One Identity Active Roles Reviews

My main use case for One Identity Active Roles is Active Directory management, user provisioning, provisioning and de-provisioning, role-based access control, and automating identity administration tasks.

The best features One Identity Active Roles offers are automated user provisioning, role-based access control, and delegated administration, auditing, and centralized Active Directory management. I also find the workflow automation and policy enforcement features very useful because they help reduce manual efforts, improve security, and maintain consistency across the environment. Features such as access templates, dynamic groups, and detailed reporting also make identity administration much more efficient.

Access templates and dynamic groups have helped standardize permissions and reduce manual configuration work. For example, when a user moves to a different department or role, the correct group membership and access right can be updated automatically based on predefined policies, which improves consistency and reduces errors.

Another feature I find valuable in One Identity Active Roles is the auditing and reporting capability. It provides clear visibility into changes made in Active Directory, which helps with troubleshooting, compliance, and security monitoring. The delegated administration feature is also very useful because it allows tasks to be assigned securely without giving full administrative access.

One Identity Active Roles has improved the efficiency of identity and access management in our organization. It reduced manual administrative work, improved consistency in user provisioning and access control, and strengthened security through better policy enforcement and auditing.

I noticed significant time-saving after implementing One Identity Active Roles. User provisioning, access updates, and onboarding tasks that previously required a lot of manual efforts are now completed much faster through automation, reducing administrative workload by around forty to fifty percent. It also helped reduce configuration errors and improve compliance by enforcing standardized access policies and maintaining detailed audit logs for Active Directory changes.

One Identity Active Roles could be improved with a more modern and user-friendly interface, especially for new administrators. Some advanced configuration and workflow can feel complex, so simplifying setup and management would improve the overall experience. Better integration and reporting customization options would also be helpful for large environments.

Other improvements needed for One Identity Active Roles include providing more simplified documentation and onboarding resources for advanced features and workflow configuration. Faster troubleshooting guidance for complex environments and more flexible reporting options would also help administrators manage identity operations more efficiently. Overall, the platform is reliable and delivers strong value for Active Directory management and automation.

Improvements for One Identity Active Roles would include enhancing performance and responsiveness in very large environments with complex workflows and multiple integrations. More built-in analytics and easier customization for dashboards and reports would also help administrators gain insights more efficiently.

I have been using One Identity Active Roles for around one year.

One Identity Active Roles is stable.

One Identity Active Roles has shown good scalability in our experience. It can efficiently handle a growing number of users, groups, workflows, and Active Directory objects without major performance issues, making it suitable for enterprise environments and hybrid infrastructure.

My experience with customer support has been positive overall. The support team is very knowledgeable and generally responsive in handling configuration issues, and I receive good technical expertise and helpful assistance from the support team.

Before using One Identity Active Roles, we mainly relied on native Active Directory tools and manual administrative processes. We switched because One Identity Active Roles provided better automation, centralized management, delegated administration, and stronger auditing capabilities, which helped reduce manual efforts and improve security and operational efficiency.

My experience with pricing, setup cost, and licensing was generally positive. The initial setup required proper planning and configuration, especially for workflow, delegation policy, and Active Directory integration, but the deployment process itself was manageable.

We have seen a positive return on investment, mainly through time-saving and reduced administrative workload. Tasks such as user provisioning, access updates, and account management that previously required a lot of manual efforts are now automated, reducing administrative efforts by around forty to fifty percent. It also helps reduce configuration errors, improve compliance, and allows administrators to focus more on strategic identity and security tasks instead of repetitive manual processes.

Before choosing One Identity Active Roles, we evaluated other solutions, and we selected One Identity Active Roles because of its strong Active Directory management capabilities, delegated administration, automation features, and centralized visibility across hybrid environments.

My advice for others looking into using One Identity Active Roles is to clearly plan your identity management and Active Directory requirements before implementation. Invest time in proper onboarding and workflow design so you can fully utilize the automation, delegated administration, and compliance features. Once configured properly, it can significantly reduce manual efforts and improve security and operational efficiency.

Overall, One Identity Active Roles has been a reliable and valuable solution for improving Active Directory management, automation, and access control. It helped reduce manual efforts, improve security, and streamline identity administration tasks across the organization. I would rate this product an eight out of ten.

Public Cloud

Amazon Web Services (AWS)

One Identity Active Roles is used for provisioning and directory management.

One Identity Active Roles has excellent delegation of permissions capabilities, allowing me to isolate the help desk team and give them permissions exactly where I need them, easily. I appreciate the automations, where PowerShell scripts can do things on behalf of other staff that I do not want to give permissions to. Two-factor authentication helps ensure that people who perform actions in Active Directory have two-factor authentication enabled.

One Identity Active Roles helps by automating tasks through scripts instead of manually running scripts or doing certain things manually, allowing people with fewer privileges to run those automations instead of burdening system admins.

One Identity Active Roles has benefited my security posture by helping reduce internal exposures of permissions and by facilitating two-factor authentication for Active Directory.

One Identity Active Roles supports my provisioning and de-provisioning needs very well. It has helped increase operational efficiency by saving a lot of time and has helped reduce the number of privileged accounts.

I evaluate the ease of managing on-premises and cloud-based identity directories through a single pane of glass as fairly easy, with a learning curve that makes it very easy to maintain once you become familiar with it.

Integration capabilities are somewhere in the middle; it is not easy to integrate, but it is not the hardest thing out there.

Certain automations, possibly web apps, could be improved or simplified to make them easier. These automations are what I think could be improved.

I do not use the comprehensive group membership management feature and have not utilized the fine-grained permission control feature deeply. The process of streamlining directory security for on-premises and cloud-based directories is not particularly applicable to my organization.

I have been using One Identity Active Roles for about three years.

One Identity Active Roles has very few bugs and is actually very stable, so I would rate the stability a nine out of ten.

I am not certain if One Identity Active Roles is a scalable solution for us since we have local deployment and approximately 50 users, and scalability is not really relevant to our situation.

I rate the vendor's technical support a ten out of ten.

Positive

We tried other solutions years ago, but I cannot compare them because I do not remember the details. Upper management tried something like SailPoint, Amada, or Symantec a while ago, but that was not me and those individuals are no longer with the company.

The deployment of One Identity Active Roles probably took weeks, though it depends on what is meant by deployment.

One Identity Active Roles was purchased through a partner.

I am aware of the pricing; it is on the expensive side, though pricing is not my department.

One Identity Active Roles is not a scalable solution for our organization since we have local deployment and approximately 50 users, and scalability is not really relevant to us. It is not a global solution; it is not worldwide.

The process of streamlining directory security for on-premises and cloud-based directories is not particularly applicable to my situation. Approximately 50 users use the solution.

I would say One Identity Active Roles has reduced privileged accounts by about 30 percent. To my knowledge, it has not helped reduce identity-based breaches.

I assess the visibility that One Identity Active Roles provides into my directory ecosystem as excellent. I would rate the granular control of One Identity Active Roles as a ten out of ten.

I would recommend this product, but it depends on exactly what you are trying to achieve; conducting a proof of concept about what you would like to see is vital. It is very difficult to answer in a review because it depends on the pain points of the customer and what they are trying to accomplish. Overall, I would recommend it and I am satisfied with the product.

The vendor may reach out if they have any questions or comments about my review. My overall review rating for One Identity Active Roles is nine out of ten.

On-premises

The main use case for One Identity Active Roles is automated user and group lifecycle management, and policy enforcement and data consistency, which we actually use it for.

One Identity Active Roles has helped us in enforcing the naming and property policies, allowing users to generate a SAM account name and a user principal name based on the roles that we have written, and it also performs data validation and other tasks.

One Identity Active Roles offers best features including role-based access control, schema preservation, and policy-driven data quality, and it provides audit trails and change history tracking, which has helped us in auditing. It has also assisted us in consolidating hybrid and Active Directory identity management, and role-based provisioning and automated user provisioning have helped us significantly.

One Identity Active Roles has positively impacted our organization by helping us automatically complete user-based provisioning, dynamic groups, and RBAC provisioning. It has helped us improve compliance in a measurable way, saved time in provisioning users, and provided users with birthright access quickly upon arrival, allowing fast access.

One Identity Active Roles can be improved by modernizing the core user interface and simplifying the initial setup and policy workflow conversion. These two improvements are the major areas where One Identity Active Roles can evolve.

I have been using One Identity Active Roles for more than five years.

One Identity Active Roles is stable.

We are using One Identity Active Roles, One Identity Manager, and One Identity Safeguard, which are the three solutions that we are currently using.

The customer support for One Identity Active Roles is very good. They provide help whenever required, and we get a response within 24 hours from them when we submit a ticket.

Previously, we did not have any solution for Active Roles and were only using Active Directory. This is the first solution that we are using for Active Roles.

It was not difficult to integrate One Identity Active Roles with our existing IT infrastructure and directory services. It was easy to integrate with our IT structure.

We used the permission control that One Identity Active Roles provides, which impacted us in giving users the least privilege, including for admin accounts. It helped us grant only the required permissions that a user needs depending on their job title and department.

The impact of One Identity Active Roles on our organization's compliance efforts was very good because we were able to provide compliance reports to the SOC and everything, improving our compliance. Before, we were tracking it manually through other tools, but it was very difficult to get everything in one point. After using One Identity Active Roles, we provided a complete report to the auditors, which improved the time we were taking for audit reporting.

We compared One Identity Active Roles with Software AG, particularly a Net-Access option that we have in Software AG, which was not as user-friendly. We switched to One Identity Active Roles, which is more helpful and less costly than the other tools.

I would advise others looking into using One Identity Active Roles that it will help them improve their user provisioning time, automate user provisioning, and assist them with auditing, so they should give it a try. I gave this review a rating of 8.

On-premises

Other

My main use case of One Identity Active Roles is managing user life cycle activity in Active Directory on a daily basis. I use it for user provisioning, group membership management, delegated administration, and handling access-related requests while maintaining governance controls.

Besides user provisioning, I also use One Identity Active Roles for delegated administration and access governance. It helps me to control who can perform specific tasks without granting broad administrative rights, which has been useful for maintaining security and operational consistency.

The features I found most valuable in One Identity Active Roles are delegated administration, workflow-based automation, and role-based access control. These features help streamline Active Directory management while maintaining better control over administrative permissions and access requests.

Workflow automation helped by reducing the number of manual steps involved in routine AD tasks. For example, when a new user request comes in, the approval and provisioning process follows a predefined workflow instead of relying on emails and manual coordination. This made requests more consistent and reduced the chances of missing important access assignments or approvals.

The auditing and reporting capability is worth mentioning. It gives better visibility into administrative changes and helps during the access review or audit activity. I also appreciate how the platform centralizes many AD management functions.

One area for improvement would be troubleshooting and reporting. When dealing with complex workflows or delegated permissions, identifying the root cause of an issue can sometimes take longer than expected. I would also like to see a more modern administrative experience and greater visibility into workflow activities to make day-to-day management easier.

Another improvement I would like to see is better visibility into delegation and access relationships. In larger environments with multiple teams and administrative roles, it can sometimes be difficult to quickly understand why a user has a particular permission or access level.

I have been working in my current field for the last three years.

One Identity Active Roles has been a stable platform in my experience. I use it regularly for user management, delegation, and access-related tasks, and it performs reliably in day-to-day operations. Most issues I encountered were related to workflow configuration or process changes.

From my experience, One Identity Active Roles scales well as the environment grew. I was able to manage an increasing number of users, groups, and administrative requests without significant changes to my processes. Features like delegation and automation helped support growth while keeping administration manageable and consistent.

My experience with customer support has been positive overall. The support team was generally responsive and had a good understanding of Active Directory, delegation, and workflow-related issues. For more complex cases, resolution times sometimes required escalation, but the guidance provided was usually helpful and technically sound.

Before One Identity Active Roles, I primarily relied on the native Active Directory administration tools and PowerShell scripts for user and AD group management. I switched because I wanted a more centralized approach with delegation, automation, and governance. As the environment grew, managing permissions and administrative tasks manually became harder to maintain consistently.

I found the integration fairly straightforward because my environment was already centered around Active Directory. The core connectivity and synchronization were not difficult to establish. Most of the effort went into designing the delegation model and approval workflows to align with the existing operational processes rather than the technical integration itself.

The ROI was mainly seen in time savings and operational efficiency rather than directly reducing headcount. Routine tasks such as user provisioning, account maintenance, and access requests require less manual effort than before the implementation. I also saw fewer escalations to the AD team because delegated administration allowed support teams to handle common requests independently, which improved overall productivity.

I evaluated a few alternatives including Microsoft Identity Manager and SailPoint. I ultimately chose One Identity Active Roles because it aligned well with my Active Directory-focused environment and offered a good balance of delegation, automation, and governance capabilities without adding too much operational complexity.

One outcome I noticed was a reduction in manual AD administration. Routine tasks such as user account management and group updates became more structured, which helped reduce configuration mistakes. I also found that access reviews and audit preparation became easier because administration changes were centrally managed and easier to track.

In my environment, One Identity Active Roles is deployed in a hybrid setup. The application runs on virtual servers in my on-premises data center while supporting identity management processes that interact with my cloud services. This approach works well because it allows me to maintain control over the Active Directory administration.

As part of my hybrid environment, I primarily use Microsoft Azure since my infrastructure is closely aligned with Active Directory and Microsoft services. Azure integrates well with my identity and access management processes. It allows me to support both on-premises and cloud-based identity requirements.

I have used fine-grained permission control in One Identity Active Roles. It was particularly useful for delegating specific administrative tasks to support teams without granting full Active Directory administrative rights.

I would rate this review a nine out of ten.

Hybrid Cloud

Microsoft Azure

My main use case for One Identity Active Roles is Active Directory user and group management with automation and delegated administration. For example, in daily work, I use it to automate user provisioning, deprovisioning, manage security group access, and enforce naming and compliance policies across AD environments.

The best features for One Identity Active Roles in my experience are automation, delegated administration, RBAC, dynamic group management, and policy enforcement. I also appreciate centralized management for AD and Entra ID, along with auditing and change tracking which helps significantly during compliance reviews.

One Identity Active Roles has made the biggest impact in automation and delegated administration. It reduced manual AD tasks, minimized provisioning errors, and accelerated user onboarding and offboarding significantly in day-to-day operations.

One Identity Active Roles has positively impacted our organization by improving AD administration efficiency, reducing manual errors, strengthening access governance, and helping to standardize user provisioning and compliance processes across the team.

Since implementing One Identity Active Roles, we have seen faster user provisioning and deprovisioning, a noticeable reduction in manual AD efforts, and significant time savings for routine administrative tasks. It also improved audit readiness through better tracking and policy enforcement.

One Identity Active Roles could be improved with a more modern and intuitive UI, faster performance for large environments, simpler reporting customization, and smoother integration with cloud-native identity platforms and APIs.

I have been using One Identity Active Roles for around a year, mainly for AD automation, user provision, group management, and access governance tasks.

One Identity Active Roles is very stable.

The scalability of One Identity Active Roles is strong in my experience. It handles large and complex Active Directory environments efficiently, supports multiple domain and hybrid setups, and maintains performance even with a high number of users and objects when properly configured. It is well-suited for enterprise-scale identity management.

Support for One Identity Active Roles is generally good. We have a positive experience with response time and technical assistance for both configuration and troubleshooting. Documentation and support portal resources are also helpful, though some complex issues may require escalations.

The integration of One Identity Active Roles with our existing Active Directory and IT infrastructure was fairly straightforward. I connected smoothly with our directory services, and most configurations were manageable with standard setup and policies. Some advanced customization required learning, but overall, the integration effort was moderate.

We have clearly seen the ROI for One Identity Active Roles. We reduced manual Active Directory administration efforts, improved provisioning speed, and minimized errors that previously required rework. While exact figures vary, the biggest gains were in the time saved for routine tasks and reduced workload on the AD team, allowing us to focus on higher value work instead of repetitive user management.

We found the pricing, setup cost, and licensing for One Identity Active Roles to be on the enterprise side, but justified by the capabilities. Initial setup, some planning, and integration effort with Active Directory and licenses are typically based on managed user objects. Overall, the cost made sense considering the automation, governance, and long-term reduction in manual administration.

My advice for others looking into One Identity Active Roles is to clearly define your Active Directory structure and governance model before implementing it. Invest time in designing roles and workflows properly, as most of the value comes from there. Also, plan the integration carefully and involve the AD and security team early to ensure smooth adoption.

One Identity Active Roles has been a reliable and effective solution for managing Active Directory at scale. It improved security, reduced manual work, and brought consistency to the identity operations. The main value comes from proper design and automation setup, which pays off long-term. I would rate this review a 10 out of 10.

On-premises

One Identity Active Roles is used primarily for managing Active Directory, including user provisioning and group management. When a new employee joins, I use One Identity Active Roles to automatically create their AD account, assign them to groups, and apply policies, all with proper approvals.

Apart from basic user provisioning, I use One Identity Active Roles daily for managing and controlling Active Directory permissions in a structured way.

The best features One Identity Active Roles offers are delegated administration and automation, which stand out the most because they reduce admin workload and improve security. Delegated administration and automation significantly reduce admin workload while improving security and control.

For example, HR or help desk can create or modify users, but only within defined limits - they cannot make critical changes outside their scope.

One Identity Active Roles reduces the risk of misuse or accidental changes, and a workflow benefit is that the centralizing IT team does not handle every request. One Identity Active Roles has had a very positive impact on the organization, especially in terms of security and control over Active Directory.

I have utilized the fine-grained permission control feature of One Identity Active Roles, and it has significantly helped implement least privilege principles. Instead of giving broad admin rights, very specific permissions are assigned based on roles, tasks, and need-to-know access. One Identity Active Roles has had a strong positive impact on the organization's compliance efforts. All changes in AD are logged and traceable, which helps during audits. Fine-grained permissions ensure users only have the access they need, while naming conventions, access roles, and security policies are automatically enforced.

One Identity Active Roles is very useful, though there are a few areas where it could be improved, such as the user interface, policy creation, and reporting - it requires good knowledge of Active Directory. The UI can feel outdated and not very intuitive for new users, and the learning curve is steep. Sometimes there can be slight delays when handling large-scale operations, and the reporting needs to be more helpful for audits.

I have been using One Identity Active Roles for around six months.

One Identity Active Roles is generally a stable and reliable solution based on my experience.

One Identity Active Roles is highly scalable and works well in both medium and large enterprise environments, as it can manage multiple AD domains, Azure AD tenants, and even hybrid environments from a single console.

Customer support for One Identity Active Roles is generally good, especially for standard issues and guidance. The support team is knowledgeable about the product and AD environments, being helpful for configuration issues, troubleshooting, and best practices.

Before implementing One Identity Active Roles, I was primarily managing AD using native tools from Microsoft Management Console, such as Active Directory Users and Computers. I switched because the manual effort was too high, and there was limited delegation and no centralized control.

Integrating One Identity Active Roles with the existing IT infrastructure and directory services was relatively smooth, especially since it is designed to work seamlessly with AD on-premise. It integrates natively with the AD, so the core setup is straightforward.

A strong return on investment has definitely been seen.

My experience with pricing and licensing for One Identity Active Roles has been reasonable for an enterprise solution, but it does require proper planning. The initial setup can involve some cost in terms of time and resources, especially for configuration, policy design, and integration, as skilled Active Directory or IAM professionals were required.

Before selecting One Identity Active Roles, I evaluated a few other options to compare features and fit for the requirements, such as Microsoft Identity Manager.

My impression of the automation capabilities provided by One Identity Active Roles is very positive - they significantly reduce manual effort and improve consistency. For example, when a new employee joins, I use a predefined template, and One Identity Active Roles automatically creates the user account, applies naming conventions, assigns the correct groups, and enforces policies; previously, this required multiple manual setups, but now it is done in a few clicks with consistent results.

One Identity Active Roles has significantly reduced both the complexity and workload of administrative tasks related to Active Directory. Many repetitive tasks are automated, so admins spend much less time on routine activities. Delegated administration allows other teams to handle common requests instead of escalating everything.

My experience with the delegation of administrative tasks through One Identity Active Roles has been very positive, as it has made the workflow much more efficient and controlled. It allows specific admin tasks to be assigned to different teams, so routine tasks such as user creation or password resets are handled by help desk teams, meaning requests do not need to be escalated, so turnaround time is much quicker.

My advice for organizations considering One Identity Active Roles would be to plan the implementation carefully; clearly define your requirements and decide who should have what level of access before implementing. I would rate this product an eight out of ten.

On-premises

The main use case of One Identity Active Roles is to support daily Active Directory administrator tasks. Routine tasks such as user creation, password resetting, account updates, and handling are performed through One Identity Active Roles, which can be managed by the support team and has really improved the efficiency of our teams.

A real-time day-to-day example of using One Identity Active Roles is that a help desk user can reset the password and unlock the account without accessing Active Directory directly. When new users are created, required settings are applied automatically, making our jobs easier and operations very smooth. Previously, this was taking so much time, but nowadays it is automated, so it is a very good solution.

The best features One Identity Active Roles offers, in terms of my use cases, include its policy enforcement to ensure that all changes follow predefined standards, avoiding incorrect configuration and maintaining consistency across Active Directory, the role-based access control that allows assigning permissions based on job roles to simplify management and improve security in our organization, and its automation features.

I need to highlight role-based access control in One Identity Active Roles, as it has had the biggest day-to-day impact. Automation and policy enforcement are powerful, without doubt, but role-based access control is what fundamentally changed how we operate. Earlier, many tasks were a bottleneck, with only a senior admin able to perform most Active Directory changes, resulting in many help desk tickets. However, with One Identity Active Roles, we created fine-grained roles such as password reset, group management, and user provisioning, assigned those roles to the help desk team, and restricted access to only those organizational units based on attributes. Now, 90% of routine tasks are handled without escalation.

The effect of One Identity Active Roles on the complexity and workload of administrative tasks related to Active Directory has been very positive. It significantly reduces the operational burden while making processes more structured and controlled. It has really reduced administrative complexity. Tasks are handled through templates, policies, and workflows, which has significantly reduced the workload.

One Identity Active Roles has really impacted our organization very positively. It has improved control over Active Directory operations and reduced manual efforts. Tasks are completed faster than previously and more securely. These are the positive impacts we are seeing in day-to-day operations.

One Identity Active Roles has really proved its value. While exact numbers vary by environment, the provisioning time reduced by 70 to 80% and it is very smooth, and help desk ticket resolution improved by 60 to 80%. It has really reduced the use of privileged accounts, contributing to the positive impact we are seeing.

As far as improvements to One Identity Active Roles are concerned, I do not think any lack of features is present in the solution. It is working well and is a very powerful solution. There is no need for improvement as per my requirements.

One thing I can add is that One Identity Active Roles could be more simplified for the initial setup and configuration.

I have been using One Identity Active Roles for more than four years.

One Identity Active Roles is stable.

From a scalability perspective, One Identity Active Roles is a very good solution. There is no kind of challenge.

Customer support for One Identity Active Roles is very supportive and good in their technical aspects.

From day one, we have been using One Identity Active Roles only.

Regarding Active Directory integration with One Identity Active Roles, it was very smooth and quick. We have not seen any kind of challenge, and it synced with Active Directory beautifully.

We have seen a huge return on investment with One Identity Active Roles. In many cases, that was quite measurable, such as reduction in provisioning and admin efforts by 40 to 60%, which resulted in reduced need for additional staff. Without it, we would need thousands of additional people. Cost saving and efficiency gain have led to some users reporting approximately 75% ROI and cost reduction.

I have had a great experience with the pricing, setup cost, and licensing of One Identity Active Roles. There is no challenge we have seen as far as the vendor is concerned.

We have not evaluated other options before choosing One Identity Active Roles.

I will highly recommend One Identity Active Roles because it is a very useful tool for improving Active Directory management and control. It really reduces risk and improves efficiency. It is well suited for organizations with a large Active Directory environment, which I will recommend highly. I gave this review a rating of 8.

On-premises

Other

We are using One Identity Active Roles to simplify our Active Directory administration, such as controlling delegation access and automating routine tasks including user management activities.

One Identity Active Roles offers many valuable features that function very smoothly, including delegation administration, automated user management, approval workflows, and auditing details. These are the best features based on my experience.

What stands out the most in One Identity Active Roles is its ability to securely delegate routine Active Directory tasks without granting full administrative privileges. Combining this with automation and policy-based control really helps us reduce manual efforts.

One Identity Active Roles has positively impacted many areas within our organization by simplifying Active Directory administration and reducing manual efforts. It improves operational efficiency with the help of automation and delegated administration, leading to very positive outcomes.

In terms of governance and security, One Identity Active Roles provides very valuable add-on features, offering strong governance while not being heavily AI focused. It helps us enforce least privileged access and improves accountability while mitigating the risk of unauthorized changes within our Active Directory environment.

The accuracy and reliability of output from One Identity Active Roles are very high, as it provides very accurate results.

We use the fine-grained permission control feature of One Identity Active Roles, which has been very effective in supporting our least privilege strategy. For example, help desk staff can perform password resets and account unlocks without receiving full Active Directory administrative rights, providing security and reducing the number of highly privileged accounts in the environment.

My impression of the automation capabilities of One Identity Active Roles has been very positive. User account creation, group membership assignments, and account updates can be automated through predefined policies and workflows, allowing the correct attributes, permissions, and groups to be applied automatically based on organizational requirements.

One Identity Active Roles helps improve our compliance processes by enhancing control, visibility, and accountability within Active Directory, strengthening governance, and simplifying the audit and compliance process.

I believe the initial setup could be more simplified to allow for better and faster deployment.

I have been using One Identity Active Roles for almost two years.

One Identity Active Roles is a stable solution.

One Identity Active Roles is a very scalable solution that can handle organizational growth over time.

Customer support for One Identity Active Roles is very responsive and effective. Whenever we face technical issues, we raise a ticket and they are ready to provide support.

I believe the initial setup could be more simplified to allow for better and faster deployment.

We are seeing a very good return on investment with One Identity Active Roles by reducing manual efforts, which in turn saves us time and money. This solution provides a significant benefit, allowing us to complete tasks forty to sixty percent faster than before.

My advice to any organization considering using One Identity Active Roles is to deploy it, as it will be a great decision. During the deployment phase, I recommend identifying the Active Directory tasks that consume the most administrative time and focusing on automating those processes while taking advantage of all the useful features. I rate One Identity Active Roles nine out of ten because it is a very powerful solution providing great features and a smooth operational process.

On-premises

Microsoft Azure

I use One Identity Active Roles primarily for identity management. We use it for managing multiple domains from a single interface, and the domains do not have trust between them. It has been used by multiple support teams, such as the service desk or the identity access management team for account creation, modification, and management of accounts. It is mostly focused on account creation, modification, deletion, and AD objects.

One Identity Active Roles has helped my organization reduce the number of incorrect privileged accounts through the management unit feature. It helps us identify accounts that are not in use, and while creating admin accounts, we use it to set policies regarding which required fields must be filled during account creation. This helps us keep the process clean and ensures all required attributes are filled before account creation. We have scheduled scripts on One Identity Active Roles that check if activity meets criteria. If it doesn't, it will move the account to a specified OU, disable it, or delete it, as per the defined process.

One Identity Active Roles helps us keep accounts consistent. For instance, when somebody leaves the company, all associated accounts get removed, which helps us eliminate unwanted accounts.

For Active Directory, the provisioning and de-provisioning capabilities work exceptionally. The de-provision feature allows account disconnection without disabling it, enabling quick reconnection with automatic group additions. This feature significantly speeds up the process compared to disabling and re-adding to groups.

The comprehensive group membership management feature is exceptional because it offers two features not available in Active Directory directly: adding multiple secondary owners and dynamic groups. The latter is only available for Azure AD, not for on-premise AD.

Using One Identity Active Roles enables temporary group additions. For instance, if a group provides access, we can temporarily add a member, and when the time period expires, the member gets removed automatically.

The granular control is exceptional; we can give the least control required by the team. For modifying any group, we don't have to give create and delete roles; we can just give them the move role. 

The delegation of administrative access impacts IT operations positively through access templates, which are usually created based on the team.

One Identity Active Roles has increased operational efficiency despite occasional slowdowns. Solution consolidation is part of our identity and access management strategy, eliminating the need for direct Active Directory access for the help desk and IAM team.

The best features of One Identity Active Roles include managing multiple domains from a single interface. I don't need to log into jump servers, making it very easy to log in from the web and manage it. Dynamic groups are also one of the best features, eliminating the need to add or manage members manually. The management unit is another excellent feature, which we can use as a virtual OU to identify missing elements.

The approval process and group approval process can include adding multiple secondary owners. 

The interface appears outdated. Once logged in, everything inside remains unchanged from years ago. 

Additionally, when they release new features, they should provide training or webinars at least once or twice a year. This would help users stay updated and aware of new features. When I requested a demo session with One Identity, the presenter didn't provide complete details, making it difficult for non-technical managers to understand. The demo should be planned based on the customer's knowledge level.

Regarding visibility in the directory ecosystem, while it is very good, there are limitations. When we add numerous domains, it becomes slow. With around 60 domains, attempting to add approximately 30 caused significant performance issues. We had to remove and decrease the number of domains, indicating room for improvement in managing multiple domains from a single interface.

I have been using One Identity Active Roles for approximately 11 or 12 years.

I would rate the stability as eight out of ten. I have already discovered approximately three defects in the new version. 

While One Identity Active Roles has improved operational efficiency, there are occasional challenges with system slowdowns.

The scalability is excellent, rated around nine or ten out of ten. It can be expanded or decreased based on the SQL server requirements.

In our organization, the solution is open to all users with read-only access, with approximately 200 users having admin access. 

I would rate their support a nine out of ten.

Positive

I've personally deployed systems from scratch, from planning through to completion.

Deployment is not overly complicated. We do need to ensure that the required ports are open and that we have the necessary permissions. However, it does vary from company to company regarding how they manage to get those ports opened and permissions granted. Based on my experience, I would rate the complexity of deployment as about a seven or eight out of ten. In the new version, we did encounter some issues related to system slowness, but other than that, most aspects look good.

The deployment duration depends on your company's processes. If you manage to get the ports opened and the permissions granted quickly, the deployment can be completed in about two months. For us, it took approximately six months because acquiring the necessary permissions and opening the ports took time. Additionally, post-deployment, we needed to conduct some testing as well. So, while I wouldn’t say it takes excessively long, it does depend on your circumstances. If everything is in place, meaning if the ports are open and permissions are set, you could deploy a basic version within two days.

The solution requires regular maintenance, including server patching and routine updates. We monitor alerts and check the website regularly as part of business-as-usual support.

When comparing One Identity Active Roles with other solutions in the market, there are no direct competitors. Having explored alternatives in my previous company, I found it to be more user-friendly and to have more secure features around Active Directory than other available solutions.

Regarding integration, I have not yet integrated One Identity with other One Identity products as this process is ongoing with our recent upgrade. While we have multiple One Identity products, this integration remains a future project.

Regarding lifecycle management capabilities via the workflow engine, we have not fully utilized it because most workplaces have used third-party tools such as Microsoft MIM. At my previous workplace, SailPoint was used for complete account lifecycle management. We primarily used One Identity Active Roles for account management after creation and for modification of admin accounts.

I would recommend One Identity Active Roles based on its ability to manage domains from a single interface and provide minimal-required access based on work requirements. The web interface login and MMC console are very user-friendly.

I would rate this solution an eight out of ten.

On-premises

Our main use case for One Identity Active Roles is centralized Active Directory administration and user lifecycle management. We primarily use it for automated user provisioning and de-provisioning, role-based access control, group management, and delegating administrator tasks securely without giving full domain admin rights.

One common scenario is delegating password reset and user account unlock tasks to the service desk team using One Identity Active Roles.

Another valuable aspect for our use case with One Identity Active Roles is automation and standardization. We use it to apply consistent user provisioning policies, naming conventions, and group assignments across the organization.

One Identity Active Roles has had a positive impact on our organization by improving security and simplifying Active Directory management. One of the biggest benefits has been secure delegation. We no longer need to provide full domain administrator access for routine tasks, which has reduced security risk and improved operational control. Help desk and regional IT teams can handle common user management activities within their assigned scope without affecting critical systems.

We have seen noticeable operational and security improvements after implementing One Identity Active Roles. One major improvement was the reduction in manual administrator effort for tasks such as user provisioning, password resets, group assignments, and account deactivation, which became much faster through automation and delegation. This has reduced the workload on senior administrators and improved response times for end users.

The best features of One Identity Active Roles are its automated delegation and centralized Active Directory management capabilities. Based on my experience, these are the most valuable features, including role-based access control and automated workflows, dynamic group management, change tracking, and auditing, hybrid environment management, and access templates and policy enforcement.

The feature that made the biggest difference for us with One Identity Active Roles is the role-based delegation. Automation workflow, automated user provisioning, de-provisioning, group management, and policy enforcement reduce manual work and human error. Dynamic group management, such as automatically adding or removing users from groups based on predefined rules and attributes, also contributes significantly.

One area where One Identity Active Roles could be improved is the user interface. A more modern and simplified interface would help reduce the learning curve and improve day-to-day management efficiency.

I would also appreciate improvements in cloud-focused management and integration. Many organizations now operate in a hybrid or cloud-first environment, so having more intuitive Microsoft 365 and Entra ID management workflows would improve operational efficiency.

There are still a few areas where improvements could be made to One Identity Active Roles, such as a more modern user interface experience. The interface is powerful but can be dated and complex. A cleaner, more intuitive UI would make daily admin tasks faster and easier, particularly for new administrators. It also needs a strong cloud-native experience and simplified workflows and reporting setup.

I have worked in this field for the last seven years.

One Identity Active Roles is very stable.

Its scalability is good.

Customer support is good, and I rate customer support a nine.

Before selecting One Identity Active Roles, we evaluated several other options, including Active Directory management and IAM solutions, such as Microsoft native tools, AD Entra, ManageEngine ADManager Plus, NetIQ, SailPoint, Okta, and JumpCloud. While other tools were very strong, especially in areas including governance and cloud IAM, One Identity Active Roles stood out for operational AD management, particularly secure delegation, which was our primary requirement. We chose One Identity Active Roles based on this evaluation.

Integrating One Identity Active Roles with an existing IT infrastructure and directory services is generally of moderate difficulty. It is not overly complex, but it does require proper planning and Active Directory expertise.

We have seen a clear return on investment from the implementation, mainly in time savings, reduced help desk load, and improved Active Directory operations. The typical ROI outcomes we have observed include time savings in user provisioning, which previously took twenty to thirty minutes per request. After implementing One Identity Active Roles, we reduced this to approximately five to ten minutes using templates and automation. This alone represents a sixty to seventy percent time reduction per request.

We have seen a clear return on investment from the implementation, mainly in time savings, reduced help desk load, and improved Active Directory operations.

Our experience with pricing, setup costs, and licensing indicates that it is on the higher side but justified by the enterprise value. The licensing model is typically subscription-based and usually calculated based on the number of managed user accounts.

Our experience with delegation in One Identity Active Roles has been very positive and has fundamentally changed how we manage Active Directory operations. With delegation, we have implemented role-based delegation to assign specific administrator responsibilities to different IT teams, such as the help desk team for password resets, account unlocks, and basic user attribute updates; the regional IT team for user and group management; and the AD administrator for higher-level tasks including policy changes, schema-related operations, and domain controller control.

The key advice I would recommend is to invest time in design before implementation, redefine your role model and UI structure, start small and expand gradually, and keep your delegation strategy role-based.

One Identity Active Roles has significantly reduced both the complexity and the workload for Active Directory administration in our environment. The impact on workload has been a major reduction in manual AD tasks. Routine activities such as user creation, password resets, group updates, and account disabling and enabling are now largely automated and delegated to various roles.

The automation capabilities are generally very strong, especially for Active Directory lifecycle management and role-based access control. One Identity Active Roles is designed to reduce manual IT administration by turning repetitive identity tasks into policy-driven and workflow-based automation.

Fine-grained permission control in One Identity Active Roles has been a key part of implementing least privilege access in our environment. We use it to define very specific permissions at a granular level, such as allowing the help desk team to reset passwords and unlock access only within their assigned organizational units, restricting group management rights so that users can only modify specific security or distribution groups, and limiting attribute-level changes. The impact on least-privilege implementation has been reduced over-privileged accounts, a strong security posture, clear accountability, better compliance alignment, and operational efficiency without risk trade-offs.

I rate this review an eight overall.