Symantec Identity Governance and Administration Reviews

This product is the main application for governance to identity and coordinate the application for a business process, improve the compliance certification, and have better risk management.

• Governance
• Identity

This product has helped us to have better rules for the application and grow the business process. We can then implement these rules in the product to have automated contracts. 

We would like to see integration with analytics. Also, for them to be more efficient regarding discovering and implementing new rules.

It is too soon to rate them as we are currently working with them for our implementation.

Manage access certifications for whole company in one place.

We used this product to identify and certify basic access profiles in our company. Created more than 6000 role-based profiles for more than 26,000 colleagues. Profiles can be granted to a user when he starts to work in the company or changes departments and/or functions.

Yes, we found that if you create a certification with a high number of objects, the portal runs slowly. We are working with CA to manage this situation.

Two years.

As noted above, we found that if you create a certification with a high number of objects, the portal runs slowly. We are working with CA to manage this situation.

No.

Always available.

No, this is the first product of its kind for us.

It was not complex. CA and a partner worked with us on the setup.

Our company has a long list of CA products, so the pricing is good for us, given the size of our company. The product was licensed by installation.

Yes, Oracle IAM.

Choose a CA partner who is experienced in implementing this product and establish all Access Manager rules before you start operating the product. The product gives you a a nice overview but it's a good idea to define basic rules to create access profiles and certification.

The most valuable features to us are:

• Provisioning engine (on the back-end, separate from front-end components, that's part of layered architecture);
• Access-request system (to manage on- and off-boarding of users); and
• Mobile interface (ability to manage workflows and user requests from smartphone).

Through the centralization and automation of access management functions, and providing a baseline for identity and security analytics, we've improved our security.

I think CA Identity Manager could improve in the following areas:

• Usability

• Stability
• It's complex
• The reporting functions

I've been using it since 2011 as Identity Manager (before: CA eTrust Admin).

We had multiple failures with Linux-based installers hindering deployment process on Linux platform.

No major issues with deployment on Windows.

Multiple issues with stability of the provisioning servers.

No issues encountered.

7/10

5/10

CA eTrust Admin 8.x had been upgraded to CA Identity Manager 12.5 SP9.

Initial setup was complex due to multiple inter-dependencies and high diversity of infrastructure components.

Initially implemented through the vendor team, following upgrades with an in-house team.

The level of expertise delivered by the consultancy firm was high, however it has decreased significantly in the past two years.

Pricing and licensing models are adequate and reasonable.

Identity Manager solutions from Oracle, SailPoint, IBM and RSA/EMC. The products from the mentioned vendors generally seem more competitive than today’s offering from CA.

Run PoC with as close to production deployment as possible; pay attention to TCO and ROI after including provisioning costs on support services for implementation and maintenance as well as required design of reports and business processes and UIs.

Automated provisioning removes manual labor and manual provisioning.

Automation is the best way it's improved the way we function because we don't have to perform manual work over identity-related controls.

A better information display for the approvals within the workflow would give them more information and the ability to comment back on a request as to why they're rejecting it. We've been telling them we'd like this improvement, and we hope to see it.

We have challenges because of the customization – it's difficult to do upgrades. We're just not doing the upgrade because we are a few versions behind, so now it's tough.

Performance is a challenge just in terms of the number of roles and endpoints that we're managing. We have 10 platforms that we manage and over 8000 endpoints – that’s our challenge.

We have challenges because of the customization. It's difficult to do upgrades. We are a few versions behind so doing the upgrade is tough.

When we've used them, they've been good.

It was set up in 2005 prior to when I joined the company.

We always look at the stability and the amount of endpoints and attributes that can be included, plus the ease of use. Make sure that it can accurately serve your needs, especially from an endpoint point-of-view. You need all your users to be able to use it seamlessly without scalability issues.

It loses points on the upgrade process. We require CA's help each time, and the upgrades, especially with our number of users, has been a challenge.

The most valuable features are role-based access and identity provisioning, which allow a single point of user access to multiple places.

It’s provided us a single point to create users and then provision them to different sources so that they have access to them without having to login in multiple locations.

It has a large footprint which you'd expect to be much, much smaller. Just to run basic services, we have 10 different servers. Also, if it were easier to manage, that'd be useful.

We had no issues deploying it.

We’ve uncovered some bugs while working in it. CA has -- and still is -- working with us to resolve those issues.

We haven't really had any issues with scalability, but we have an older version of it where we’ve had to customize it to an extent.

Their engineers know our environment very well. We're able to get personal support with specific engineers when we make such a request.

The initial setup is very complex. In fact, it took a while to get through the entire setup and we’re even adding to it now. CA has even been on site to help us.

CA is great to work with, but to use it, just learn the product suites and how the individual products interact. Make sure you have a good layout and you have everything you need.

Connector Xpress and Policy Xpress and the new interface.

I like the new interface. It has the same look and feel across devices, such as browser and mobile.

Reporting could be improved.

5 years.

No.

No.

Eight out of 10.

No.

The latest version is very simple to set up and install with a lot of wizards. It also comes with a new Virtual Appliance which can select the features and be ready to use.

The price is based on the number of users.

No.

The interface of the latest version is very simple to use on both browser and mobile devices.

This is the only IM solution I have come across. Using the implementation guide, I was able to implement the solution with ease. The IM is the most valuable feature to me. I also find the solution's documentation and community valuable.

I find the API boring. I also faced issues while integrating with CA SSO.

I have used this solution for three months.

There is a good level of technical support because the community is a good set of geeks.

The setup was easy because of the friendly product documentation and the community support.

Compared to other options, CA products are not that expensive.

I did not evaluate other options, since this product was just meant for a PoC.

I would not recommend this product to others. There are better products on the market, as I later came to know about Sailpoint, DELL IDM, and NetIQ.

• The xPress technologies (connector xPress/Policy xPress/Config xPress)
• Integration with API Management and other CA solutions
• Facility to publish the web services of any task of Identity Manager
• Ease of integration to leverage authentication processes managed by Identity Manager and called by external applications
• You do not depend on the supplier to change screens and validate field, create notifications, etc.
• True integration between CA Identity Manager and CA Identity Governance for better use of compliance approved roles, data exchange and improved customer experience
• Availability to implement in the cloud
• Take advantage of important features of Identity Manager and Identity Governance on the Portar offered by Identity Suite (best user experience) and less technicall knowlegde need

What about Identity Governance and integration with Identity Manager?
This solution makes a seamless integration, leveraging the power of Identity Manager connectors it import the data obtained to Identity Governance; in the opposite direction, the results campaigns from Governance have the ability to update in automatic way the information in Identity Manager, enabling materialization of privileges changes and fulfilling a RBAC model (It is the business strategy to the lowest level of privileges in applications)

Through the implementation of "Identity Suite Virtual Appliance" have created a supremely quick and convenient way to install (Identity Manager / Governance / Portal) with even high availability. Multiple scenarios available on a single console.

It has increased our automation and maintenance of SLA security functions. Additional compliance of all activity relate to provisioning, self-service, and all critical transaction of security management.

• Security information
• Human resource onboarding/offboarding processes
• All areas in organization that required account functionality in applications of the company

We've been implementing it since 2007, so around seven years.

No issues encountered.

No issues encountered.

No issues encountered.

8/10.

When you open a ticket with priority one, the technical support is excellent - 10/10. However, when the ticket is priority two, three, or four, then it's 7/10.

Did not user previous. But I helped move from a different solution to CA
Identity Manager. Why the change? Because the previous solutions was nor
flexible and was high cost value to adapt.

I did not use the previous solution, however I did assist in the move from it. We changed because the previous solution was not flexible and it had a high cost value to adapt.

The initial setup is not complex. You only need define the right architecture and work on it.

I implement it.

If you analyze the evolution of these type of solutions, there are still uncovered needs and the customers are still identifying needs. The important thing here is the adaptability to integrate and deal with new technologies. The solution integrates with solutions like CA API Management/SSO and others.

Find someone with experience implementing this type of solutions to ensure the success of its implementation.

The valuable features are the speed and the ability to provision all of our employees. I like the usability as well.

I'm happy with the features that are in the current release.

We have IDM integrated with Provisioning, SiteMinder, and CA Directory as our IAM solution. When we embark on an upgrade initiative for one of these components we quickly find that newer versions of IDM are not supported with the other exisiting components. This results in a much larger project to upgrade SiteMinder, IDM, Provisioning, Directory, and the OS which results in Senior management abandoning our upgrade project. I would like to see IDM supported with a larger version footprint in relation to the other required components in our IAM application framework.

The provisioning perspective is very stable. In terms of identity management, the logic is good, but performance could be better.

The tool is not scalable. That is not a limitation from a CA software perspective. The lack of scalability is more a result of how we originally set up the product.

We have used technical support. Overall, we find it very good. For Identity Manager, it is hard to get the right support agent.

I was involved in the installation and it was complex. We were coming from a very old version and we had to upgrade. There was a lot of data migration.

I have many colleagues from different companies and we all tend to lean towards CA products. We are accustomed to using CA.

We only need one pane of glass to see what users have access to, especially privileged accounts.

Once it's in place, it's easy to use. You definitely need insight into how your company provides access to users. Especially if it's going to be role based, which most of it is. It reduces the amount of time needed for analysts to provision users; new accounts, changes, and terms.

I'd like to see the user interface be a little bit better as far as deploying the infrastructure, the back end, but I hear that it's coming.

Most of the troubleshooting workflow is based on logs, so if the logs were consolidated we would need to just look at one particular log for all the servers to figure out what going on.

For example, if you get a fail when provisioning a user, you determine where it fails, and go to the logs to see where specifically the process stopped and what tasks were not completed.

We've had CA Identity Manager for three years now.

Stability needs some work. There are some issues with the back-end infrastructure. We've noticed that in our implementation, a lot of Java memory leaks are recurring. We've gone back and forth trying to discover the cause, and have to restart the systems and clear out the memories every couple weeks or so.

It scales fine. It's one of the better products out there. There is a limit to the amount of provisions you can keep in users accounts and you need to archive some things, but I haven't reached that limit; at least with our users.

We've opened up a few tickets with technical support and we've used our CA third-party consultants as well. They've been very helpful.

We had an in-house solution that was for a subset of our users. It wasn't robust enough to go scale to the entire corporation, so we went through a selection process to find out who's the best out there at the time. We've had CA Identity Manager for three years now, so it was pretty recent.

I was involved in the initial setup and it wasn't complex. The implementation after setup was difficult. The documentation in that area was lacking, but the implementation was as good as it's going to get.

Definitely understand your access base for your user from the business perspective. If you're made up of different companies, get a clear understanding of how those different companies get access to users, so you can make it easier when the roll out comes out and do role-based implementations.