Symantec Identity Governance and Administration Reviews

The range of provisionning possibilities, such as native connectors and tools which facilitate the development of new ones.

• The automatic creation and removal of the accounts
• Passwords change process organized and controlled by the user
• Least priviledge rules applied
• Profiles easy to configure, so less people are needed to administrate the solution
• All processes around user accounts are simplified
• Assets and business modeling improved

CA technologies must improve IHM for a better user-friendly approach.

I've been using the solution for eight years.

Version changes are long and tiresome.

There are issues with the web services.

7/10.

5/10.

No solution was previously in place.

Setup is still complex when you plug a solution in a huge environment. A number of days were necessary to adjust everything.

We used a vendor team who were 8/10.

We only need two people to administrate, maintain and support the solution.

The same price as the other editors with a cost by users, but with additional solutions there is often room for negociation.

• Sailpoint Identity IQ
• Ping Identity
• IBM Tivoli Identity Manager

Stay with the native functions, and don't make too many custom developments.

Our customers find it easy to use.

It provides a user-friendly front-end to manage LDAP-based users.

The interface is modern, but could have been made even easier to use for the customers.

I managed it for approximately three years.

No issues encountered.

No issues encountered.

It's a little bit difficult to support.

It's reasonable. The support is not the quickest to respond and does not have a mature process in terms of what logs must be gathered, and what to gather before raising a case.

CA provided assistance with augmentation of the existing solution, they provided quite a good level of support during the project.

• User-friendly UI
• In built connectors for various endpoints

It's provided a centralized platform to manage the lifecycle of all identities across different endpoint systems such as Active Directory, Salesforce, etc.

It should be better when doing custom connections.

I've used it for one year and two months.

There were very few issues.

At times we had issues with CA Identity Manager tasks getting hung in an "In Progress" state. We had to restart the instances, but that happens very seldom.

No issues encountered.

8/10.

7/10.

No previous solution was in place.

It was complex due to the vast number of identities in the organization.

It was implemented in-house.

It's more than satisfactory.

The ability to customise the screen, and create a technical solution suited to the business requirements including delegation, password management and role based access.

Delegated responsibility across to the customers, instead of the organisation maintaining the user. In addition, this also allows user privacy and security to be maintained.

Multiple areas:

• Bulk Load capability
• Services
• Organisation propagation, etc.

I've used it for the last seven years.

Deployment was stable. Only issue was with the policy express and emails which were very dependent on the exact name instead of a tag.

If the product has been tuned, appropriated, and appropriate memory has been allocated, there are no issues with stability.

No issues encountered.

8/10.

8/10.

No. We moved from a manual user management system to a delegated user management system.

Provided the requirements are set, the initial setup was straightforward. Subsequent functionality within CA IM is not appropriately documented creating issues.

We used a vendor whose level of expertise was 8/10.

Yes, we also considered using Oracle Identity Manager.

Use an agile approach of delivery if the business is not aware of what it wants.

• Group management
• Task delegation
• Access granularity

It allowed local departments to manage the people in their own groups, without any help from the IT department.

Better recovery for the application server with the DB connectivity.

Two years.

Yes, at some point CA support repaired the bug.

Yes, sometimes the connection with the DB is lost, and it isn't fully recovered without restarting the server.

No issues encountered.

7/10.

7/10.

No previous solution used.

I think it depends on your background, but as soon as you understand the terminology it's not so complex.

We did an in-house implementation.

Engineering and operational.

Do a good gathering of your requirements and make sure you are creating the system architecture it in the right way.

The most valuable features of this product are the following:

1. Policy Xpress
   Allows for the ability to build policies triggered off of events in a codeless manner.
2. Separation of Duty (SOD) policies
   Gives the ability to create roles and/or policies with a criteria for removal or addition of a role, policy, or an entitlement based on the user’s title as an example.
3. Connectors
   IDM has a rich set of connectors that covers traditional on premise, SAAS related, or custom resources. IDM provides the ability to create a custom connector through its Connector Xpress module. The module itself allows one to build a connector to any resource that is either LDAP or database driven. Once again this process involves no coding for the task.

I'm an integrator, and as a result I deploy solutions in behalf of an organization. IDM improves the organizations ability to govern the life cycle of an end user. The life cycle starts with the on-boarding of an individual to the organization, whether it’s a contractor, consultant, employee (full or part time), or a partner. The life cycle ends with the departure of the individual from the organization. Everything in between is about managing the user's access, permissions, profile, and evolution from an identity stand point. We (Mycroft) advise and implement the necessary user cases that drives the successful central management of identities for an organization. Plain and simple, IDM provides the automation that allows the IT and respective business department(s) to focus in on other pressing needs while IDM standardizes the identity practice.

The areas of this product which requires improvement are as follows:

1. The User Interface (UI)
   The User Interface has been improving over time and there are products such as IDMLogic Sigma that improves upon the user UI experience.
2. Its delegation model
   While IDM has the capability to delegate, the delegation process is not intuitive or forthcoming to the clients. The delegation model is present but it’s not a straight forward model to design against.

These two areas are the ones that stand out, as I probably developed a tolerance over the years for any other if others do exist.

Eight years.

Yes, but deployment issues are hardly product installations, but rather retro-fitting the installation to the core principals of the organization. Anyone can install the product within a 20 minute window in an ideal scenario. Each organization has environmental complexities and business policies that at times causes issues with the deployment.

No issues with stability.

No issues with scalability. Typically deployments are done with an assumption that an organization will grow by a certain percentage in the foreseeable future. As a result the architecture will adhere to the growth plans accordingly.

Technical support has drastically improved over the years, as a result I would rate them at 7.5 and climbing.

While I implement solutions for organizations, I witness switches for the following reasons:

• Staff are no longer knowledgeable on the solution as a result of staff turnover over time
• Product configuration has not been maintained to support needs of the business over time
• Vendor Support and direction
• Cost model
• The direction of the organization and its relationship with other vendors

In my experience, the posture of the setup has a direct correlation to the use case mapped to the feature set and functionality. There are numerous ways to implement a solution, but the level of complexity stems from the ability to simplify the requirements and work with the business on compromises. All organizations have security and business policies that they mandate by or govern towards. As a result, the initial setup or configuration is a direct by-product of how the use case is socialized into the product. At times, some business processes should not be subjected to IDM at all. unless there are compromises to how the business flow is managed. Understanding this basic idea and product limitations go hand in hand.

The ROI on CA IDM is a result of the following 3 areas:

1. Employee productivity
   Faster onboarding process and provisioning. The ability for end user to perform self-service password resets and utilize an access requests system.
2. IT cost savings
   The ability to focus less on traditional cost areas around password resets, user on-boarding, and essentially the whole user life cycle allows IT to spend on other technical areas wisely. Cost savings to IT is not only how to save but also how to re-purpose the funds to other needed areas.
3. Cost avoidance.
   Potentially recovering from security breaches or violations and the cost to recover from them. Centralized management introduces efficiency that leads to shared resources not redundant work throughout an organization.

Policy Xpress makes modifications to how our user data is handled so easy.

This product has allowed me to take the repetitive tasks away from a person so the value of a person is better.

An out of the box way to control when a policy executes.

Five years.

No, not after someone explained a way to use Screen Logical Attributes to control the execution of policies.

No issues encountered.

No issues encountered.

I love their customer service.

I'd rate them 10/10. I have my go to techs.

We didn't have a solution previously.

Identity managment is a complex animal no matter what product you use.

We used a vendor team who I would rate as 10/10.

Look at training from the vendor not just their perfect scenarios but real world issues. Make sure your users have the skills needed to manage the product.

Extremely good customization possible with respect to local language support.

In our environment we have build separate environments and roles structures based on language and look and feel for their products.

4 years.

Only minor issues.

Sometimes, earlier only due to lack of RAM. Now it's stable most often.

Haven't faced any so far.

8 out of 10.

7 out of 10.

It was a little complex.

No other options evaluated.

Perform a pre-implementation analysis as to what level you would like to implement the solution (only role mapping/provisioning/AD sync etc) and to how it can meet your needs.

The simplicity, easy installation and configuration.

I worked on this product as a consultant implementing it at various client locations so I cannot really answer this question from my own organization's point of view. But the tremendous value at client locations has been a centralized and simplified identity provisioning and management solution.

Been quite a while since I worked on it so I can't really comment on how far the product has come in the past 2-3 years.

For almost 2 years at various engagements

Nothing major encountered.

None encountered.

No. The product gives flexibility with respect to application servers and databases so scalability more depends on the platform you choose.

Very good.

Very good.

Clients I have worked at either didn't have an existing solution or had older versions of the same product.

It is straightforward if you read the product documentation and understand the architecture before your set it up.

The major plus points are simplicity, but do ensure you have the right resources before you implement this product.

• User provisioning
• Web services

Enabled enhanced delegated control to application owners and third party support reducing overhead cost to support desk and directory services teams

GUI/Web interface

10+ years.

Numerous. Despite having a Linux/JBOSS version it does not perform at the same level of proficiency as Windows/.NET.

Yes

No

9 out of 10.

7 out of 10,

Complex, documentation was inadequate as was professional services.

Combination, and experience for professional services was less than adequate.

We evaluated Novell and Oracle as well, and for our needs this was still the best solution.

Be prepared for issues with the web interface and avoid heavy customization.