What is our primary use case?
OneLogin serves as our centralized identity and access management platform. We previously used it as single sign-on, so users could access multiple business applications with one set of credentials instead of managing separate logins for everything. We also use it for user provisioning and de-provisioning to make onboarding and offboarding more efficient. One practical benefit is reducing password-related issues and giving users a smoother experience. At the same time, one challenge we notice is that integration can vary depending on the application. Standard cloud applications are usually straightforward, but some legacy or custom applications need additional configuration and testing. So it is not always a completely plug-and-play process.
Beyond SSO and access management, OneLogin also helps from a user experience and security perspective. Having a single place of authentication reduces password fatigue for users and cuts down on password reset requests, which can take up a lot of IT support time. At the same time, identity management is rarely a one-time setup. As organizations grow, applications change, and access requirements evolve. One challenge is maintaining the role structure and ensuring users continue to have the right level of access over time. Even with OneLogin, periodic access reviews and cleanup are still important because automation can help with efficiency, but governance still needs ongoing attention.
What is most valuable?
Single sign-on is the most valuable feature I find in OneLogin. From a user perspective, it makes daily work easier because employees do not have to remember different credentials for multiple applications. It improves productivity, but it also reduces password reset requests from the IT team, which can become a frequent support issue.
Another useful feature is automated provisioning and de-provisioning. Once users are linked to a role or group, application access could be assigned more effectively, and access removal becomes more controlled during offboarding. I would also mention MFA, multiple factor authentication, and adaptive authentication. Having an additional authentication step for higher-risk logins adds an extra security layer without applying the same restriction everywhere.
One practical advantage is the large application integration catalog because it simplifies connecting common enterprise applications. At the same time, in a real environment, there are still gaps that no identity platform fully solves. Modern cloud applications usually integrate smoothly, but some legacy systems or applications without proper federation support can still require manual processes. I have had situations where offboarding for non-integrated systems needed separate tracking, which can create security and audit concerns if not monitored properly.
What needs improvement?
OneLogin works well for centralized identity and access management, but there are a few areas where I think improvements could help, especially in larger or more complex environments. One area is integration with legacy or highly customized applications. Modern cloud applications are usually easier to connect, but older systems can still require additional configuration or workarounds. Having more flexibility and simpler integration options for those cases would help. I think reporting and visibility could also always improve. Organizations often want more detailed insight around user activity, access patterns, and audit information without needing additional tools or custom work. Another area is simplifying administration for complex environments. As companies grow, role structures and access policies can become difficult to manage. Small changes can sometimes have a wider impact and clear visibility into access relationships and dependencies would be useful. I would also say this is not only OneLogin's challenge but an industry-wide one. Balancing security and user experience is crucial. Organizations want stronger authentication and tighter controls, but users also want fast and simple access. Finding that balance is still something many identity platforms continue to improve.
For how long have I used the solution?
I have been using OneLogin for the last four years.
What do I think about the stability of the solution?
In my experience, I would describe OneLogin as generally stable for day-to-day operations. Most of the time, authentication, SSO, and user access processes work consistently, and users typically do not notice issues during normal usage. From an operational perspective, stability is especially important because identity platforms become a centralized dependency. If OneLogin has an issue, users can suddenly lose access to multiple applications at the same time. So reliability matters a lot.
What do I think about the scalability of the solution?
In my experience, OneLogin handles scalability reasonably well and adapts well as the environment grows. As we add more users, applications, and access requirements, we do not see a major need to redesign OneLogin itself. The cloud-based model helps because scaling users and applications feels more like expanding configuration rather than adding infrastructure. OneLogin is designed for enterprise-scale identity management and has been used across large environments with sustainable authentication volumes.
How are customer service and support?
My experience with customer support is generally okay, but I would describe it as a mixture rather than consistently exceptional. For standard questions or routine issues, responses are usually helpful and documentation covers many common scenarios. So not every issue requires opening a ticket. User review platforms generally rate OneLogin support positively overall, though experiences vary across customers. We do contact support occasionally for things like integration questions or troubleshooting authentication behavior. For straightforward issues, the experience is usually fine. More complex cases sometimes take longer because they need additional investigation or escalation.
Which solution did I use previously and why did I switch?
Before moving to OneLogin, we were using a more traditional setup with a combination of directory services and some application-specific authentication methods, rather than a fully centralized identity platform. The main reason for moving was to simplify access management and improve the user experience. Managing authentication separately across multiple applications was becoming difficult as the environment grew. Users had multiple credentials to manage, onboarding required more manual work, and maintaining access consistency across systems became harder. OneLogin helped by bringing everything into a more centralized model with SSO and more automated identity processes. That reduced some operational overhead and gave better visibility into user access.
One thing I have noticed is that migrations themselves can also be challenging. Moving users or reconfiguring application integration and ensuring a smooth user transition takes planning. So even when a new solution is better long-term, there is still some effort involved during the change.
How was the initial setup?
The setup itself is generally straightforward for standard integration. One thing I notice, though, is that regardless of the cloud provider, the bigger challenge is usually not connecting OneLogin itself. It is maintaining consistency, access policies, and integration as the environment grows. Once organizations start using many applications across different teams, access management can become more complex over time.
What about the implementation team?
OneLogin is primarily deployed in a hybrid environment in our case. OneLogin itself is cloud-based, but we still have a mix of cloud applications along with some on-premises or legacy systems that need to be integrated. That setup works well because it allows us to use the benefit of OneLogin as a cloud identity platform while continuing to support existing systems that the organization could not immediately migrate. In reality, many companies are in a similar situation where everything is not fully cloud-native yet. One practical challenge with a hybrid setup is that it can add some complexity around integration, synchronization, and maintaining consistent access policies across different environments. Modern SaaS applications usually integrate more smoothly, while older systems may require additional configuration or ongoing maintenance.
What was our ROI?
We did see ROI, although I would describe it more in terms of operational efficiency and time saving rather than saying we reduce headcount. We do not suddenly need fewer employees. Instead, the IT team spends less time on repetitive tasks and more time on higher-priority work. If I had to give a rough estimate from what we observe, password and login-related support requests likely reduce around thirty to forty percent and onboarding provisioning activity becomes noticeably faster once automation and centralized access management are in place. OneLogin also reports that organizations commonly see significant reductions in help desk volume and provisioning effort.
What's my experience with pricing, setup cost, and licensing?
From my perspective, I am not directly involved in the procurement or contract negotiation, so I have more visibility into usage and implementation than the exact pricing details. But my general impression is that OneLogin's pricing model is fairly standard for an identity and access management platform and is typically based on factors like the number of users and the selected features. For setup costs, it all depends on the environment's complexity rather than just the product itself. If an organization mainly has standard cloud applications, the setup feels more straightforward. On licensing, one thing I notice is that organizations sometimes need to plan beyond current requirements. Features such as advanced security capabilities, additional integrations, or future growth can affect overall costs over time. One practical challenge I have heard discussed across teams is that OneLogin's license cost is often only part of the overall investment. Time spent on implementation, administration, and maintaining integration can also become important factors when looking at the total cost of ownership.
Which other solutions did I evaluate?
We looked at a few other identity and access management options during the evaluation process, including Okta, Microsoft Entra ID, and solutions like Ping Identity. The comparison was not only about features because most mature IAM platforms cover core capabilities such as SSO, MFA, and user lifecycle management. The bigger discussion was around things such as integration effort, compatibility with other existing environments, ease of administration, user experience, and overall cost. OneLogin felt like a reasonable balance for our requirements at the time. It covered the functionality we needed without making the environment feel overly complex.
What other advice do I have?
Single sign-on has the biggest impact for our team on a daily basis. It is one of those changes that people notice pretty quickly because employees no longer have to keep track of multiple usernames and passwords. Support tickets related to password resets and login issues also become less frequent. So the IT team spends less time on repetitive tasks and can focus on other work. For MFA and adaptive authentication, the experience is generally straightforward for users. The idea is not to challenge users for every single login. For example, if someone logs in from their usual device or normal location, the process feels almost seamless. But if there is a login attempt from a new device, unusual location, or something that looks higher risk, additional verification could be triggered. Initially, there is some adjustment because users sometimes see the extra authentication step as inconvenient. We had a few questions around things such as changing phones, registering devices, or getting prompted unexpectedly. But once people understand that it is mainly for protecting accounts rather than adding extra work, adoption improves.
One thing I would add about features generally is that technology itself is usually only part of the solution. Features can work really well, but user awareness and process consistency still matter. A common challenge in many organizations is balancing security and user convenience. If controls become too strict, users get frustrated. If they are too relaxed, security risks increase. Finding that balance is still something many teams continue to work on.
The reduction in password reset and login-related tickets was probably somewhere around thirty to forty percent over time. It was not an overnight change because users still need time to adapt, but once SSO becomes part of daily usage, the support load definitely becomes lighter. In terms of time-saving, onboarding that previously could take several hours, especially when multiple applications and approvals were involved, becomes much faster. A good portion of the access setup could be completed automatically based on roles or groups. So in many cases, users could get access the same day without as much back and forth between teams. From a security and compliance perspective, centralized access management also improves visibility. During audits, it becomes easier to review who had access to what because information was more consolidated instead of spread across different systems. We also reduce the chances of inactive accounts being missed during offboarding. I would not say OneLogin completely eliminates security incidents because many risks still come from phishing, weak user practices, or unmanaged applications outside OneLogin. But having MFA and stronger access control definitely reduces some common risks related to compromised passwords. One ongoing industry challenge is that the identity environment can become complex as organizations grow. Over time, role structures, exceptions, and temporary access requests can pile up. So governance still requires continued cleanup and review. The tool helps a lot, but maintaining long-term access hygiene is still something many companies struggle to get on top of.
As environments become larger, managing access can become more complex than expected. The initial setup may be straightforward, but over time, organizations add more applications, users, and exceptions, and maintaining everything can require ongoing effort. Another point that sometimes comes up is troubleshooting. When authentication issues happen, especially across multiple integrated applications, teams may want faster root cause visibility. Sometimes the issue is not with OneLogin itself. It could be an application configuration, directory sync issue, or policy setting, but identifying exactly where the problem is still takes time. I have also heard discussions around making automation smarter. For example, many organizations still rely on role-based rules, but in real environments, user responsibilities change frequently. There is still a broader industry challenge around dynamically adjusting access based on changing roles, projects, or user behavior without creating unnecessary complexity.
We primarily use Azure alongside OneLogin. It fits well with the environment because a lot of our applications and user management processes are already connected to the Microsoft ecosystem. OneLogin works as a centralized identity layer while integrating with different applications and services.
HR-driven identity management plays an important role because it helps connect employee lifecycle events with access management processes. Instead of IT manually tracking every employee change, information from the HR system acts as a source for identity-related actions. For example, when a new employee joins, HR data such as department, role, or job title helps trigger account creation and assign initial access automatically. Similarly, when someone changes roles internally, access can be updated based on the new position, and when an employee leaves the organization, offboarding actions can start more quickly. The biggest benefit is reducing manual effort and improving consistency. It also helps avoid situations where access requests are delayed or someone retains access longer than needed. I would say HR-driven identity management helps streamline employee handling significantly, but good data quality and coordination between HR and IT remain important for it to work effectively.
The impact of phishing-resistant device trust is mainly around strengthening security without creating a completely different login experience for users. Phishing-resistant device trust adds another layer of confidence by considering not only who the user is, but also whether the device itself is trusted and meets security requirements. From an authentication perspective, it helps make decisions more context-aware. For example, if a login comes from a recognized and compliant device, the process remains smoother. If the device is unknown or does not meet certain conditions, additional verification or restrictions could be applied.
I would rate OneLogin around eight out of ten overall. The reason I would not give it a perfect score is that it does a good job with core areas such as SSO, MFA, centralized access management, and improving user experience. It can save time and simplify identity-related tasks in day-to-day operations. I give it an eight because it performs well in the areas it is mainly designed for. It improves access management, simplifies authentication with SSO, and helps reduce manual effort for onboarding and offboarding. For day-to-day use, it provides real value and generates a better experience for both users and the IT team. The reason I did not rate it higher is not because of a major issue, but because there are still areas that can become challenging in real environments. As organizations grow, managing complex role structures, handling exceptions, and integrating older or custom applications can take more effort than expected. For OneLogin to move closer to a ten for me, I would like to see even stronger automation and easier management for complex environments. Better troubleshooting visibility would also help, where administrators can quickly identify whether an issue comes from policy, integration, synchronization, or the application itself.
