What is our primary use case?
We use it for identity management and governance. We are a large financial institution; therefore, we use it for identity management and all the cases surrounding that, such as segregation of duty, attestation, extensive provisioning, and life cycle management.
How has it helped my organization?
The largest improvement we have seen is the depth of how many applications we have covered. We have about 4,000 applications connected to One Identity Manager, fully managed from there. That has definitely grown over the years, including the ease of connecting those applications. In the end, what we want to achieve as an organization is not a nice technical solution, but our goals are being in control of our accounts, being in control of our entitlements, and being in control of what entitlements are assigned to whom and why, and proper substantiation for that. To be able to achieve that, we need to have a large range of applications that we actually manage. That is something that has become easier and grown over the years. I would say this is the biggest improvement. Moreover, better processes have been introduced surrounding the data so that we do not just connect the applications, but at a data level, we actually achieve the control we want by ensuring everything in those applications is monitored and kept in control.
The SAP integration goes in-depth into the SAP tool, enabling us to get all the information we want from there. It connects SAP accounts to employee identities under governance, which is very important. It saves licensing costs by cleaning up and ensuring SAP accounts are associated with actual employees. We want a SAP account associated with one person.
It provides IGA for the difficult-to-manage aspects of SAP, such as T Codes, profiles, and rules. It provides profiles, profile limits, and field values.
It offers a single platform for enterprise-level administration and governance of users, data, and privileged accounts. It is very good, especially when you are looking at the enterprise backend. On the platform side, it is very good. However, the frontend usability, at least for our organization, could still be improved a little bit. That is not so much for the admin perspective; that is for the actual end-users in our enterprise. That is partially also due to the fact that we are still using some of the older portals because we have been using the tool for a while, and we have not had a chance to migrate to all the latest versions. It is very good for enterprise management, but our end-user experience could still use some fine-tuning, tweaking, and improvements.
We can easily customize the solution for our needs.
We use the solution's business roles to map company structures for dynamic application purposes. That is very important for us because it is one of the ways where we can remove the complexity for end-users. We can automate things while still providing a good control framework where we can say we are in control. Being a large enterprise, we have a complicated structure, so we need a good model that allows us to accommodate that complicated structure. With the business roles, we were able to do that.
We use it to extend governance to cloud apps. This extension is important for us because, as a large financial institution, we have to meet a lot of compliance requirements. That does not stop with our on-premise environment; it also applies to our cloud systems, so we need to manage those.
It helps minimize gaps in governance coverage among test, dev, and production servers. We also have a lot of our dev, test, and acceptance environments connected to the solution. It allows us to manage those as well based on the production user's life cycle. We have no issues there.
It helps consolidate procurement and licensing a little bit. We do not manage our procurement or licensing in the tool. We have our own procurement tools for that. However, when we know, for example, that there are limits to the amount of licenses we can give out, we use the tool to ensure we do not pass those limits. We use it more as an enforcement tool or safety valve to ensure we follow the guidelines set by procurement on how much we can do.
It streamlines application access decisions, application compliance, and application auditing. We use the segregation of duty framework. We use the attestation framework. It is one of the core pillars for the regulatory and compliance set where we show we are in control of our identities, accounts, and the access they have. We can show that we meet all the regulations in regular reviewing that ensure that no toxic combinations or toxic pairs are assigned.
It helps achieve an identity-centric zero-trust model. We are currently using it for one body, and we are looking into extending it to machine identities. For our current human employees, we are in the identity-centric model. We also have multiple sources from where identities come. We have a lot of subsidiary companies. We have a lot of statements of work or external contractors, and sometimes people come in from multiple sources at the same time. It also allows us to consolidate that to see that it is actually the same identity.
It helps create a privileged governance stance to close the security gap between privileged users and standard users. For the management of privileged accounts, we use another solution called CyberArk Privileged Access Management, and we do have a close automated connection between One Identity and CyberArk where we use One Identity to decide who should have access to which privileged accounts and why. CyberArk is a tool that we use to actually hand out access to those accounts and monitor usage of those accounts, etc. The governance part of who can use which account is managed from One Identity, and then the actual usage is done through CyberArk, and that integration works well for us.
What is most valuable?
What I like the most is the flexibility or configurability. It is not like you are writing huge lines of code. It allows us to handle our very complex enterprise use cases, and we have many of those. We have a lot of scenarios where we need to do things internationally or slightly differently per country, or need to comply with specific regulations. It gives us a lot of flexibility to meet all those needs while also being able to accommodate our enterprise processes. It allows us to shift the tool to work for us instead of needing to change the organization to follow a piece of technology.
What needs improvement?
Their support could be enhanced.
There is an area for improvement when it comes to intuitiveness. It has the ability to manage everything and does that fairly well, but that also causes a risk of drowning end-users in complexity. One Identity technology probably has the best way to handle the complexity that you want to tackle as a large enterprise. It can handle any complex use case you can think of, but that is also the thing they should improve on. They should keep it simpler for end-users, even though they are handling that complexity. They should handle all the complexity, but keep it simple for the end users, so the part they need to improve on is keeping it simple for the end users.
For how long have I used the solution?
I have been using it in some way, shape, or form for 14 years. At my current place of employment, we have been using it for 8 years.
What do I think about the stability of the solution?
I would rate the stability a nine out of ten.
What do I think about the scalability of the solution?
I would rate its scalability an eight out of ten.
In terms of the number of users, there are two sides. The number of people who request access would be about 50,000, and there are about 300 or 400 people who do specialized things. That ranges from the actual technical team supporting the solution to people doing more complex business role management and things like that for their pillars within the organization.
How are customer service and support?
We use their premier support. That has differed over the eight years. At the start, it certainly did add a lot of value. At a certain point, about one and a half years ago, One Identity underwent some reorganizations and their support level went down and was not up to our expectations anymore. We have had some serious conversations with them about that. They reacted well because support has picked up back to where we expected it to be. The advantage for us with premier support is that, as a large enterprise, we can always run into specific problems, and, at that point, someone who knows all the ins and outs of the product looks at it and helps us resolve those.
Premier Support has not been an influence in purchasing additional licenses or products from the vendor. However, it has definitely been an influence in using the product for this long and not switching to a competitor.
About two years ago, I would have rated their support a nine out of ten. Given the issues we have had, I would rate it a seven out of ten, hoping it will climb back up to that nine.
How would you rate customer service and support?
How was the initial setup?
We have a hybrid deployment model. Technical deployment or technical setup is very straightforward. Integrating it into your entire landscape when it is as big as ours and managing everything is obviously complex. I do not believe that is necessarily due to technology; that is due to the sheer volume of data and applications you need to connect.
From starting the setup to the full global rollout, it took about two years.
It does require maintenance. It primarily includes the occasional cumulative update packs being deployed. The second thing is that we have a constantly changing environment. New applications come in, and other applications are deprecated. We acquire companies. We spin companies off. They are, on the one hand, business-as-usual cases. On the other hand, they do require changes in the system. When you are, for example, suddenly onboarding 5,000 new people because you have acquired a new organization or need to integrate another directory service, then obviously that has some impact.
What about the implementation team?
Our partner is Intragen. Our partner was originally AspisID, and they were acquired by Intragen during the eight-year period.
They helped with the implementation, although it was company-led. We led the implementation, and they provided expert resources. They definitely helped with the speed of the implementation. Some of the things they implemented were good for the initial implementation, but over the eight-year period, it has had some rework, which is not surprising.
We got the training from One Identity themselves which was good. Our partner provided on-the-job training but did not provide specific, in-depth training like a specialized training course or anything.
Our partner was involved in helping us customize the solution for our particular needs. Our experience on the whole was positive. Especially on some very detailed use cases, some choices were made which were good in the short term. In the long term, we have had to revisit them. What we are really happy with is that all the customizations they have done have proven to be very upgradable. Customizations that were done seven or eight years ago are still able to work in the current versions of the product. The customizations were done fairly well within the One Identity framework, but for the specific banking use cases, we are currently revisiting some of those.
The customer service we received from our partner has been very good. They have provided good value. They have definitely helped us move forward. They were originally AspisID and were acquired by Intragen. We have the advantage that they have local people, which always makes for a good collaboration. Their nearshore team integrates fairly well into our organization. They do their best to help bridge the cultural gaps. Due to the way they work with the nearshore team, they have been able to provide the resources we want, which we found to be tricky in the past with the IAM market.
What was our ROI?
That is a tricky estimate to give. Our primary reason for having the tool is not just a return on investment; without technology like this, we do not see a good way to meet our mandatory compliance requirements. Having a technology like this, whether it is One Identity or another, is almost a given to be able to keep a banking license when you are at our scale. Without it, we would need thousands of additional people. That is hard to translate into a return on investment, other than as a multiple of hundreds. That is just not the way you would tackle that problem.
What's my experience with pricing, setup cost, and licensing?
I am aware of the cost. For us, it is quite cost-efficient. We have a good enterprise license agreement, and we are very happy with what we get for the price we pay for it.
Which other solutions did I evaluate?
I would compare One Identity Manager fairly favorably to other vendors on the market for identity management governance. We have recently done another RFP and decided to extend our contract, primarily because we have a lot of complex use cases, and the fact that the tool can tackle those fairly well is important for us.
What other advice do I have?
I would recommend One Identity Manager to other users, but I would ask questions like, 'What are the users? How big are they?' For other enterprise organizations, I would definitely recommend it. For smaller organizations, like mid-size businesses with a few hundred employees, I would only recommend it if they are in a heavily regulated space.
I would rate One Identity Manager a nine out of ten.
Disclosure: PeerSpot contacted the reviewer to collect the review and to validate authenticity. The reviewer was referred by the vendor, but the review is not subject to editing or approval by the vendor.
