One Identity Manager Reviews

My use case with One Identity Manager is both access management and identity management. The main tasks I perform involve solving issues when users receive roles but cannot access applications. During these situations, I debug within One Identity Manager to find and resolve the issues according to required actions. This is my daily use case.

The best features of One Identity Manager are the synchronization project, the mapping, onboarding using CSV, and the designer tool which allows us to write our own custom workflows. 

Once it's set up, One Identity Manager helps with provisioning and continues to work effectively. When anyone leaves the organization, they can be un-provisioned, and all access is removed instantly.

The UI of One Identity Manager is adequate, but there is room for improvement. They should publish more development documents to help users of One Identity Manager, as there are limited resources available.

I have been using One Identity Manager for one year.

The stability of One Identity Manager is good.

I don't have extensive experience comparing One Identity Manager with other market solutions, but I have heard about SailPoint, which has its own advantages and disadvantages. For large organizations, One Identity Manager is more scalable and secure.

We have 8,000 people.

The technical support for One Identity Manager rates a seven out of ten, which is average. When we raise tickets, they are directed to the respective team for response. We have two support connections from One Identity Manager itself and the partner, allowing direct communication. Issues are typically resolved within 24 hours through the ticket system.

Neutral

While I didn't work with SAP, I worked with Segregation of Duties (SoD) in One Identity Manager. It is flexible, and customization is neither particularly easy nor difficult. There are certain theories and concepts to keep in mind for successful customization.

I use the business roles in One Identity Manager, which is essentially the RBAC (role-based access system), and for the target system, we use the FRIC business role. Though I haven't used One Identity Manager to extend governance to cloud apps yet, I would if given the opportunity.

For production management, we have the packager tool, which allows setup of various environments including development, test, ultra-test, and production. We can export from lower environments and import into production using the packager tool.

I would rate One Identity Manager a nine out of ten.

I have worked on various European projects where we mainly use this tool as an Identity and Access Management (IAM) solution rather than its Privileged Access Management (PAM) features. Specifically, it serves as a central IAM tool for governance, compliance, and managing access requests across all the companies and projects I've been involved with. Most of these access requests were processed through Microsoft tools. They were onboarding applications and managing access to them via One Identity Manager through the portal it offers.

Every identity management tool has its unique features, and I believe that One Identity Manager performs quite well. From a developer's perspective, its interface provides excellent information. It includes appealing visuals and a user-friendly design, allowing you to clearly see how software accounts correlate or match with an identity. This gives you a comprehensive view of what an identity encompasses. You can establish specific rules to determine if access is fully managed by One Identity, which acts as the authoritative source for system access. Additionally, it offers a range of capabilities and customization options for managing access across various applications. Overall, I think One Identity Manager does a commendable job in this area.

One Identity Manager can be set up to have accounts synced from the SAP system and have them as orphaned in the system. The intended way is to link them to an identity, and when clicking the identity of the employee, you will see underneath the AD accounts, other application accounts, and different SAP accounts. For each SAP system, you can have specific rules. It has this capability out of the box, SOD rules, different roles, and bundles.

When users request access for a SAP system and do not have an account already, an account is created based on specific criteria that can be defined. From an end user point of view, they go to the portal and request access. If they do not have an account, they get one. If they already have an account, the access will be added and provisioned properly. The account will be connected to their identity with all the access in the downstream application in SAP. It requires a good architect to think through all the different cases for the business. Many connectors must be built because some companies use upwards of 200 SAP systems.

One Identity Manager offers governance for cloud apps through its cloud framework. The logic remains similar to on-premise applications: build a connector, import data, create business roles, enable requests, and implement approvals. The governance framework is particularly strong with application approval workflows and recertification processes.

The solution provides technical options to distinguish between different types of accounts per system. For AD, different rules can identify and manage various account types differently. It offers strong reporting capabilities and can detect policy violations.

For application management, One Identity Manager has a built-in risk framework that helps businesses with approvals and recertifications. Full application management without IT involvement requires building custom frameworks.

It helps to streamline application access decisions, application compliance, and application auditing for customers. When auditors come in, they require that access be managed using an IGA tool. It's quite easy to set up; you just need to build a connector to facilitate this access. In addition, a business analyst can identify the business rules needed. You publish the business rules and set up an approval process—usually requiring two approvals if it's related to the application. Once the business rule is published, a user can request access through the portal, and someone will approve it—standard procedure. You can also run certifications and set up different approval processes for employees who need access for one year or for those who are moving (like shifts). Certification can involve various terms, including access reviews or access refusals. It's a straightforward process. It's strong and reliable. I've seen hundreds of applications successfully managed and compliant because of this process, which includes approval requests and access refusals. You simply onboard the application, and you're set—it all becomes remote for you. All the audit trails are available. You can see who approved what, why they approved it, when the access was granted, and when it was revoked, among other details. It truly helps to maintain compliance.

The solution offers some out-of-the-box capability to manage profiles, but I have not worked with other aspects. In the companies where I was working, they were not using this from a SAP point of view.

One of the most significant advantages is its strong security around identity management when compared to other tools; it's quite robust. However, it does come with a high learning curve, making it difficult to implement and operate without a dedicated IAM team. You need people with substantial experience—likely several years—in order to navigate the complexities effectively. It's not something you can easily outsource entirely to a consultancy. In the past couple of years, they released a new version, Version 9, building on the previous version 8.02. This new version introduced a revamped portal where end users can request access. The previous version had a built-in portal that was quite complex to configure. In the new Version 9, they developed a new portal based on Angular, which offers many capabilities. If someone knows how to utilize it and learn its features, they can make API calls to interact with other systems. Some consulting firms are already developing custom frameworks around this to leverage these capabilities. 

This new portal is where end users go to request access. It provides good out-of-the-box functionalities, allowing users to request access to various applications, and managers can approve these requests. In addition to the default functionalities, the use of APIs is enabled through the portal. However, the general market lacks expertise regarding this tool; only a few companies are actively investing in understanding how it works and offering their services based on that knowledge. Many businesses are migrating to this new portal as the older versions are being phased out of support and are eager to learn how to maximize its capabilities.

Overall, One Identity Manager is a robust tool designed for large enterprises and is still an on-premise solution.

One Identity Manager does not offer much in terms of delivering SAP-specialized workflows and business logic. Custom workflows can be built, but it is limited in that regard. Comparing it to SailPoint, One Identity Manager is less advanced around SAP, particularly regarding the flexibility to build custom flows. While customizations are possible through processes in One Identity Manager where you can build PowerShell code or make API calls, this is not the intended way and requires heavy customization that might become unmanageable.

They could offer more out-of-the-box connectors so that custom PowerShell connectors would not need to be built. 

The support could be improved. They could add more AI to help with role mining. The new portal documentation needs improvement as some partners are more advanced in understanding how the Angular portal works than One Identity itself.

I'm not currently working with it. I stopped working with it three to four months ago. Before that, I worked with it for about three years and seven months.

Regarding support, they prioritize resolving escalated issues. However, their response can be slow. Whenever I open a ticket, the reply often includes a request for the specifications of the server I am using. For instance, they frequently ask, “How many gigabytes of RAM are you running on the server?” If I'm not using the maximum recommended specifications, they immediately suggest that there is a problem. They don’t always consider that the issue may not be related to performance at all.

I haven’t had the best experience with them, but I understand that they do eventually respond. However, there have been instances where we had tickets open for months without any resolution. Sometimes, they would either go quiet or eventually respond and help us find a solution. I’ve faced many similar situations across various projects.

At the end of the day, I’m not a customer, so I’m not too concerned about the experience. However, the application owners of One Identity in these companies have expressed dissatisfaction with the responses they received. They wanted more immediate assistance and access to more skilled resources. That's understandable. Overall, I would rate the experience as a six out of ten.

Neutral

It depends on the situation. If you're starting from scratch, in a greenfield scenario, where you have nothing set up and don't have an IGA tool, then you can begin by establishing an Active Directory. You start with the basics: take employee data and import it into One Identity Manager to create Active Directory accounts for each employee. This setup can typically be completed in about three to four months. It’s not overly complicated. However, it’s important to note that most businesses have complex processes that don’t easily translate into the tool. To effectively monitor applications and manage these processes, you really need technical expertise.

For a large enterprise that has the capability to support an on-premise solution and is willing to find reliable partners to assist with this new portal, along with the technical know-how to match the tool's capabilities, it can be a highly effective solution. This tool offers a wide range of features out of the box. However, the biggest challenge is the steep learning curve; it's essential to have experts with many years of experience and strong technical expertise to maximize the tool's potential. This solution is not suitable for small companies or those seeking a quick implementation. It requires a significant investment initially, but it pays off in the long run due to its extensive features compared to other tools.

I don't have information on the costs associated with the tools or the specific deals they offer. However, I do know that it's challenging to find technical expertise, and these professionals often command high salaries.

In addition to purchasing the tool and its licenses, it's important to account for the need for a dedicated team, especially if you're a large enterprise. There are significant costs involved in maintaining the solution and ensuring it operates effectively. Unfortunately, I don't have details on the licensing fees or per-user costs, among other specifics.

My recommendation is that you really need to understand the realm of identity and access management. It's important to consider the alternatives available, and I believe that for some companies, One Identity is the best solution out there. For specific enterprises, it could indeed be the ideal choice, but for others, it may not be suitable. For instance, a small business with fewer than 25,000 employees, which may not prioritize governance and compliance, might find One Identity unnecessary. It really depends on the landscape of the company using the tool—what their requirements are, what applications they have, and what they're aiming to achieve.

One Identity is quite beneficial for finance-related entities that have strict compliance and security needs. However, One Identity should invest more in AI and enhance their documentation on the new portal. This improvement would help customers and developers better understand what they are building.

The business roles functionality is a very standard part of the access model. Typically, you would start with an application. You gather all the users and their entitlements, which include the accesses they have. Then, you need someone, such as a business analyst or consultant, to help identify bundles or groups of this low-level access. Instead of managing each access individually, you can group them together and create a role for each application, or possibly a combination of different applications. This approach greatly simplifies management. A user doesn’t need to know all the low-level accesses required in a system or across different systems. By creating bundles of access with accompanying business rules, it becomes easier to understand. For example, if I am a DevOps member working with AWS, there’s already a pre-defined access bundle for me. My colleague can tell me to request this specific access, which provides everything I need. Alternatively, access can be automatically assigned based on department—whenever someone joins a specific department, they receive all associated accesses. 

Moreover, you can build dynamic rules around these business rules. While technically speaking, in the One Identity Manager, an application role is part of a business role. However, it’s important to note that you can have a business role defined by specific criteria. Anyone who meets this criterion receives the business role, which is beneficial for management. For instance, if you want to grant access to new hires for applications like Teams, all relevant accesses can be bundled into a business role. If someone leaves the company, their status would change to inactive, and they would lose their access. This streamlines the access lifecycle management process.

From an end-user perspective, it simplifies requests for specific applications or accesses per department. Depending on your chosen architecture and access model, this organization is crucial. However, a key requirement is to have a business analyst involved; otherwise, you risk ending up with scattered entitlements and groups that lack clarity regarding their business association. Finally, don't forget to set up an approval process.

From an end-user perspective, with the new Angular portal in version 9 and upwards, it has improved significantly. However, not all companies have migrated because they have custom logic in the old portal that needs to be translated to the new Angular portal. The new portal is better as it is easy to navigate with straightforward navigation bars. Previously, sometimes custom queries behind the portal really slowed down end-user performance, with users reporting waiting 15-20 minutes for a page to load, especially during approvals or attestations. This was particularly frustrating for users needing high-level managerial approvals for various tasks. In the new portal, you can customize tasks to address some of these performance issues, making it a more efficient experience.

Overall, I would rate it a seven out of ten.

We use One Identity Manager as our primary solution for identity and access management. We use it for multiple functions including identity lifecycle, access management, provisioning, segregation of duties (SODs), and attestations. It is being used for the core IM functions.

We are a large insurance company based in Germany. We are compliance-driven. We have to fulfill BaFin requirements. BaFin is a governmental body that oversees banks and insurance. They have a big list of requirements that each financial institution needs to fulfill to stay on the market as a bank or as an insurance provider. One Identity Manager helps us to meet those requirements.

We differentiate between two types of accounts, personal and non-personal accounts. Personal accounts are accounts or usernames assigned to people, and then we have non-personal accounts, which are technical or service accounts used by software or machines. One of the BaFin requirements is that we have control of each and every account within the system. The sync editor is able to read each and every account into IAM. It discovers every account if you have given it the right to see everything in the SAP or any other system. The tool fulfills the base needs so that we can traverse every account available in the system and then match it to digital identities there, meaning that we get a linkage between each account and each digital identity that we get from the HR system. So, we do not have orphaned accounts or the ones that we are not able to match. It is up to each customer to utilize this. They can develop their own processes to handle this. They need to have their own processes to connect them, identify them, or report on them. There is not much that the vendor does there. It discovers them, and that is it. I am satisfied with what it offers. It fulfills our needs.

When it comes to core IGA, the functionality that we use is the life cycle of accounts. We use the life cycle of membership of these accounts into SAP roles, the membership of these SAP users, and the membership life cycle of SAP users in the SAP structural profile. These three are what we cover. There are also SAP groups and SAP profiles, but we do not actively manage them. From the access control structures, we use only this subset. That is all that we need. It is currently sufficient for our needs.

We use several objects to represent company structures. We use the department object and the location object, and we also use business roles pretty extensively. We have thousands of business roles in the system. If I traverse the table org, which is the technical name of the table, I will find thousands of entries there.

Compliance and automation are two reasons for implementing an IM solution. Automation helps save money. For compliance, even if we do not like it, we must install such a solution because we have to fulfill law obligations. We work actively on that and have a big team covering it. It will keep us busy over the next few years. The second one is automation. We have automated the whole onboarding process of employees within this company. Instead of having 50 different administrators, we have less than 10 administrators. It saves us money. We definitely save lots of effort for administrators of different systems. We save people and resources by automating and not having several dozen administrators for different systems. That saves us lots of money.

Another advantage is that it saves us time. We can onboard the person within a day in our company. As soon as the HR types in a new employee there and pushes it to us, we can provision the employee to all necessary systems roughly within a day. Without such a solution, it will probably take weeks.

It helps streamline application access governance. When you have different applications, such as Active Directory-based ones, SAP-based ones, and cloud-based ones, they all have different GUIs. They all have different approval processes. Once you connect them to a solution like One Identity, you have to order all of their entitlements through the IM WebShop, which is a web interface. There is a very homogeneous look and feel to how you order access to these applications. Otherwise, from the administration point of view as well as from the approval point of view, it is a very heterogeneous experience. Once you integrate applications with One Identity Manager, you get the same experience for your AD-based and SAP-based tools. Other competing products like SailPoint and Verix also provide a uniform experience.

It also helps with application auditing. That is one of the core features of the tool. We use it to audit the access to different applications and impose governance on these applications. The application life cycle is also one of the core features that we use. There is one package called the application onboarding package (AOB). We developed our own mechanism there about 15 years ago, so the tool does offer steps, and we utilize it.

I like the provisioning feature of One Identity Manager. It is very powerful and flexible. It works at a very high level, but it can also be tailored as per needs. They have something called Sync Editor. I personally like that one because I have a developer background. Currently, I have more responsibility within the company for this feature. I am one of the six subject matter experts (SMEs). My area is the reconciliation part. 

Compliance with BaFin requirements is very important for us. If we do not fulfill them, our license can be retracted. If we do not fulfill these requirements, it is not good for the company. We use the identity life cycle. We use provisioning extensively. We use attestations, recertifications, and SODs. We need all these equally to fulfill the BaFin requirements.

In terms of user experience or intuitiveness, it is in the middle. I personally find it good. Based on the complexity, the vendor seems to have done a good job of providing a web shop kind of experience, similar to eBay or Amazon. You order something in the shopping cart and submit it. Another one approves it and it gets provisioned. It is in the middle because I have seen better and more lightweight interfaces. They are now introducing the Angular portal. There is a new design. It is better, but certain things are still a little bit hidden. It is not yet ideal. Things like attestations or segregation of duties are not that intuitive. People take time to learn. We need to train them on what they need to do. When we generate attestations, the guy who needs to attest does not intuitively know what to do. When it comes to SODs, it is even harder. People are unsure what exactly things mean there. We need to train these people. For core processes like ordering entitlements, they know what to do without any training or reading materials from us. For example, you order a group, somebody approves it, and then you get it provisioned. For such simple scenarios, we do not need to support them, but for the other cases, such as attestations and SODs, we need to write articles on the Internet. We need to do training. We need to actively support them and hold their hands.

The biggest complaint we get from the end users is the performance. When they click or submit something in the shopping cart, all the compliance checks for SOD rules are run. Sometimes, it takes two to three minutes for something to be submitted. It is slow. It has a bit of a bad reputation within the company because it is a slow product. That is the biggest drawback in terms of user experience. Performance has been a problem in the last 10 to 15 years. It is sometimes good and sometimes bad. Every now and there, you hear that performance is an issue.

The user interface could be more streamlined. The overlapping functionality among tools like the Sync Editor, Designer, Object Browser, and Manager needs better delineation. Currently, you have Sync Editor for synchronization. You have the Designer for scripts, procedures, and SQL development, and then you have the Object Browser for raw or low-level data adjustment there. You also have the Manager which is a user or operations management tool. These four tools overlap in their functionality. For example, you can administer schedules in Manager, Object Browser, and Designer. I see a little bit of overlapping there. You also have the Transporter that transports the code. If you open the binaries folder for tool installation, you will see 20,30, or even 40 files there. There are so many small tools for different things. They might have grown over time. They should differentiate a little bit between operations, development teams, and test teams. For operations, they have done a good job of centralizing things in the Manager tool, but for developers and testers, there is a little bit of overlap between Designer and Object Browser. There is one other tool called Web Designer. That one will become obsolete soon with Angular. Currently, some things can be customized by the operations teams in prod and some of the things need to come from the developers. The borderline is not very clear. There are gray areas. They might have fixed these things in the Angular portal.

Another thing that I do not like is that they are mixing useful data and code data in the same data model. Other tools such as SailPoint or Verix Identity are stronger in terms of the separation of useful data and code data, although they have worse data models than One Identity. There should be a cleaner separation between the actual usage data and code data.

I have been using One Identity Manager since 2009, although back then it was known as Active Entry. I have been using it actively since 2011.

I would rate it a five out of ten for stability. As with all other products, it has bugs. It is buggy. When a new version comes out, there are issues with it. It then takes them some months or patches to make the version stable. If you take 8.0 or 9.0, those versions are usually buggy. I have spent 15 years with this product. There were always issues after they made some major release. It then gets stabilized. The product is buggy, but they work on it. After six to twelve months, they sort out everything, and then you get a more robust version.

It has its advantages and disadvantages, but it is definitely scalable.

It is a good tool for enterprise-level management. It fulfills its role. In the Gartner Magic Quadrant, this tool has gone from the lower left corner to the upper right corner in the last ten or so years. It is definitely an enterprise-level tool. It is powerful, but it is slow. As soon as the company becomes very big and different scenarios need to be managed, it tends to be slow. Two years ago, there was a conference in Hagen, Germany. The vendor asked everyone about their thoughts about the product. They asked us the good or bad things about the product, and every second customer said that they had performance issues with the product. The product is very powerful. It is an enterprise-level software, but it is slow. As soon as you have a larger number of users or a larger number of systems connected to it or you have heavyweight scenarios, it becomes slow. Of course, it depends on how each customer customizes it and implements the features in it, but every second customer complained about the performance.

We have about 30,000 users. We have only one centralized instance for the whole company. We have four environments, and there are several different teams here. We have testing, development, and operations teams. We also have the requirements scoping team where the SMEs are. It has grown pretty big. In the beginning, there were just two to four of us doing everything, but now there are quite a lot of people. Different departments are doing different aspects of it.

Their technical support is pretty good. We use standard customer support, which allows us to open tickets and receive fixes for bugs. While it is not state-of-the-art, I would rate their service as being in the better half, providing positive support experiences.

Neutral

I have worked with two other competing products. One is SailPoint, and another one is DirX Identity. All of these products have their advantages and disadvantages. There is no perfect product, but I find One Identity Manager to be the most powerful and flexible of the three.

I have a developer and IM architect background. When it comes to customization, One Identity Manager is very powerful and very flexible. It is not very easy, but it is definitely better than DirX Identity or SailPoint. The amount of energy that you need to invest is less compared to the other two products.

We have a separate solution for PAM or privileged account management, and that is CyberArk. I know that One Identity has its own safeguard solution, but I am not sure if that one is used in our company. Another team might be using it but not us. We are a big company. I know that this was one of the solutions that they were evaluating, but in the end, they decided to use CyberArk. 

Back in 2010, we had six months of evaluation. We did evaluate Tivoli and other products. We had a prototype. It took about six months before we went to production. We first started only with Active Directory and SAP, and then we kept growing it with additional target systems and additional features. It is comparable to other products in terms of ease of deployment. It is not simple. All these products are complex. It takes time to understand what they do. As compared to others, there is a middle complexity level to bring it live. Overall, it took about six to nine months.

We have the operations team to maintain it. There are several people in that team.

During the evaluation phase, we considered other solutions like Tivoli.

I would definitely recommend this solution. I have influenced two companies in the direction of adopting it in Germany. They were evaluating this, which takes lots of money and time. One company even booked me and a colleague of mine and asked which one to go for between this solution and SailPoint. I definitely recommend this one.

I would rate One Identity Manager an eight out of ten.

One Identity Manager's primary use is managing employee identities, encompassing the entire lifecycle from onboarding and role changes to offboarding, including lifecycle management, certification, segregation of duties, and identity retirement.

One Identity Manager offers a comprehensive platform for enterprise-level administration and governance of user data and privileged accounts. The platform includes features like Safeguard for securing high-privileged accounts and a unified login for access management. Essentially, it provides a complete suite of identity management, privileged access management, and access management within a single platform.

The user interface provides a comprehensive graphical view of identities and entitlements across various systems, offering a clear and accessible overview of user accounts and permissions. This allows users to quickly and easily view their accounts and entitlements in each system, enhancing the overall user experience.

One Identity Manager is easily customizable to our needs due to its built-in Visual Basic editor, accessible through Visual One. This allows for customization by utilizing their comprehensive API documentation to build or modify functions as required. The integrated editor within the product enables us to readily access and write custom logic, streamlining the customization process.

It utilizes business roles, which are mapped to technical roles and then further mapped to entitlements. This structure streamlines access requests for end-users, as a single business role can encompass multiple technical roles, granting access to multiple systems upon approval. The system also allows for customized approval workflows with multiple levels of authorization. Additionally, a cart feature enables users to select and apply for various business or technical roles, combining them as needed before submitting their request.

One Identity Manager employs a governance framework that utilizes a certification process to verify identities based on client-defined intervals, typically every six to eight months, aligning with their audit requirements. This governance feature is seamlessly integrated into the platform, eliminating the need for separate installations. Furthermore, the system allows for the customization of attestation processes, including certification campaigns, email templates, and recipient lists, providing extensive flexibility. This functionality is crucial for ensuring data security and regulatory compliance within cloud applications, as granting access to unauthorized individuals can lead to severe financial and legal repercussions. By managing access privileges effectively, organizations can mitigate risks and maintain control over sensitive information.

One Identity Manager can help to minimize gaps in governance coverage among tests, dev, and product servers.

It establishes a privileged governance framework, mitigating the security risks associated with highly privileged user accounts. These accounts, if compromised or accessed without authorization, can cause extensive damage to servers and applications, potentially jeopardizing the entire company. By implementing One Identity Manager, organizations can effectively address these vulnerabilities and enhance overall security.

One Identity Manager streamlines application access decisions for compliance, especially in large companies with hundreds of applications. Without a centralized solution like One Identity Manager, managing access and ensuring compliance becomes nearly impossible. This tool provides a single point of reference for application access, offering a complete audit trail of who has access to what, when it was granted, and when it was revoked. This simplifies application management across the enterprise and ensures comprehensive auditing capabilities.

It empowers application owners to align with business managers in making application governance decisions independent of IT, thereby reducing operational costs by around 25 percent. The platform offers various connectors to onboard applications as endpoints, enabling automated provisioning, creation, deletion, and access control for user accounts. This automation minimizes manual intervention, streamlines operations, and ultimately contributes to cost reduction.

One Identity Manager helps achieve an identity-centric Zero Trust model. Without a proper approval process, granting access based on simple email requests compromises the Zero Trust model and introduces significant security risks. The Zero Trust model mitigates these risks by requiring multiple approval levels for any access, emphasizing its importance in maintaining a secure environment.

One Identity Manager is a comprehensive identity management system that encompasses employee identity lifecycle management, certification, and segregation of duties. It ensures high security through multiple approval processes, preventing unauthorized access and enhancing compliance by providing time-based access for privileged accounts with proper audit trails. Additionally, it streamlines application access decisions and extends governance to cloud applications.

The support model has room for improvement, especially when compared to competitors like Omada and SailPoint, which offer a more extensive global presence and support network.

I have been working with One Identity Manager for six months.

One Identity Manager is stable.

One Identity Manager is scalable.

I believe the support model could be better.

Neutral

I worked on platforms like Broadcom and IGA before using One Identity Manager. I did not switch on my own; it depends on what the client uses.

One Identity Manager offers superior reporting capabilities compared to dot com IGA. While dot com IGA requires significant time, financial investment, and server resources to configure reporting, One Identity Manager provides an intuitive and user-friendly interface that allows for easy report generation directly from the GUI. This streamlined approach simplifies the reporting process and enhances efficiency.

The return on investment in compliance is clear because inadequate identity management can result in substantial financial penalties for data breaches.

Investing in One Identity Manager is necessary for regulatory compliance. Although it might not directly bring in business, it prevents issues like tool compliance. The pricing is reasonable compared to other solutions.

I would rate One Identity Manager nine out of ten.

My customer uses their custom HR system. On the backend, data is sent from the NS SQL server to One Identity Manager.

If you want to save on infrastructure costs without extensive customization, opt for the SaaS model. If you require significant customization, consider the on-premise model of One Identity Manager.

We use One Identity Manager for user lifecycle management and access management.

Since I am placed in the business organization, I see smooth processes for joiner, mover, and leaver, and a compliance perspective. We are getting cost savings by automating system integrations. Previously, people handled access rights manually for each system. Now, after integrating about half of our systems, we are saving approximately three FTEs, and expect it to double. Line managers can see team members' access rights and do attestations in one view. We have integrated requesting of access rights also to external systems via the web portal to remind leaders about access rights management also for leavers and movers. Automation of these processes improves security and compliance by meeting auditor requirements.

There are functionalities we needed to build ourselves, such as cleaning the direct entitlement assignments if inderect exists. The user interface can sometimes be a bit confusing for end users, for example during attestations, as completed tasks simply disappear without indicating that there are no pending requests left any more and therefore end-user is unsure if they have completed all theirs tasks.

We have had it in production since autumn 2023, approximately one and a half years.

I rate stability around nine out of ten.

We have around 8,200 employees using the system to request access rights. Scalability is not an issue, so I rate it a nine out of ten.

I rate customer support at eight out of ten. The response time has room for improvement as it can take quite a long time in some cases.

Positive

Previously, we used an old Microsoft MIM solution. We transitioned to One Identity Manager for improved functionalities like handling mover situations and integrating external systems for better security compliance.

We implemented it through Tietoevry, a partner. Initially, we had an unsatisfactory experience with a different partner, which delayed our project by a year. After switching to Tietoevry, the project improved significantly.

Annually, we have saved three full-time employees as a result of deploying One Identity Manager. We anticipate doubling this saving once all current integrations are completed and even more when we add Segregation of Duties rules.

I would recommend One Identity Manager due to the improved security and compliance it offers. We have achieved considerable productivity gains through automated processes. I rate One Identity Manager a nine out of ten.

We are using One Identity Manager to change our previous old identity access management platform. Currently, the separation of duties is the most important aspect.

It delivers SAP-specialized workflows and business logic. It meets the needs of the most common use cases. It also supports customization for special cases.

Its biggest benefit as well as its biggest problem is that it is highly customizable. Usually, customers do too much customization, and then it is not great performance-wise.

We started to see how to optimize or support audit processes with One Identity Manager about a year ago. It has been helpful there. It saved quite a lot of time.

It did not help us to achieve an identity-centric Zero Trust model, but that is because we need more push from the business or management.

It helps automate processes. Our company uses One Identity as an enabler, which would be nice to change. It helps us save on license costs through effective license management.

It is highly customizable, a feature that influenced our company's decision. We can easily customize it.

I find it user-friendly. Once you have some experience, it demonstrates best practices and guides you on the correct way to use the tool. 

Default connectors work fine, but certain connectors, such as SCIM to SAP Cloud Identity Services connector, have quite a few bugs. They are not so great.

Their support can be better. They can also improve testing of their product before releasing new versions. We have had a few critical issues after upgrading to a newer version, which also caused problems with auditing.

Our company has been using One Identity Manager for around seven years, but I have personally used it for four years. I became its developer four years ago.

We are using it at one location. We have about 30,000 active identities. We have five people working with this solution.

There is room for improvement. For each ticket, they require logs or traces from the system, even when the issue shows no logs. This requires sending the information back and forth, which consumes a lot of time. After submission, they contact the product team, which often takes one or two months to respond.

Neutral

I have not worked with other solutions.

I was not involved when they started implementation, but it was complex. This complexity was not due to the difficulty of implementing One Identity Manager, but rather a lack of business support for our process decisions.

Deploying the One Identity Manager solution itself is easy. The documentation is clear.

You can do customizations. It can be customized, but it is hard to customize correctly without affecting the system.

IPG is our partner. They have helped customize the solution for our needs.

Their support was alright. It is important that the partner advises to follow the standards because customizations can cause issues. It is better to change the process instead of going for customization.

We received very good support from them post-implementation. It is of high level. I would rate our One Identity Partner a ten out of ten in terms of value.

I would recommend One Identity Manager for sure. It is quite easy to use as long as you find a good partner who can facilitate changes in the process rather than customize it for every single case. Many issues arise from the misuse of the system due to extensive customizations. If used correctly, there would be fewer issues, and it would be a fast, quick system.

It can be a bit complex to learn for new users when there is a lot of customization.

It has a lot of potential. We try to use it as much as possible, but we are not using it to its full potential. The problem is business support. 

Overall, I would rate One Identity Manager an eight out of ten.

We use One Identity Manager for access management and provisioning, as well as onboarding target system applications. It focuses on identity management and providing access. 

We use different tools like Web Designer and Synchronization Editor, and we do implementation, customization, and configuration based on our requirements.

I can see many benefits, including granting the right access to the right people at the right time. It helps with enhancing security, validating identity types, and assigning initial rights based on the defined processes. Users follow request workflows inside the system to access, which is validated for correctness.

We use One Identity Manager to manage SAP target system applications. We generally use the SAP connector. We create the SAP onboarding project in Synchronization Editor. It is like a bridge between One Identity Manager and the target SAP system applications. It is able to meet our requirements.

It has had a Windows-based UI, and they are also moving to a web-based portal. One Identity Manager helps manage identities and accounts, and we can also see the pictorial representation of the identities there.

We do a lot of customization. It supports customization based on our needs. However, when it comes to Web Designer, customization can be a bit challenging.

We have onboarded 30 to 40 applications, including SuccessFactors, ServiceNow,. We are about to complete SuccessFactors' integration with One Identity. Previously, we used to get the identities in the form of a CSV file where the data was inserted inside One Identity to create the identities of new joiners and do the onboarding. It is now connected to the SuccessFactors application. It is also integrated with ServiceNow. If any incidents get raised, they can be routed to the respective operations or engineering teams for resolution.

One Identity Manager helps minimize gaps in governance coverage among test, dev, and production servers.

One Identity Manager helps streamline application access decisions, application compliance, and application auditing. We have dedicated teams focused on compliance and auditing.

One Identity Manager has helped us achieve an identity-centric Zero Trust model.

In One Identity Manager, I appreciate the Synchronization Editor for onboarding different target system applications. We have various connectors that allow customization. For instance, the Windows PowerShell connectors can connect to different services such as RESTful services, SOAP services, and Windows services. I like how data flows from the target system applications to One Identity. We explore technical aspects, write functions in PowerShell, and connect with APIs. 

Another interesting feature is attestation, where we review and re-attest existing employees' rights. We create attestation policies, workflows, and schedules.

A major area for improvement is Web Designer. If One Identity Manager advances this, it will greatly benefit all customers. Web Designer is based on legacy Microsoft technologies like ASP.NET and HTML. I believe future improvements will resolve performance issues.

I have been using One Identity Manager for the last six years.

It is stable but need more improvements.

It is scalable. I would rate it an eight out of ten for scalability.

We use their regular support. Could be rate 7 or 8 out of ten.

Positive

We do not handle the initial setup, but from what I have heard, it is not complex.

In terms of maintenance, mostly it requires monitoring and health checks to ensure everything in the infrastructure is working properly.

I would definitely recommend One Identity Manager. It offers many opportunities for technical learning, implementation, and customization. One Identity Manager is a good solution for identity and access management, provisioning, and other IAM aspects. 

I would rate it an eight out of ten.

I work as a tester and qualitative analyst for a German client. They use One Identity Manager for identity management, which connects to various downstream applications such as SAP, DLCM, and RSA Archer. This requires numerous connectors, including Azure Active Directory and Microsoft Active Directory. Additionally, we create custom records from SuccessFactors using its integration with One Identity Manager. We sync data from SuccessFactors to create personal accounts and provision user accounts. We also create external identities for all vendors. Furthermore, we use One Identity Manager for reporting and auditing purposes.

We deployed One Identity Manager using a hybrid model through a CI/CD pipeline.

We can create, modify, use, and delete business roles directly from the web shop. Users can request and manage their business roles and entitlements, and we utilize them for our purposes.

We have recently migrated several applications, including RSA, DLCM, Majesco, and ServiceNow, from their native apps to the end-user environment. Previously, these applications were connected to LDAP, and before that, VLCM. We have now transitioned them to cloud-based Starling and CSM connectors, which are currently being used. In total, we have approximately four to five applications running on the One Identity Manager cloud service, utilizing these Starling connectors. It is helpful to have this extension of governance in the cloud.

We recently onboarded a new company using our Angular Web Shop. This is a new Angular-based Web Shop released by One Identity Manager. We've begun implementing Angular for this new company as a pilot application, and the front end has been very intuitive. We've tested the Manager, designer, and object browser for back-end operations, finding them easy to use. The object browser allows direct querying of results, and the designer is efficient in modifying configuration schedules. I've exclusively used One Identity Manager for the past five years and found it to be a good fit for our needs.

For privileged user requests, we require dual approval, with both the manager and application owner sign-off. Also, we conduct attestation reviews every six months to make sure that we have continued authorization. We implement two-factor authentication to enhance security using tools like MF Authenticator for all privilege access management. This requires users to provide an OTP upon login. For password storage and management, we utilize CyberArk's GPAM solution. Access to sensitive information is restricted to authorized users and is regularly reviewed to maintain security.

One Identity Manager assists in streamlining application access decisions, compliance, and auditing. As a financial organization, we have been leveraging One Identity Manager to audit various aspects of our operations. We use Power BI as a reporting tool to monitor current user access, access levels, testing dates, role assignments, and other relevant information. One Identity Manager effectively supports both access governance and reporting.

The automated provisioning feature streamlines user access by dynamically assigning roles and privileges based on user attributes like location and role. For example, a user with a manager role or from a specific location will automatically gain access to the system, eliminating the need for manual requests. This dynamic role conditioning runs daily, ensuring users receive appropriate access based on their current attributes. However, users or their managers must still submit requests through the web shop for additional privileges. If a manager requests on behalf of a user, the request is typically auto-approved within a few minutes due to the manager's authority. The system verifies that the requester is the recipient's manager before granting automatic approval, further streamlining the process.

The One Identity Manager's user-friendly interface allows for easy external identities and user account creation. To request a new account, we can just navigate to the appropriate section and provide the necessary information. Existing identities can also be managed through this platform by requesting entitlements. This streamlined process eliminates manual intervention and ensures efficient account management.

One Identity Manager's slow loading speed has been a recurring issue for users. This is likely due to the overwhelming number of entitlements, nearly 100,000 associated with the products. The high load is further exacerbated by the simultaneous access of thousands of users during peak times. To address this, we have implemented measures such as increasing server RAM, but the underlying issue of product-related entitlements remains a contributing factor.

While out-of-the-box features are typically user-friendly, our clients' customized user account creation and the added complexities of sub-entities and account sub-entities have made it challenging to leverage these features effectively. We plan to phase out these customizations and revert to a more standard configuration to streamline our processes and reduce long-term maintenance costs. Unfortunately, this transition has temporarily limited the availability of certain out-of-the-box functionalities. Furthermore, the extensive testing for our customized system is time-consuming and resource-intensive, as numerous scenarios must be evaluated to identify potential bugs.

The user interface of our web shop, which customers interact with directly, needs improvement. The front end's speed could also be enhanced. This might be related to the infrastructure of our client systems, but I need clarification. Regardless, the front end, which is the customers' primary point of contact, should be redesigned and optimized for a better user experience.

I have been using One Identity Manager for five years.

The backend tool occasionally experienced slowness due to the servers we used. Since 2012, we have been using outdated Microsoft SQL servers. However, last month, we upgraded these servers to the 2022 version. As a result, the tool's performance has significantly improved. Our client has used One Identity Manager for 14 years with no significant stability issues.

I would rate the stability nine out of ten.

One Identity Manager has demonstrated exceptional scalability in our organization. Despite initially lacking applications for DLC and relying on LDAP, our seamless migration to the cloud was a testament to its adaptability. We've successfully integrated over 200 SAP applications into Identity Manager, ensuring smooth operation without significant issues. This ongoing scalability, evident from day one, has allowed us to manage and secure our growing identity infrastructure effectively.

I would rate the scalability nine out of ten.

The deployment is straightforward. Our team consists of eight developers, including leads and team leads. We are organized into two separate development teams. One team focuses on developing new features and connectors, while the other enhances existing connectors and addresses product bugs. Each team has core developers and two leads. Additionally, we have an architect, a solution architect, and a business architect. For operations, we have a team of 12, and our testing team has eight members. Our IT department includes approximately 30 people, encompassing development, operations, and testing.

I would rate One Identity Manager nine out of ten.

We have 33,000 users for our clients.

One Identity Manager requires minimal maintenance. We upgrade it from the previous version when a major update is released every two years, and minor updates are released annually. To ensure continued support, we must upgrade our client's installation every two years to the latest version. This aligns with the manufacturer's support policy, which is limited to the current and previous major releases.

I recommend One Identity Manager to others due to its user-friendly interface. Although it may occasionally experience loading delays, its underlying infrastructure ultimately determines its performance. We have significantly improved its speed and reliability by upgrading from 2012 to 2022 servers. Additionally, the tick lines we use for operations, governance, subject matter experts, and backend operators are invaluable for managing the system efficiently. With them, managing One Identity Manager would be considerably more manageable. We utilize tick lines and desktop applications for operations and development, while front-end users benefit from the intuitive UI. Both interfaces are highly effective for their respective purposes.