view. From the operation side or the administrative side, this solution helps us to have a view without logging into the target systems.

We did a PoC with other identity management tools such as SailPoint, Oracle Identity Manager, and Microsoft Identity Manager. We chose this product for being able to accommodate our requirements. It's very flexible, and it's open to being developed to our requirements. For example, for our custom tasks related to subsidiary companies, we created a custom HR portal for our subsidiaries. These employee accounts are not in our main HR databases. We created a portal in One Identity for their HR divisions, and they are doing their daily operations on this One Identity custom portal. That's why we chose this product for our production environment.

Another reason for choosing One Identity was the local support and the Password Manager solution that they have.

The product's GUI could be more user-friendly.

One Identity can improve its Password Manager solution for custom requirements. We want to manage different environments, such as test environments, and we want to manage their passwords, but we can't use this solution because their environment does not have its own connector server.

I'm not sure if One Identity already has it or not, but there could be a Privilege Identity Management solution from the vaulting side in the One Identity family.

It has been almost three years.

It's very stable. I would rate it a nine out of ten in terms of stability.

It's scalable. We have installed it on an on-prem server in one of our data centers, but it's a highly available infrastructure. It's not a standalone server. We have a redundant topology for this one. The approximate number of end-users who are using this solution is 35,000. Its usage would only increase by 5% in our organization.

Currently, we are using both premium support and local partner support. We are getting support from our local partners for the development requirements from our side. They are supporting us with development requirements. I would rate our local partner an eight out of ten in terms of support. 

We used Security Identity Manager from IBM. We switched to One Identify because that product was out of support, and it was not open to implementing a custom workflow from our side. It was not flexible, and it was not a convenient service.

I worked as a team leader. I was involved, but I did not execute or administer this service. We worked with our local partners, and they did it for us, but it was straightforward. 

It took about three months to implement it. We closed our old identity management solution and moved all the workflows to the new one, but the installation was quick.

We used SoftwareOne in Turkey for the implementation. In general, four people were involved in the implementation. We had two people from each side, and then there was a project manager. People from our side were from the Identity Access Management department. They were Access Management architects. From the integrator company, two people were Identity Access developers.

Our experience with SoftwareOne was good. They helped us to customize the solution for our particular needs. They trained us on the solution, which was very helpful for us in managing and doing daily activities. They have also been involved in post-implementation support. We are happy with their support. They have been very important to us. We wouldn't have been able to go further without them.

In terms of its maintenance, for the maintenance tasks, two IM specialists are involved.

It was okay for us. It was not too much for us. It was nearly the same as other products. It was not expensive.

We aren't paying any costs in addition to the standard licensing fees. We are just paying for the local support. We are paying for the development requirements to our local partners.

We evaluated SailPoint, Oracle Identity Manager, and Microsoft Identity Manager. When we compared this solution against SailPoint, they were very close, but the local support and development capabilities were the reasons for going with One Identity.

It's a very flexible solution. You can improve or develop it based on your needs. If you have a little bit of knowledge of .Net code, you can create whatever you want. The product is so open to development. If you have some coding experience, you can do whatever you want. This is one of the most important things for us.

I would rate it an eight out of ten.

We're a consulting company and provide professional services. If the customer has the solution, we end up using it. 

It offers really powerful processes. For example, when a person is joining a company, or changing teams, or leaving, it's easy to create a management flow for the onboarding or offboarding process. It helps manage all of the accounts a person might need to have access to. It integrates with several platforms and has specific connectors that make it very useful. It works with the majority of applications an enterprise might be using, such as Salesforce or various cloud providers. It also integrates well with SAP. 

It provides a unified view of logically connected solutions. It can connect to accounts related to employee identities under governance. It's probably the main reason a client would use the solution. The entire reason to deploy such a solution would be to have governance over accounts and have access to the life cycle of the account. 

The solution is a single platform for enterprise-level administration and governance of users, data, and privileged accounts. 

It can be fairly easy to customize, depending on a user's particular needs. If you are integrating with some very common solutions, it's pretty straightforward. 

The solution offers various business roles to help map company structure, name, and provision. You can tie permissions to specific roles very effectively. You can implement role-based access control.  

We've used it to extend governance to cloud apps. This is important to us. The common trend is to move to cloud applications. Even local clouds afford the same level of permissions. Having a standardized layer in between definitely helps. 

We immediately noted the benefits of the solution. However, it depends on the type of user. Common enterprise users can get quick results. Those responsible for identity access management or compliance see the results quickly. They'll benefit almost immediately. The normal user, however, may not understand the difference. 

You can use the solution to minimize security gaps and close the gaps between privileged and standard users. 

It can help consolidate procurement and licensing. It can help you understand how many users need access to specific applications to help you get better numbers as to what is needed and not overbuy licenses. 

The solution helps us streamline application access decisions, application compliance, and application auditing. You can get reports. It's nice. It helps with visibility and planning. 

It helps reduce footprints and minimizes access from unrelated teams. 

The user interface can be a bit clunky. It could be more modern. 

Its documentation could be better, especially around complex configurations. 

Support could be better as it is part of the user experience of the product itself.

I've used the solution for the past year. That said, we do not use the solution in my company directly. 

The solution is pretty stable. I haven't experienced any major issues. 

It's a scalable product. You can integrate with many platforms, and it works well with the majority of common enterprise platforms. It's pretty scalable overall. 

I've contacted support in the past. There is premiere and regular support, and I've used both. I work mostly on the client's behalf, which I would reach out to would depend on the client's contract. 

Premiere support has more advanced engineers and is more available to the users.

Normal support could be better in terms of the level of service. They should offer more services during the initial deployment and configuration. 

Neutral

I have used competitors in the past.

One of my colleagues handled the configuration and setup process. I've never experienced a deployment. 

If any maintenance is needed, it will depend on the deployment model. For example, if it is on-prem, it would need a bit more maintenance than if it were deployed on the cloud. There may be access and configuration reviews or integrations with other platforms that may be ongoing on occasion. 

Given the fact that you can save a lot of time and headaches around compliance, it is worth paying for this - if you are an enterprise. SMEs may find the cost high, even though they could benefit from the offering. 

We're One Identity partners. 

I'd rate the solution seven out of ten. 

My clients use One Identity Manager to streamline and enhance their identity and access management processes. Whether it is a university simplifying student onboarding, or a global corporation managing employees across multiple branches worldwide, One Identity Manager helps them efficiently onboard, move within the organization, and offboard individuals. 

One Identity has transformed our organization, particularly in streamlining the join, move, and leave processes. It has shifted these from being manual or non-existent to around 80% automation, making a significant and beneficial impact. Clients, especially in large enterprises, have experienced drastic improvements with One Identity.

One Identity Manager has helped minimize governance gaps, particularly in the transition from test to development and production servers. This has significantly streamlined our operations and simplified the delivery of functionality for our customers who utilize One Identity Manager.

One Identity Manager has helped establish a privileged user governance stance, particularly in recommending regular reviews or rotations of privileged accounts. This approach is not only for privileged accounts but also for general usage analysis, ensuring unused accounts are closed, and optimizing licensing. Overall, it contributes to a more robust IT governance framework.

One Identity Manager helps consolidate procurement and licensing processes effectively.

The most valuable features are centralized Identity Management, robust Access Governance, and One Identity Manager workflow automation, simplifying user management and compliance.

In terms of improvement, the web portal for end-users in One Identity Manager has improved but could still see enhancements. The training for admins is crucial, and once you gather the knowledge, it becomes fairly easy. However, documentation could be better, especially for new features. It currently doesn't cover everything comprehensively, making it challenging to navigate some aspects. Improvements in documentation would be beneficial.

I have been working with One Identity Manager for four years.

It is quite a stable product. I would rate the stability as a nine out of ten.

I would rate the scalability of the product as an eight out of ten.

As a partner, we have access to a higher level of support, either gold or platinum. The support experience is generally good, and I would rate it around an eight out of ten.

Positive

Compared to Microsoft, One Identity Manager provides more granular and customizable solutions,  and although it can be used for managing cloud applications and user directories, it's primarily made for managing on premise tenents. The downside of OneIM is the documentation and training. 

The initial deployment of One Identity Manager can be straightforward with the right tools and knowledge, especially if using specific deployment tools. It typically takes around two working days for a basic installation. The solution requires maintenance mainly in the form of periodic upgrades to stay current. Other than upgrades, regular day-to-day maintenance is minimal, focusing on ensuring the application is up and running.

We are consultancy specialising on OneIM implementation. We are experts.

When properly planned and executed,  it should be pretty decent ROI

One Identity Manager is fairly priced, especially for large corporations or enterprises.

We use One Identity Manager for SAP integration, but it has some limitations. Managing logically disconnected SAP accounts can be challenging, and the solution feels somewhat incomplete. As a consultant, there is often a need for additional customization to address the intricacies of SAP integration within the broader One Identity Manager framework.

One Identity Manager connects to SAP accounts for identity governance. However, it is not the primary feature our clients emphasize. While useful, it is not the main driver for most organizations adopting One Identity Manager.

One Identity Manager provides Identity Governance and Administration for challenging aspects of SAP, including key codes, profiles, and rules. In a broader sense, it addresses these complexities within the SAP environment.

One Identity Manager is a solid choice for enterprise-level administration and governance. It effectively handles users, data, and accounts. While not perfect for privileged accounts, its integration with a complementary solution makes it a sophisticated option in the on-premise IGA landscape.

The user experience of One Identity Manager is unique, but it is not straightforward for an outsider. It requires some learning, and the navigation can be challenging without guidance. Overall, it is a complex system that benefits from the expertise of consultancies like ours.

Customizing One Identity Manager depends on your expertise. For experienced users, it is straightforward, but for beginners, especially in the first year, it often requires consulting with senior experts. Customization can be simplified with the right knowledge.

I use the solution's business roles to map the company structure for dynamic application provisioning. The business role functionality is crucial for us and our clients.

We use One Identity Manager to extend governance to cloud apps. It is essential, and I would rate its importance around seven on a scale of one to ten. Many customers, including us, find it valuable even if they don't plan to move entirely to cloud servers.

One Identity Manager helps streamline aspects of application governance, particularly in making application access decisions. The effectiveness largely depends on the implementation by the consultancy. If done correctly, it can greatly enhance application governance.

One Identity Manager has enabled application owners and business managers to make governance decisions without involving IT. If implemented correctly, there is minimal to zero IT involvement, allowing them to approve applications, manage access, and handle licenses directly through the One Identity Manager web UI. This aligns well with achieving an identity-centric zero-trust model.

I would recommend One Identity Manager, especially for large enterprises. However, it is crucial to consult with the customer first to ensure it aligns with their specific needs and requirements. Performing a proof of concept could be beneficial to validate its suitability for their environment. Overall, I would rate the product as an eight out of ten.

We provide IT services for several European clients, so their individual use cases vary. For example, one is a research center in Sweden. 

One Identity Manager helps minimize gaps in governance coverage. The privilege governance feature enables us to close the security gap between privileged users and standard users, positively affecting our overall operations.

One Identity Manager is user-friendly and easy to customize. One Identity's business roles enable me to map company structures for dynamic application provisioning, which is fairly important.

The user interface needs to improve.

I have used One Identity Manager for about five years. 

I rate One Identity technical support six out of 10. 

Neutral

I rate One Identity Manager seven out of 10.

The use case is like any other identity management solution: to provision and de-provision software accounts and entitlements for new hires and terminations, and to update name changes, leaves of absence, and those kinds of business cases. The goal of the tool is to automate processes of updating or modifying user access.

One Identity Manager is going to improve your CIS standards, or any other security framework, because it going to help automate account management and entitlement management. It's going to help organizations run a certification campaign and implement role-based access processes.

It also helps consolidate procurement and licensing. You can configure the tool to track cost-center expenses or licenses of software assigned to users' workstations. Typically, One Identity Manager is not used for that purpose, but it has those capabilities.

Another benefit is that it helps streamline application access decisions, application compliance, and application auditing. You can implement a request process for onboarding of any application, meaning a user can request access to an application and it will follow a workflow approval process and the request can be approved or denied. Once access is granted, One Identity Manager will provide access automatically to the target system. You can also define certification campaigns to recertify access for users. On top of that, you can configure segregation-of-duty rules.

In addition, if the application owner has all the information or the criteria to make a decision—i.e. all these users need access to my application, and all these users don't need access—we can integrate that application within One Identity Manager and enable a request engine process for that application. For example, if a new employee needs access to that application, they need to submit a request for access and the approval process will be directed to the application owner. The application owner can approve or deny access for that person. In that way, the entire decision process belongs to the application owner and not the IT department.

One Identity Manager can also help achieve an identity-centric Zero Trust model. You can configure the tool to identify the different departments, call centers, and locations to give them the minimal permissions necessary to perform a task. Furthermore, if you have critical access or entitlements that need to be recertified, you can run a certification campaign against an Active Directory group or Google group or SIP entitlement to recertify that these entitlements in Active Directory, for example, are assigned to these 20 users. You can then ask someone to certify this critical group and determine if all 20 users are still needed. If the decision-maker denies access to some of those users, the tool can remove the access automatically. It definitely gives you that flexibility.

It helps in managing SAP. There is a connector that you configure with the tool and it helps to provision accounts and assign roles or permissions in SAP. If there is a disconnected SAP application and you want to bring it on board, One Identity Manager gives you the tools to do so.

One Identity Manager connects SAP accounts to employee identities under governance. Although each organization is different, what is typical in some organizations is that it is important for them to meet security compliance regulations like CIS controls. They use the solution to meet those requirements.

In addition, healthcare companies have to be HIPAA compliant. One of the HIPAA rules is related to terminations. They need to make sure that every user or employee who is terminated is denied access within 24 hours. One Identity Manager helps you to implement that kind of case. If we connect One Identity Manager with the human resources system, we can read the employee's end date and automatically disable access for that user in less than 24 hours. In fact, we can disable the employee, once we have connected to Active Directory, in five minutes or less.

One Identity Manager doesn't have a privileged access management model but we can create one. A robust solution is based on the Windows platform. To address this use case you need a SQL Database and Microsoft Internet Information Services. If your organization is a Windows environment, One Identity Manager is a good option for your company.

In terms of the user interface, Quest, the vendor, follows up-to-date web standards for development. Currently, they are moving to implement Angular as a framework to implement end-user UIs. As a result, end-users will see a pretty nice website, a web portal where users can approve requests, submit password changes, or submit new requests. Also, if there is a certification campaign running, the web portal is very user-friendly. The manager can log in and see items that need approval or denial. The current version is designed to support mobile, tablets, and web browsers.

We also make use of One Identity's business roles to map company structures for dynamic application provisioning. That is a very important feature because most companies want to implement role-based access. Business roles are one way to help companies to identify job codes and position codes. It enables the grouping and automating of certain types of access for certain departments. For example, if you know all the people in your sales department, you can configure a business role so that anybody who is a new hire in that department will get certain accounts or certain access or certain groups in different applications. Doing that in One Identity Manager is a very simple task and it is very well organized.

The product can also be extended to support any of the SaaS or PaaS applications on the cloud. Nowadays, identity manager solutions are focused more on managing of identities and entitlement access on-premises. But companies are moving to the cloud and it has become very critical for solutions to start handling user accounts and permissions in the cloud. One Identity Manager is specifically a product that is moving in that direction and providing connectors to the cloud. It's a gap that needs to be closed and not many providers are investing in that. I've been implementing One Identity Manager for 12 years and I still haven't seen any other company doing cloud identity management, 100 percent. Hopefully, next year and in the following years, more companies are going to start adopting that technology.

And whenever you implement test, dev, and production servers, it will help minimize gaps in governance coverage among them. Using the solution you can connect and configure users in production, but if you configure dev or test instances, you should absolutely be able to handle ID and governance access for those applications.

End-user UI customization is difficult and requires some knowledge of proprietary Angular technology. Every time a customer asks us: "Hey, can we modify this form in the UI?" or "Can we integrate a new form?" it's difficult to do. It's possible and we usually do it, but coding form changes typically takes two to four weeks, depending on the changes.

There is also a lack of connectors. One Identity has between 10 and 20 connectors compared to SailPoint IdentityIQ, which has about 100 connectors. Quest is improving on that. They do have cloud connectors and you can expand the number of connectors. They know there is a gap. But the connectors One Identity has are the most common connectors among all organizations.

I have been implementing the solution for about 12 years.

I don't use the solution as an end-user, I just implement it as a consultant for multiple companies. When a company wants One Identity Manager, I gather requirements, do the design, implement the solution, and train people on how to use it.

The product is very stable and performs well for medium-sized organizations with fewer than 200,000 users. For organizations with over half a million identities, there are some performance issues that have been found in previous versions, issues that affect the end-user experience. For example, if you run an attestation cycle or a request for a deployment with half a million identities, the system becomes a little slow in processing end-user requests to refresh a page, because of the amount of data.

Once you go into production and you have a stable system, you have it for a year or two, as long as there is no major issue that you find in your deployment, something that can be fixed in the next release. Typically, customers have the same version for one or two years before they decide to do an upgrade. Going through an upgrade to the next version means a lot of production testing of your current implementation.

The scalability is very good. You can scale the application job servers or web servers. They are very easy to scale. Once you have identified your gap or your need for scaling in your current deployment, it's just a matter of adding a new server, configuring it, and you're done. It's highly scalable.

The only advantage of their Premier Support is that you have an agent from the vendor assigned to your account, someone you can contact for any kind of product updates or fixes. That person will also tell you, "Hey, the next release is coming and these are the new features, these are the hotfixes." You get the added value that if you open a support ticket with them, your Premier Support agent will try to get a response a little sooner than usual.

Neutral

The deployment is in between easy and difficult. On a scale of one to 10, where 10 is "easy," it's an eight. It's not difficult to implement and use the out-of-the-box functionality. I can have a company running in two weeks, including connecting the tool with Active Directory and creating and updating users.

When a company wants more customization, that is when it starts getting more complicated. But if a company is looking for basic use cases and not too much customization, from the start of gathering requirements, though deployment in production and Active Directory, could take three to four weeks. That is fairly simple.

You have the option of deploying the solution on-premises or in the cloud or using Quest's cloud. The solution requires application or database servers in a web server. You can deploy it on-premises or, if you have Amazon or Azure components, you can deploy the solution there. And Quest, as a company, offers cloud services, where you pay for a One Identity Manager instance with the number of users you need, and they will do the installation and configuration for you, and they will take care of all the technology. You then just need to implement your use cases. So there are three options: On-premises, where the customer handles all the servers, in the cloud, where the customer handles all the servers, or through Identity Manager on Demand, where Quest manages all the infrastructure and servers and the customer just implements the business cases.

The number of people involved in an implementation depends. I have led teams of two people and teams of 20 people. I have implemented the solution for companies with 10,000 users and I have done an implementation for a major company with about half a million identities. For that instance, we had 10 dev servers and 20 people involved, including developers, testers, project managers, et cetera.

At the very least, when the vendor releases hotfixes every three or six months, you will need to do maintenance if there is an issue with your implementation that has been addressed in that release. Typically, customers do upgrades once a year to the next version. But the solution doesn't require a lot of attention.

My advice is to review your business cases and try to use most of the out-of-the-box features of the product, instead of asking a consulting company to customize the solution. Adding customizations will add some burden when you need to upgrade to the next version or make changes. They will increase the chances of failure and your progression and smoke testing. Try to reduce the amount of customization with this tool.

When it comes to customizing One Identity Manager for particular needs, it's like any other tool. When the tool is implemented we try to push customers to use all of the functionality. If there is a need to customize, on a scale of one to ten, where ten is easy, customizing it is a seven.

And as a tool, on its own, it does not create a privileged governance stance to close the security gap between privileged users and standard users. It needs to be integrated with another product. One Identity Manager does the user provisioning, de-provisioning, and access requests and management. But if you want a full integration with a PAM solution, Quest has a different solution called One Identity Safeguard. Safeguard is the solution for privileged access management and can be connected with One Identity Manager. By connecting the two tools, you can keep track of the submission of requests with One Identity Manager and the fulfillment of the requests in the privileged access management tool, which is Safeguard.

In terms of the use case, the traditional use case related to IAM is to synchronize the accounts to the user ID.

Most of the time, we connect it to Active Directory, Azure AD, SAP One, and one or two other systems at the first stage of the project. At the next stage, we start to integrate it with other systems.

My company is an integrator and a partner. I am not the final customer. I deliver solutions to our customers. I also have other solutions in my portfolio, but my strength is Identity Management.

One Identity Manager delivers SAP-specialized workflows and business logic.

It provides a single platform for enterprise-level administration and governance of users, data, and privileged accounts.

The user interface is not a big problem nowadays. About 10 years ago, it could have been a problem, but now, it is easy to do proper localization in Portuguese, Brazilian Portuguese, and Spanish. We have multiple language support. Of course, it is not yet 100%.

When it comes to customization, we need to model the business rules for customers. Every customer has different business rules. For a similar use case, you can have different business rules. I split the ability to model that into two categories. There is the ability to do the parameterization, and there is the ability to do customization with coding, which can have some risks.

One Identity Manager helps minimize gaps in governance coverage among test, dev, and production servers.

It also helps to create a privileged governance stance to close the security gap between privileged users and standard users.

One Identity Manager helps consolidate procurement and licensing. One of the valuable use cases that this solution provides is to take care of the licensing for some of the applications.

One Identity Manager helps streamline the following aspects of application governance: a) application access decisions; b) application compliance; and c) application auditing. We can deliver a use case where when a user requests access, the user may receive a warning that the access being requested conflicts with some other access that the user may already have. We can now model the SOD rules to validate a request when it is made. It is very important to be able to use One Identity Manager to do this kind of validation at the time of the request.

One Identity Manager enables application owners or line-of-business managers to make application governance decisions without IT. We can model that kind of personas, participate in the process, and make some decisions in the workflow process.

One Identity Manager helps to achieve an identity-centric Zero Trust model. That is a very strong use case of One Identity Manager. They claim that they are the only vendor that can deliver the Zero Trust model or Zero Trust architecture for identity, but I do not know if they are the only vendor.

One Identity Manager connects SAP accounts to employee identities under governance. The connector from One Identity for SAP is the most powerful one in the market. This connector can touch all the levels of the objects in SAP. It can not only be connected to SAP ERP but also to SAP HANA, GRC, etc. One of the strengths of One Identity Manager is the SAP connector. You can touch a lot of the SAP environment and also have deep granularity.

It is a very powerful solution, but when it comes to doing some complex parameterization or authorization, we end up coding. Comparatively, CA solutions require less coding. It is more powerful than the CA solutions, but you end up with coding in VB.Net or C#. Complex parameterization could be better from their side. There can be more documented templates where you can take a piece of code and deliver a specific use case. I cannot find that in the documentation. Sometimes, you can go to the community, and sometimes, you have to use their support.

If you implement it properly and finetune it, it is very stable.

I have used their Premier Support. It is called PSO. It is very easy to book an appointment. You can use the calendar to find a slot. You can take half an hour or one hour. Once you are connected, the guy knows it is very important. Based on my experience, they were able to provide the resolution and tell me about the button that I needed to hit and what I needed to do. At that time, I asked them why it was not documented, and the answer from the PSO was that for specific matters, they wanted us to contact PSO. 

I prefer not to involve PSO because the prices are huge. We try to avoid it. When I need to involve PSO, it adds value, but it is very expensive. Whenever I involved PSO, I got the answers I needed within the time in which I needed the answers. I would rate them a ten out of ten.

Premier Support has not been an influence in purchasing additional licenses or products from the vendor.

Positive

I never implemented the SaaS model because of the pricing. My experience is for on-prem.

Its implementation is easy for me, but it is very complex for those who are doing it the first time. It is not straightforward. They do provide documentation, but it is not easy. I usually build my documentation and enable my team. After that, it is easy.

For its implementation, one project manager and two more people are required. One is senior, and the other one is of intermediate experience. Sometimes, developers are also required for customization.

We licensed it from a distributor. In Brazil, it is not possible to directly license One Identity. The distributor's name is ADISTEC. We did not take their help with implementation. We implemented it ourselves. They help me with other solutions but not with One Identity because it is very specific. In Brazil specifically, I do not have resources to help me with implementation. Quest in Brazil has a structure only for commercials. They do help with presale but for implementation, I do not have any kind of help. I usually take the help of the YouTube channel, the official documentation, and the community. We are pretty much doing everything ourselves.

The maintenance usually involves changing the logic, roles, or workflows. After the sign-off for the implementation, I also provide sustainability services where I take care of any problems and also contact the vendor. I also help with the environment and sometimes help implement a new connector if it is easy to implement or is a native connector from an API, for instance. I take care of the sustaining phase issues where we are not installing everything again. We are doing a little bit of parameterization. These services are helpful for revenue and important for our business.

Its price is okay. 

Overall, I would rate One Identity Manager an eight out of ten.