Symantec Identity Governance and Administration Reviews

We are using CA Identity Management product to provide an identity management service for the largest in the retail industry.

Performance is good, but the other side, the drawback with the CA Identity Manager is they don't have a connector to HR systems like SAP, or PeopleSoft, or Workday. That's a major drawback with the CA Identity Manager. For that we have to do lots of custom quoting to get data from HR systems.

The solution in which we have brought in CA Identity Manager, it is like combining multiple HR sources. It helps reduce thousands of hours of work.

Policy Xpress.

It needs to be connected to major HR systems. That is a major thing. And if they can connect it to GRC systems, that's good to have in an identity product.

Stability is very good. We have been using it the last three years. I haven't seen any issues.

I would evaluate them at five out of five. Every tech support guy who works at CA is good. I don't have any issues.

It was straightforward. Even when you're installing dependent software, like a database or something else, I consider it it straightforward.

When we are choosing a vendor we will go for whether they have the capability to connect to the target system. The basic feature would be connectivity. If the product doesn't have the capability to connect to that system, we will need to do something else to get or push this information to that system. Connectivity is the main thing.

I'd rate it seven out of 10. Those connectivity issues are the only reasons. Functionality-wise, it's good. The features that they have are good.

It has improved our user management. It is definitely streamlined.

Writing policies and provisioning are easy.

Policy writing and provisioning are easy, but should be improved. Provisioning has a dependency on Windows.

No, we have not.

No, we have not.

 I would say they are good, but there is always room to improve.

Yes, custom codes. It was not as reliable as CA Identity Manager.

It was complex with lots of requirements.

It is expensive, same as the other tools in the market.

I prefer Oracle Identity Manager, which is more stable. 

Get the latest version and good architecture before implementing the solution.

Managing identities at a financial services institution.

We're implementing it currently, so I have no real measure of how it's going to perform, but so far so good.

• Streamlines user access
• Consolidates applications
• Access in one place

User access control.

Customer reporting. One of the big things we had asked for is for the Identity tool to actually do more kinds of reporting for audit purposes. It doesn't really track any of the metrics that are useful to us, at this point.

Can't comment yet. Not up.

I've used Identity Manager before for a different client. The scalability is good.

Tech support is very good. We actually have a CA team onsite.

The client is using different solutions for different things. So they have instances of a number of different tools that have the same functionalities as CA, but for different items. So yes, they did have other solutions as well.

Most of the complexities are because of the business itself and the complexities that they have within their current infrastructure. The complexities are not really coming from CA's product.

I was not there when they made this selection. I'm sure they evaluated the normal ones, SailPoint, CA, Oracle.

It's early but so far I give it a seven out of 10. Most of the issues we've had with it are coming from business complexity rather than the product itself. The support's been good from CA.

In terms of advice to a colleague who is looking for a similar solution, that's difficult because I've done SalePoint and CA. It's up to them. It's based on the organization itself, so they have to do more evaluation than what I can provide for them. I'd recommend they do their research and pick what's best for them, but I'd say we have no problems with CA's software.

Provisioning. It has performed well.

It has been good to keep zero day. We have almost zero day provisioning, where the user shows up on the first day of work and he has the necessary access, birthright roles, and such. Therefore, there has been good, internal performance improvement and user experience.

It has good endpoint support and endpoint connectivity to different versioning endpoints.

Identity Manager has a lack of entitlement support, unlike other products that I have worked with. Other products have a focus on the entitlement that a user has, where you can pick and choose access as an entitlement, and add it to the user or remove from the user. With CA it is all role-based, that is kind of a sticking point with me, so we have to work around that.

It is pretty good. Relatively stable. We have definitely had some downtime, but overall it is good.

We just have a two node cluster, so we have not really scaled. However, I imagine it is easy enough to scale those nodes, so it is scalable since it is a clustered app.

Technical support is great.

The initial setup was very complex. The product is just basically a conglomerate of a bunch of other products that were bought and pieced together. So it is still my one main gripe of Identity Manager. It is too many moving pieces; too many parts that were kind of stuck together. It makes it very complex. 10 servers and 10 different apps running to make it happen, and it is only getting worse now that Identity Plural is on top, which is supposed to be making it better, but we will cross that bridge sometime next year.

This product is the main application for governance to identity and coordinate the application for a business process, improve the compliance certification, and have better risk management.

• Governance
• Identity

This product has helped us to have better rules for the application and grow the business process. We can then implement these rules in the product to have automated contracts. 

We would like to see integration with analytics. Also, for them to be more efficient regarding discovering and implementing new rules.

It is too soon to rate them as we are currently working with them for our implementation.

Manage access certifications for whole company in one place.

We used this product to identify and certify basic access profiles in our company. Created more than 6000 role-based profiles for more than 26,000 colleagues. Profiles can be granted to a user when he starts to work in the company or changes departments and/or functions.

Yes, we found that if you create a certification with a high number of objects, the portal runs slowly. We are working with CA to manage this situation.

Two years.

As noted above, we found that if you create a certification with a high number of objects, the portal runs slowly. We are working with CA to manage this situation.

No.

Always available.

No, this is the first product of its kind for us.

It was not complex. CA and a partner worked with us on the setup.

Our company has a long list of CA products, so the pricing is good for us, given the size of our company. The product was licensed by installation.

Yes, Oracle IAM.

Choose a CA partner who is experienced in implementing this product and establish all Access Manager rules before you start operating the product. The product gives you a a nice overview but it's a good idea to define basic rules to create access profiles and certification.

The most valuable features to us are:

• Provisioning engine (on the back-end, separate from front-end components, that's part of layered architecture);
• Access-request system (to manage on- and off-boarding of users); and
• Mobile interface (ability to manage workflows and user requests from smartphone).

Through the centralization and automation of access management functions, and providing a baseline for identity and security analytics, we've improved our security.

I think CA Identity Manager could improve in the following areas:

• Usability

• Stability
• It's complex
• The reporting functions

I've been using it since 2011 as Identity Manager (before: CA eTrust Admin).

We had multiple failures with Linux-based installers hindering deployment process on Linux platform.

No major issues with deployment on Windows.

Multiple issues with stability of the provisioning servers.

No issues encountered.

7/10

5/10

CA eTrust Admin 8.x had been upgraded to CA Identity Manager 12.5 SP9.

Initial setup was complex due to multiple inter-dependencies and high diversity of infrastructure components.

Initially implemented through the vendor team, following upgrades with an in-house team.

The level of expertise delivered by the consultancy firm was high, however it has decreased significantly in the past two years.

Pricing and licensing models are adequate and reasonable.

Identity Manager solutions from Oracle, SailPoint, IBM and RSA/EMC. The products from the mentioned vendors generally seem more competitive than today’s offering from CA.

Run PoC with as close to production deployment as possible; pay attention to TCO and ROI after including provisioning costs on support services for implementation and maintenance as well as required design of reports and business processes and UIs.

Automated provisioning removes manual labor and manual provisioning.

Automation is the best way it's improved the way we function because we don't have to perform manual work over identity-related controls.

A better information display for the approvals within the workflow would give them more information and the ability to comment back on a request as to why they're rejecting it. We've been telling them we'd like this improvement, and we hope to see it.

We have challenges because of the customization – it's difficult to do upgrades. We're just not doing the upgrade because we are a few versions behind, so now it's tough.

Performance is a challenge just in terms of the number of roles and endpoints that we're managing. We have 10 platforms that we manage and over 8000 endpoints – that’s our challenge.

We have challenges because of the customization. It's difficult to do upgrades. We are a few versions behind so doing the upgrade is tough.

When we've used them, they've been good.

It was set up in 2005 prior to when I joined the company.

We always look at the stability and the amount of endpoints and attributes that can be included, plus the ease of use. Make sure that it can accurately serve your needs, especially from an endpoint point-of-view. You need all your users to be able to use it seamlessly without scalability issues.

It loses points on the upgrade process. We require CA's help each time, and the upgrades, especially with our number of users, has been a challenge.