One Identity Manager Reviews

The use cases for One Identity Manager include multiple aspects of identity and access management. One of the most interesting features I wanted to utilize was the user's access review, UAR module. The idea was to create a quarterly review process to review the entitlements and the access and controls in place, initially targeted towards Active Directory and later extended to other local systems. One Identity Manager can connect SAP accounts to employee identities under governance. It is possible to map company structures for application provisioning through dynamic application provisioning using role-based access control. Mapping roles to users is a seamless experience that offers a lot of leverage in terms of speed and compliance, making it a very useful feature.

The use cases for One Identity Manager include multiple aspects of identity and access management. One of the most interesting features I wanted to utilize was the user's access review, UAR module. The tool can onboard applications such as SAP, which is standard, and the APIs do not present challenges. One Identity Manager can connect SAP accounts under governance, and mapping roles offers leverage in speed and compliance. This functionality is crucial for compliance and governance.

The tool did not allow beyond a specific level of visibility; it provided visibility at the user level, not at the level of nested entitlements, resulting in an inaccurate depiction from the asset manager's point of view. This necessitated manually inputting data into the One Identity Manager user access review module. When it comes to privileged access management, we need to know who has access to what, which is the central problem we want to solve. However, for One Identity Manager, the visibility could be a lot better, especially given we are dealing with many data visibility products in the market.

Aspects such as reporting and dashboarding could be improved; I've seen tools doing better in those areas. One Identity Manager does not deliver specialized workflows for SAP; it offers very standard workflows. However, there are some modules that can be imported, and certain custom workflows need to be created. 

Customizing the solution for particular needs is very subjective. It does provide a lot of customizability, though there's room for improvement. One Identity Manager helps minimize gaps in governance coverage, but effectiveness depends on the organization. Ultimately, while One Identity Manager can solve problems, the tool must be combined with good people and a sound strategy for maximum effectiveness.

I have used One Identity Manager for more than ten years.

For single-site installations, it performs adequately, however, multi-tenant setups present challenges demanding significant improvements.

For single-site installations, it performs adequately. Multi-tenant setups present challenges demanding significant improvements.

I have contacted their technical and customer support. I consider their support to be very standard, relying on an email-based system. My support engineers have received solutions to their inquiries. However, a tailor-made, dedicated support would significantly enhance user experience, especially for organizations that do not want to wait in queues.

Negative

I would rate the initial setup at a seven out of ten. The reason for this rating is the critical nature of multi-tenant applications; compliance is heavily influenced by multi-tenancy, so a lot of engineering improvements could enhance the product.

Ideally, One Identity Manager as a SaaS tool handles maintenance; however, this depends on the specific maintenance discussed.

I had partners who helped set up the whole process, and they were familiar with implementing the tool. Some were contractors, and they did a pretty good job in terms of delivery, respecting timelines. When I was working with one company, my team was based in Nice, France, consisting of internal employees and contractors. They implemented the solution fairly well. However, I had to provide a lot of unnecessary reporting and overhead when connecting the tool with our production environment, providing data that could compromise internal security despite getting the right approvals. Overall, it was an okay experience with One Identity Manager.

We use multiple tools in tandem for better security. The procurement and licensing process can indeed be complex. My experience was decent, with no major problems during procurement or licensing; it was a mostly seamless experience.

With respect to privileged accounts, I would say One Identity Manager can improve; for privileged accounts, a lot needs improvement, and it is not best practice to depend on one tool. 

One Identity Manager could incorporate dynamic dashboarding to predict attack vectors and compromises.  

I would rate One Identity Manager seven out of ten since it can improve on many aspects.

I use One Identity Manager in a few different projects for the Air Force, and I have also used it for the commercial business that I currently work for, covering both government and commercial environments.

I do not use One Identity Manager to help me manage SAP.

I don't use One Identity Manager for IGA regarding the difficult-to-manage aspects of T-codes, profiles, and rules.

I do not use One Identity Manager to extend governance to cloud applications through custom interfaces.

The most valuable aspect of One Identity Manager is how customizable it is compared to alternatives, which is the most obvious and biggest differentiator for me.

I am a strong advocate for One Identity Manager because it provides a single platform for enterprise-level administration and governance of users, data, and privileged accounts. The tool is fantastic for what it does. However, in version eight and below, the UIs to perform all that functionality were terrible and even worse when customizing. The newer version nine is significantly better. I haven't had much experience with the latest version since we are still on version eight, though the UI to manage and perform governance could be better, but I know version nine has definitely improved in this regard.

One Identity Manager has helped me minimize gaps in governance covering test, dev, and production servers. We have two instances of One Identity Manager, and one instance doesn't necessarily allow us to manage test, dev, and prod all together, but separate instances of One Identity do.

One Identity Manager's documentation is something they can improve, and I believe much of this is related to translation since it is a German company. Access to documentation and finding answers on how things work is extraordinarily difficult.

One Identity Manager has not helped application owners or line of business managers make application decisions without involving IT. Regarding the elimination of the help desk's need to govern access to applications because of One Identity Manager, managers can go in and find the roles their employees need and dynamically assign permissions through One Identity Manager. However, I'm uncertain about what is meant by application governance decisions in this context.

One Identity Manager could help me achieve an identity-centric Zero Trust Model, but we haven't necessarily designed it to do so in any of my environments.

I have been using One Identity Manager for approximately eight years.

One Identity Manager is very stable. I haven't seen any major instability such as lagging, crashing, or downtime.

Considering that One Identity Manager runs off a database, as long as you can scale your database, the scalability is great because you can even set up multiple job servers.

I have contacted customer support or technical support for One Identity Manager, mostly because we are trying to customize things and need that next-level engineering support, not because of problems with the product.

The quality and speed of One Identity Manager's support were terrible years ago, but in the last few years it has gotten significantly better. I would rate the support currently as pretty good.

On a scale from one to ten for the support of this product, I would give it a nine. For the support recently, I would say seven.

Positive

The initial deployment of One Identity Manager when I first started was pretty easy with no major hurdles.

The first time I deployed One Identity Manager was eight years ago, which isn't a fair comparison, but regarding the most recent experience, I had it installed in under an hour, though I have also done it a few times.

One person can deploy One Identity Manager, so you don't need an entire team.

One Identity Manager requires pretty straightforward maintenance regarding the installation sustainment. However, for governing the system for a decent-sized corporation, you would want a couple of full-time people to govern all the functions. For day-to-day IT system administration, it doesn't really require much.

I did look into alternatives to One Identity Manager, specifically ForgeRock at one point, and there was something else we looked into, but I cannot remember the name of it.

I would give this product a review rating of nine out of ten.

On-premises

Other

One Identity Manager simplifies user operations and provides security features, including automatic blocking of inactive accounts and timely access revocation.

My user experience with One Identity Manager involves using Identity Access Management to provide security, compliance, and visibility. We have implemented RBAC, where we define roles and responsibilities based on job functions or permissions. We have SoD (segregation of duties), ensuring that no single user has permissions that could lead to conflicts or fraud. The benefits include reduced security risks, lower costs with SSO solutions, enhanced user experience compared to other solutions, and improved compliance with regulations.

Customization for One Identity Manager is based on client inputs. We can detail and break down the inputs for customization, including user interface customization, where we include manager and launch pad features. For example, we implemented the Genesys application for the service desk, where we can monitor daily calls, frequency, and agent performance. This implementation helps showcase to customers our multiple checks and background processes internally. We provide recording sessions to users for review and daily improvement. Configuration parameters come under several aspects based on system behavior. One Identity Manager provides default parameters for particular solutions, allowing an overview of the tool.

In my experience, the best features in One Identity Manager are under SSO (single sign-on), where we can save passwords and don't need to authenticate each time when accessing applications. This extends to the creation of privileged IDs and account creation in AD. 

Perhaps support could be improved. The knowledge base articles and wiki resources we currently use may not be applicable in every situation, as they often depend on the specific inputs or problems presented by users.

I have been using One Identity Manager for six years.

It is stable. 

We provide solutions for enhancing access governance with One Identity Manager, including identity verification and improving system security procedures. This includes designing and implementing IAM solutions for legacy systems, cloud migrations, and multifactor authentications. We implement MFA solutions for applications with larger audiences. We manage roles and responsibilities in IAM technology and conduct risk assessments to identify potential vulnerabilities. The identity verification process comes as an automatic solution, streamlining user onboarding and offboarding in the organization.

Our clients are enterprises. We have more than 50 specialists.

We use their regular support. I would rate their support an eight out of ten.

Positive

For identity access management, we have used multiple tools. When I was working on a banking project, we used a right modeling tool and Sphere and AD to create users in AD and Nsphere, which is an internal tool of a particular project. Whatever we handle in AD and the right modeling tool reflects in Nsphere, which serves as a portal where all users are displayed, and we can see which level of access is required for a particular application. Being in the banking sector, we have an N-3 approval format. Based on approvals, such as line manager approval, we make changes accordingly. We worked with privileged IDs where particular users want different sets of privileges for their accounts. For example, with my particular account in the banking sector, I can give third-party users access to my entire bank for read, write, and edit capabilities. For some users, I can give only read access, allowing me to segregate the privileged IDs and privileges for users who can access my application or banking portal.

In another project for insurance, we used applications in SAML and OIDC. For OIDC applications, we asked the end user to provide the client ID and based on that, we shared the configuration directly to their email IDs. They could copy-paste the same configuration to make the portal easily accessible. With SSO and One Identity Manager implementing that configuration for OIDC applications, they can easily access their portal without multiple authentications. Through single sign-on, users can sign in once and access the portal without passwords.

From my knowledge, One Identity Manager makes customer operations easier compared to other solutions. When customers have different applications or solutions but want to migrate to One Identity Manager, it's because of enhanced security and the convenience of the SSO process.

The setup is somewhat tricky because providing on-premises ID access requires following specific justifications and naming conventions, with different sets of servers to be added for users. We must be conscious while providing access to servers. For instance, if a user requests access to 10 servers, we need to evaluate whether they truly need all server access and can segregate permissions for cost and security reasons after consulting with line managers.

The cost is handled by customers, but it doesn't seem to be very expensive. It seems fairly priced.

We use One Identity Manager for business roles, implementation capabilities, SSO bypass, and automation deployment with guidelines. The licensing helps consolidate procurement when generating audit reports. We follow basic steps such as end-user satisfaction and improvement in regulatory functions to reduce business risk. We implement changes according to the system lifecycle and role-based access control. 

Privileged users receive separate access, enabling them to access cloud applications. With a privileged ID account, users can access CyberArk, Entra, and Office 365 to manage licenses. One Identity Manager provides good security through SSO and MFA implementations. While there can be dependencies during new configuration creation, we work to provide better user satisfaction and support. 

I would rate One Identity Manager a ten out of ten.

On-premises

We use this solution to enable a lifecycle for all the accounts we have in our Active Directory. One Identity Manager helps us enforce rules and renewal periods. It assists in tracking useless accounts to ensure that we do not retain people's accounts once they leave the company. We are extending the solution, highly customizing it to associate almost every object in our Active Directory with an identity. Every identity has a lifecycle and specific rules enforced by One Identity Manager.

The benefits are significant for us. We had no real central governance before implementing One Identity Manager. Being a large organization operating in 60 countries, it has helped us regain control over Active Directory. By enforcing rules, processes, workflows, and account lifecycles, it aids in cleaning our Active Directory and enforces strong workflows in user management.

One of the best features of One Identity Manager is its high level of customization. Since deployment, the solution has been tailored extensively to fit our specific needs. Its out-of-the-box capabilities are commendable, allowing for evolution and integration within an on-premise environment. For us, being able to customize the product to our requirements has been incredibly valuable, turning it almost into an in-house solution.

The new portal is in a specific technology that is more difficult to program. While it is a specific decision, the customization will become harder. A real SaaS solution could be provided rather than an on-premise product deployed on One Identity Cloud. Although we are not the target for this kind of improvement, a pure web-based SaaS solution could be beneficial for smaller companies.

The solution started deployment in 2018. My personal experience as a Functional Analyst with the solution is approximately two and a half years.

I was not part of the company during the initial deployment. However, it was relatively easy because it came out of the box. Upgrading is more challenging due to the extensive customizations we have, but this difficulty is more related to our use of the solution rather than the solution itself.

We have not experienced many issues with the tool itself. The problems we face are more related to our database consumption due to the high number of users. In terms of stability, I would rate it highly.

We have not needed to increase scalability much, and One Identity Manager supports a large number of users effectively. I would rate its scalability as strong since we have not experienced any significant challenges.

The technical support could be improved, particularly for architects with advanced knowledge. I have heard that the forums, moderated by One Identity experts, are helpful. Although sometimes support can take time, we have not raised any serious alerts about the quality of support from One Identity.

Neutral

We had no Identity Management solution before One Identity Manager. Compared to our previous situation, the solution provides significant benefits in terms of automation.

The initial setup was straightforward as the solution came out of the box.

We are working with a consulting company that provides specific support and resources for us, but they are not direct partners of One Identity.

One Identity Manager saved us approximately thirty to forty percent in terms of time, money, and resources compared to our pre-deployment setup. It significantly improved our control and management efficiency.

We have a global ELA, which means we do not have licensing issues. The price is correct and the relationship with the sales team is excellent. They are open to discussions whenever savings are needed.

I have no other experience besides Okta. Okta is more of an out-of-the-box solution with less customization opportunity, while One Identity Manager is a full product.

I would recommend One Identity Manager due to its customization capabilities. It allows you to adapt the solution to your specific needs. However, for smaller companies without high-level expertise, a pure SaaS solution may be less intimidating. I would rate One Identity Manager at a seven out of ten overall.

On-premises

We use One Identity Manager for workforce identity and access management. We have implemented basic controls like joiner, mover, and leaver processes for our employees. 

We are integrating our most critical and important business systems and applications into it, handling the access management to those systems using One Identity Manager. 

I like the solution since it is very flexible, and I can basically do everything that I like and need with it. 

I appreciate its automation capabilities a lot. Through automation, we have been able to reduce the number of service requests and tickets to our vendor. We have also managed to reduce the cost quite drastically in that sense. 

Additionally, by automating the access reviews, we have saved considerable time for our business leaders, even talking about several full-time equivalent savings concerning access review automation.

It works well at an enterprise level. We use it as a centralized platform for the whole identity.

It is a flexible system and we can customize it the way we want.

We use the business roles to map company structure for dynamic application provisioning. This is a very important aspect of the solution. 

We use the solution to extend governance to cloud apps and this is very useful for us.

Through automation, we have been able to reduce the number of service requests and service tickets towards our vendor, and we have been able to reduce the cost quite drastically. By automating access reviews, we've been able to save quite a lot of time - up to several FTEs. When we launched the system, we had quite a wide scope and saw results immediately. 

The solution helps us achieve an identity-centric zero-trust model. As you are getting your identity only through a centralized system and also getting all the accesses attached to that identity and all the accounts attached to that identity through one system, then it is possible. We also handle access to any system through that one solution. When we do that, we have a full picture of the identities and what kind of accounts and entitlements they have. Having the full picture and having the governance of the whole entity when it comes to access management allows security to be tight. Also, the controls that we have in place then, for example, joiner, mover, leaver, that helps in maintaining that zero trust principle.

In regards to the front end, the portal that is offered to our users needs improvement. There is room for improvement on that side, particularly in user experience. It is not as intuitive as I would like. If there is something to improve in One Identity Manager, it is the end-user experience. 

The database structure is quite complicated. I don't know if it can be improved or if it can. It will probably be a long journey. The most important thing is to think of our customers, and then the user interface is the part of the system that needs some improvement.

We can customize it, however, we need skilled resources to do so. There aren't as many skilled people in the market.

We launched it in October 2023. However, we started implementing it in 2021.

We rely on vendor support, and I would rate it as ten. We mainly receive support through their partner. 

Positive

We did quite a large comparison when we chose this system, and I see that there are systems in the market which offer the same functionality. However, there are also a lot of systems that are more restricted in the functionality they offer. There are maybe a couple as large and with as many capabilities as One Identity Manager. One Identity Manager is one of the top systems in terms of capability offering. That's the reason why we chose it for our company's purpose.

Our experience was complex, however, it was not due to the system. It was due to the wrongly chosen partner who didn't have the needed skills to implement it properly. 

It also depends on the scope of what needs or is wanted to be implemented as the minimum viable product. I wouldn't say that it's complex, however, maybe not easy either, so maybe something in between.

We implemented via a partner. They are the ones doing the customization if we do any currently. Our partner organized the training, however, the training was given by One Identity itself.

We have been reducing costs and saving several full-time equivalents by using automation.

I would rate the solution overall as eight out of ten based on the bad user interface.

On-premises

I use One Identity Manager for RBAC in my current project. We do provisioning and de-provisioning. After running certification campaigns, it automatically aggregates. I also onboard several applications in One Identity Manager. We also use it for audits, recordings, and activities like entitlements or policies with segregation of duties.

We use out-of-the-box connectors for SAP to automate account provisioning and de-provisioning and ensure the right access based on roles and responsibilities. For access governance, we also handle detecting and resolving conflicts. It reduces administrative overhead related to provisioning, de-provisioning, and role authorizations. When it comes to password synchronization with SAP systems, it ensures a smooth user experience. For disconnected SAP accounts, it helps to align the business processes and data flows. We have centralized dashboards providing a holistic view of identities, roles, and privileged access.

We also have Active Directory, Azure AD, and other enterprise applications. It serves as a single source of truth to ensure roles and privileges align with organizational policies. We can view policies and conflicts and also have custom rules.

It provides centralized administration through a single pane of glass. We can manage users' roles and entitlements, identity lifecycle management, and access review management. We can connect both on-premises and cloud systems, ensuring centralized provisioning. With automation for tasks like provisioning and password resets, we can efficiently manage a large user base in complex organization structures.

The analytics provide real-time insights into access, policy violations, and system health. We can also identify potential risks or inefficiencies.

One Identity Manager provides pre-built connectors, requiring minimal effort for standard user cases and workflows. All the common attributes are preconfigured. However, for customized and more complex use cases involving dynamic rules or unique compliance requirements, we need to use PowerShell scripts or APIs.

Business roles help map company structures for dynamic application provisioning. There are predefined templates for common business roles. It supports hierarchical roles and dynamic assignments. The drop-and-drag interface simplifies role creation and assignments and policy integrations. For example, when a new employee joins the finance department, the system dynamically assigns the required role containing the required access and privileges.

It has pre-built connectors for popular cloud apps such as Azure AD. It helps with policy enforcement for implementing RBAC and ABAC for governance across cloud and on-premises systems. We can automate access reviews and certifications for cloud applications ensuring ongoing compliance. We can also dynamically assign and revoke access to cloud apps based on the lifecycle events, such as onboarding, promotion, or termination. It supports monitoring user activities within the cloud apps, providing detailed audit logs and reports for compliance. It also helps with user access requests via self-service portals with automated approval workflows for cloud apps like Salesforce.

It helps with better license management and reduces over-provisioning. We can also track user licenses for cost-saving opportunities, audit reports for compliance, and vendor agreements. We can also create business rules to automatically revoke licenses with a role change. When it comes to the cloud application platform, it synchronizes license date and usage.

Its benefits were seen immediately after the deployment.

One Identity Manager offers identity-centric security, acting as a single source of truth by centralizing identity data for users, devices, and applications. It supports role-based access control and automatically assigns and reworks roles to minimize privileges. 

The solution integrates multi-factor authentication, enforcing stronger measures and requiring identity verification for accessing critical resources. It continuously monitors user behavior in real-time, triggering automated responses, and manages secure access for both on-premises and cloud applications using protocols such as SAML.

Additionally, it facilitates RBAC, provisioning and de-provisioning, certification campaigns, onboarding various applications, audits, and reporting with segregation of duties.

It can have a clearer navigation map of the user interface and user provisioning. The documentation lacks step-by-step details on common tasks like creating roles, running action reviews, and version control. Enhancements could also be made to feedback mechanisms. In development, understanding workflows and integrating ORDM skills with SAP could be improved.

I have been using One Identity Manager for approximately two to three years. I previously worked with an organization in India, where I utilized One Identity Manager. Currently, in my project in the US, I am working in the retail domain, and I am using One Identity Manager here as well.

I have worked a lot with SailPoint, so its deployment was easy for me. The deployment duration varies from project to project.

In terms of maintenance, it sometimes requires updates.

Pricing depends on licensing models, such as per-user licensing and feature-based pricing. Additional models like governance, provisioning, and reporting increase costs. Cloud or on-premises models follow different pricing approaches. On-premises might incur higher costs.

The cost also depends on integration systems like Active Directory, SAP, and custom connector requirements. Scalability influences costs, with larger organizations potentially benefiting from cloud setups. Cloud setups might be more cost-efficient compared to on-premises solutions.

I would rate One Identity Manager a seven out of ten.

My use case with One Identity Manager is both access management and identity management. The main tasks I perform involve solving issues when users receive roles but cannot access applications. During these situations, I debug within One Identity Manager to find and resolve the issues according to required actions. This is my daily use case.

The best features of One Identity Manager are the synchronization project, the mapping, onboarding using CSV, and the designer tool which allows us to write our own custom workflows. 

Once it's set up, One Identity Manager helps with provisioning and continues to work effectively. When anyone leaves the organization, they can be un-provisioned, and all access is removed instantly.

The UI of One Identity Manager is adequate, but there is room for improvement. They should publish more development documents to help users of One Identity Manager, as there are limited resources available.

I have been using One Identity Manager for one year.

The stability of One Identity Manager is good.

I don't have extensive experience comparing One Identity Manager with other market solutions, but I have heard about SailPoint, which has its own advantages and disadvantages. For large organizations, One Identity Manager is more scalable and secure.

We have 8,000 people.

The technical support for One Identity Manager rates a seven out of ten, which is average. When we raise tickets, they are directed to the respective team for response. We have two support connections from One Identity Manager itself and the partner, allowing direct communication. Issues are typically resolved within 24 hours through the ticket system.

Neutral

While I didn't work with SAP, I worked with Segregation of Duties (SoD) in One Identity Manager. It is flexible, and customization is neither particularly easy nor difficult. There are certain theories and concepts to keep in mind for successful customization.

I use the business roles in One Identity Manager, which is essentially the RBAC (role-based access system), and for the target system, we use the FRIC business role. Though I haven't used One Identity Manager to extend governance to cloud apps yet, I would if given the opportunity.

For production management, we have the packager tool, which allows setup of various environments including development, test, ultra-test, and production. We can export from lower environments and import into production using the packager tool.

I would rate One Identity Manager a nine out of ten.

Public Cloud

Microsoft Azure

I have worked on various European projects where we mainly use this tool as an Identity and Access Management (IAM) solution rather than its Privileged Access Management (PAM) features. Specifically, it serves as a central IAM tool for governance, compliance, and managing access requests across all the companies and projects I've been involved with. Most of these access requests were processed through Microsoft tools. They were onboarding applications and managing access to them via One Identity Manager through the portal it offers.

Every identity management tool has its unique features, and I believe that One Identity Manager performs quite well. From a developer's perspective, its interface provides excellent information. It includes appealing visuals and a user-friendly design, allowing you to clearly see how software accounts correlate or match with an identity. This gives you a comprehensive view of what an identity encompasses. You can establish specific rules to determine if access is fully managed by One Identity, which acts as the authoritative source for system access. Additionally, it offers a range of capabilities and customization options for managing access across various applications. Overall, I think One Identity Manager does a commendable job in this area.

One Identity Manager can be set up to have accounts synced from the SAP system and have them as orphaned in the system. The intended way is to link them to an identity, and when clicking the identity of the employee, you will see underneath the AD accounts, other application accounts, and different SAP accounts. For each SAP system, you can have specific rules. It has this capability out of the box, SOD rules, different roles, and bundles.

When users request access for a SAP system and do not have an account already, an account is created based on specific criteria that can be defined. From an end user point of view, they go to the portal and request access. If they do not have an account, they get one. If they already have an account, the access will be added and provisioned properly. The account will be connected to their identity with all the access in the downstream application in SAP. It requires a good architect to think through all the different cases for the business. Many connectors must be built because some companies use upwards of 200 SAP systems.

One Identity Manager offers governance for cloud apps through its cloud framework. The logic remains similar to on-premise applications: build a connector, import data, create business roles, enable requests, and implement approvals. The governance framework is particularly strong with application approval workflows and recertification processes.

The solution provides technical options to distinguish between different types of accounts per system. For AD, different rules can identify and manage various account types differently. It offers strong reporting capabilities and can detect policy violations.

For application management, One Identity Manager has a built-in risk framework that helps businesses with approvals and recertifications. Full application management without IT involvement requires building custom frameworks.

It helps to streamline application access decisions, application compliance, and application auditing for customers. When auditors come in, they require that access be managed using an IGA tool. It's quite easy to set up; you just need to build a connector to facilitate this access. In addition, a business analyst can identify the business rules needed. You publish the business rules and set up an approval process—usually requiring two approvals if it's related to the application. Once the business rule is published, a user can request access through the portal, and someone will approve it—standard procedure. You can also run certifications and set up different approval processes for employees who need access for one year or for those who are moving (like shifts). Certification can involve various terms, including access reviews or access refusals. It's a straightforward process. It's strong and reliable. I've seen hundreds of applications successfully managed and compliant because of this process, which includes approval requests and access refusals. You simply onboard the application, and you're set—it all becomes remote for you. All the audit trails are available. You can see who approved what, why they approved it, when the access was granted, and when it was revoked, among other details. It truly helps to maintain compliance.

The solution offers some out-of-the-box capability to manage profiles, but I have not worked with other aspects. In the companies where I was working, they were not using this from a SAP point of view.

One of the most significant advantages is its strong security around identity management when compared to other tools; it's quite robust. However, it does come with a high learning curve, making it difficult to implement and operate without a dedicated IAM team. You need people with substantial experience—likely several years—in order to navigate the complexities effectively. It's not something you can easily outsource entirely to a consultancy. In the past couple of years, they released a new version, Version 9, building on the previous version 8.02. This new version introduced a revamped portal where end users can request access. The previous version had a built-in portal that was quite complex to configure. In the new Version 9, they developed a new portal based on Angular, which offers many capabilities. If someone knows how to utilize it and learn its features, they can make API calls to interact with other systems. Some consulting firms are already developing custom frameworks around this to leverage these capabilities. 

This new portal is where end users go to request access. It provides good out-of-the-box functionalities, allowing users to request access to various applications, and managers can approve these requests. In addition to the default functionalities, the use of APIs is enabled through the portal. However, the general market lacks expertise regarding this tool; only a few companies are actively investing in understanding how it works and offering their services based on that knowledge. Many businesses are migrating to this new portal as the older versions are being phased out of support and are eager to learn how to maximize its capabilities.

Overall, One Identity Manager is a robust tool designed for large enterprises and is still an on-premise solution.

One Identity Manager does not offer much in terms of delivering SAP-specialized workflows and business logic. Custom workflows can be built, but it is limited in that regard. Comparing it to SailPoint, One Identity Manager is less advanced around SAP, particularly regarding the flexibility to build custom flows. While customizations are possible through processes in One Identity Manager where you can build PowerShell code or make API calls, this is not the intended way and requires heavy customization that might become unmanageable.

They could offer more out-of-the-box connectors so that custom PowerShell connectors would not need to be built. 

The support could be improved. They could add more AI to help with role mining. The new portal documentation needs improvement as some partners are more advanced in understanding how the Angular portal works than One Identity itself.

I'm not currently working with it. I stopped working with it three to four months ago. Before that, I worked with it for about three years and seven months.

Regarding support, they prioritize resolving escalated issues. However, their response can be slow. Whenever I open a ticket, the reply often includes a request for the specifications of the server I am using. For instance, they frequently ask, “How many gigabytes of RAM are you running on the server?” If I'm not using the maximum recommended specifications, they immediately suggest that there is a problem. They don’t always consider that the issue may not be related to performance at all.

I haven’t had the best experience with them, but I understand that they do eventually respond. However, there have been instances where we had tickets open for months without any resolution. Sometimes, they would either go quiet or eventually respond and help us find a solution. I’ve faced many similar situations across various projects.

At the end of the day, I’m not a customer, so I’m not too concerned about the experience. However, the application owners of One Identity in these companies have expressed dissatisfaction with the responses they received. They wanted more immediate assistance and access to more skilled resources. That's understandable. Overall, I would rate the experience as a six out of ten.

Neutral

It depends on the situation. If you're starting from scratch, in a greenfield scenario, where you have nothing set up and don't have an IGA tool, then you can begin by establishing an Active Directory. You start with the basics: take employee data and import it into One Identity Manager to create Active Directory accounts for each employee. This setup can typically be completed in about three to four months. It’s not overly complicated. However, it’s important to note that most businesses have complex processes that don’t easily translate into the tool. To effectively monitor applications and manage these processes, you really need technical expertise.

For a large enterprise that has the capability to support an on-premise solution and is willing to find reliable partners to assist with this new portal, along with the technical know-how to match the tool's capabilities, it can be a highly effective solution. This tool offers a wide range of features out of the box. However, the biggest challenge is the steep learning curve; it's essential to have experts with many years of experience and strong technical expertise to maximize the tool's potential. This solution is not suitable for small companies or those seeking a quick implementation. It requires a significant investment initially, but it pays off in the long run due to its extensive features compared to other tools.

I don't have information on the costs associated with the tools or the specific deals they offer. However, I do know that it's challenging to find technical expertise, and these professionals often command high salaries.

In addition to purchasing the tool and its licenses, it's important to account for the need for a dedicated team, especially if you're a large enterprise. There are significant costs involved in maintaining the solution and ensuring it operates effectively. Unfortunately, I don't have details on the licensing fees or per-user costs, among other specifics.

My recommendation is that you really need to understand the realm of identity and access management. It's important to consider the alternatives available, and I believe that for some companies, One Identity is the best solution out there. For specific enterprises, it could indeed be the ideal choice, but for others, it may not be suitable. For instance, a small business with fewer than 25,000 employees, which may not prioritize governance and compliance, might find One Identity unnecessary. It really depends on the landscape of the company using the tool—what their requirements are, what applications they have, and what they're aiming to achieve.

One Identity is quite beneficial for finance-related entities that have strict compliance and security needs. However, One Identity should invest more in AI and enhance their documentation on the new portal. This improvement would help customers and developers better understand what they are building.

The business roles functionality is a very standard part of the access model. Typically, you would start with an application. You gather all the users and their entitlements, which include the accesses they have. Then, you need someone, such as a business analyst or consultant, to help identify bundles or groups of this low-level access. Instead of managing each access individually, you can group them together and create a role for each application, or possibly a combination of different applications. This approach greatly simplifies management. A user doesn’t need to know all the low-level accesses required in a system or across different systems. By creating bundles of access with accompanying business rules, it becomes easier to understand. For example, if I am a DevOps member working with AWS, there’s already a pre-defined access bundle for me. My colleague can tell me to request this specific access, which provides everything I need. Alternatively, access can be automatically assigned based on department—whenever someone joins a specific department, they receive all associated accesses. 

Moreover, you can build dynamic rules around these business rules. While technically speaking, in the One Identity Manager, an application role is part of a business role. However, it’s important to note that you can have a business role defined by specific criteria. Anyone who meets this criterion receives the business role, which is beneficial for management. For instance, if you want to grant access to new hires for applications like Teams, all relevant accesses can be bundled into a business role. If someone leaves the company, their status would change to inactive, and they would lose their access. This streamlines the access lifecycle management process.

From an end-user perspective, it simplifies requests for specific applications or accesses per department. Depending on your chosen architecture and access model, this organization is crucial. However, a key requirement is to have a business analyst involved; otherwise, you risk ending up with scattered entitlements and groups that lack clarity regarding their business association. Finally, don't forget to set up an approval process.

From an end-user perspective, with the new Angular portal in version 9 and upwards, it has improved significantly. However, not all companies have migrated because they have custom logic in the old portal that needs to be translated to the new Angular portal. The new portal is better as it is easy to navigate with straightforward navigation bars. Previously, sometimes custom queries behind the portal really slowed down end-user performance, with users reporting waiting 15-20 minutes for a page to load, especially during approvals or attestations. This was particularly frustrating for users needing high-level managerial approvals for various tasks. In the new portal, you can customize tasks to address some of these performance issues, making it a more efficient experience.

Overall, I would rate it a seven out of ten.

On-premises