One Identity Manager Reviews

It is mainly an identity governance tool. It is being used to collect, for example, any new employee records or employee records in general from HR systems, such as Oracle, SAP, and Workday, and then push it downstream for systems such as Active Directory, Exchange, etc. This is the main functionality of it. 

The other functionality for it is to have a request platform, such as a web portal, for requests for access, approval, and user-based grants and reviews.

It helps the organization to simplify its control over enterprise access and makes the new joiner's process easier. In a small organization with 40 to 50 users, it is not a big deal. You can have one IT guy who is responsible for creating an email account, Active Directory account, Azure account, etc. It will take him one or two days to do it, but in a big corporation with more than 500 employees in different time zones, doing that is a big challenge. One Identity, and IGA products in general, excel at onboarding and offboarding employees with the linking and synchronization with the HR system. This is what they are best at. They remove the complexity because you have your Active Directory created, updated, and disabled on time, and there is no issue with that.

There is one fabric for identity lifecycle management, and the access is based on that identity lifecycle management. This is applicable to the whole market for identity governance. It is not just One Identity. You have SailPoint, Saviynt, and others. All of them are good in this aspect. They do improve the organization like that.

We can customize it to integrate with any system or application, and we can go deeper in analyzing people's access, creating roles, dynamic roles, and RBAC. They have a very strong RBAC offering, which is a role-based access model offering. If you structure it right, you can do an RBAC with One Identity. I use it for two customers. One is in the Middle East and one is in Europe. I represent the client side, and mostly I see a robust onboarding and offboarding operation with this product. It is very good for both experiences. It is a very structured way of doing things. Movements across the departments and things like that can be handled. It is quite customizable. It is quite good.

When it comes to intuitiveness, the clients using IT Shop people are complaining. I have had a client in the Middle East, and then I have had a client in Europe. They all say that IT Shop is not intuitive. It is the same feedback. One Identity is trying to make it better with Angular, but there is a fifty-fifty split. One aspect is how the vendor has designed the portal and the other aspect is how you structure the request and approval process. We are as guilty as the vendor. The vendor has a bad portal, but most of us also have a bad way of thinking as clients. People are not advised well because the adoption and the usage should be driven by the vendor. Instead of doing that, the vendor is just selling. If you talk to a partner, they might advise you, but if you have the wrong partner, you are in trouble. So, people complain about the intuitiveness of the portal, but they are confused because the process is being showcased in a very bad way.

To customize IT Shop, they had a strange tool called Web Designer. It is one of the seven tools or seven clients they had. It was not easy to find anyone worldwide who knew how to handle it. You can find developers who have One Identity skill set, but only one out of ten of them would know how to handle the designer tool. In case you need to customize, it was a tough journey. That is why One Identity flipped the narrative by saying that they are going with Angular. We need to run Angular, and they have the REST API. I told them that this is a bad approach because they are assuming that clients have Angular developers, but some clients or some small clients do not have Angular developers. Some clients might have Angular developers but they are assigned to all business units. They are asking us to start hiring an Angular developer or rely on a partner, but is their partner certified to do Angular or not? To me, they did this conversion without any proper thinking or from a very narrow perspective.

I do not have complaints about the backend of this tool. Frontend is a major issue. Their roadmap has no consideration for the clients. In the CAB meetings, I have seen how they manage relationships in general. The company mindset is a bit strange. They look at big clients for feedback and opinions, but they do not look at small and medium businesses. They do not care about hearing us, but when it comes to big companies, you see their engineering team circling around them. They have this cultural problem in the company. They are not only selling the products to just a few big companies worldwide. They are selling it to everyone, but there is a lack of inclusiveness. They assume that all the clients have the same technical skill sets to operate this tool, but that is not true. There is an issue with their roadmap and way of thinking. I have also provided this feedback to the head of the company, Mark Logan, during a cab meeting. I told him that they need to fix how they collect feedback and maintain customer relationships.

We use business roles to map company structures for dynamic application provisioning. It is very good for that. It works very well. If you implement it right and you are advised very well, it can be magic. It can make people very happy about the tool in the company, which was the case when I was working in the Middle East for my first employer. If you do it wrong or are not advised well about it, it can lead to disaster, which is the case with my new employer where I have been working for two years. We have reached a point where we have 50 roles with the same entitlements, and people do not know which one is which. It is not the fault of the tool. The lack of advice on how to structure and design it well can lead to issues. It is not a technical issue. From a technical perspective, it is very flexible. It can do whatever you want. Partner implementation is the main issue.

It can help minimize gaps in governance coverage among test, dev, and production servers, but I have not seen it in practice. Some people do it where you can connect One Identity to One Identity Manager with a direct connection. You can have that. That is one option. The second option is something called transport packages, so it has a good change management label and transport package solution. They have a partner called Intragen, which is a Dutch partner, that created a new product called Deployment Manager. That product does the release management process and testing for CI/CD to a very good level and in an automated fashion. You can buy a product like that and hook it up to One Identity. The tool has the framework to handle this. It is okay in that sense. From a change management and release management perspective, the product has principles. It is not lacking there, but it needs modernization for complete CI/CD.

It is very good at helping you streamline application compliance and application auditing if you know how to integrate applications. Most IAM programs or projects focus on users and users in groups, but handling single entitlements or a cluster of entitlements is a different board game. However, I cannot say that it is a One Identity problem. One Identity is customizable, and it is equipped to do that. You can do that. It is an investment issue rather than a One Identity issue.

We use it for identity management and governance. We are a large financial institution; therefore, we use it for identity management and all the cases surrounding that, such as segregation of duty, attestation, extensive provisioning, and life cycle management.

The largest improvement we have seen is the depth of how many applications we have covered. We have about 4,000 applications connected to One Identity Manager, fully managed from there. That has definitely grown over the years, including the ease of connecting those applications. In the end, what we want to achieve as an organization is not a nice technical solution, but our goals are being in control of our accounts, being in control of our entitlements, and being in control of what entitlements are assigned to whom and why, and proper substantiation for that. To be able to achieve that, we need to have a large range of applications that we actually manage. That is something that has become easier and grown over the years. I would say this is the biggest improvement. Moreover, better processes have been introduced surrounding the data so that we do not just connect the applications, but at a data level, we actually achieve the control we want by ensuring everything in those applications is monitored and kept in control.

The SAP integration goes in-depth into the SAP tool, enabling us to get all the information we want from there. It connects SAP accounts to employee identities under governance, which is very important. It saves licensing costs by cleaning up and ensuring SAP accounts are associated with actual employees. We want a SAP account associated with one person.

It provides IGA for the difficult-to-manage aspects of SAP, such as T Codes, profiles, and rules. It provides profiles, profile limits, and field values.

It offers a single platform for enterprise-level administration and governance of users, data, and privileged accounts. It is very good, especially when you are looking at the enterprise backend. On the platform side, it is very good. However, the frontend usability, at least for our organization, could still be improved a little bit. That is not so much for the admin perspective; that is for the actual end-users in our enterprise. That is partially also due to the fact that we are still using some of the older portals because we have been using the tool for a while, and we have not had a chance to migrate to all the latest versions. It is very good for enterprise management, but our end-user experience could still use some fine-tuning, tweaking, and improvements.

We can easily customize the solution for our needs.

We use the solution's business roles to map company structures for dynamic application purposes. That is very important for us because it is one of the ways where we can remove the complexity for end-users. We can automate things while still providing a good control framework where we can say we are in control. Being a large enterprise, we have a complicated structure, so we need a good model that allows us to accommodate that complicated structure. With the business roles, we were able to do that.

We use it to extend governance to cloud apps. This extension is important for us because, as a large financial institution, we have to meet a lot of compliance requirements. That does not stop with our on-premise environment; it also applies to our cloud systems, so we need to manage those.

It helps minimize gaps in governance coverage among test, dev, and production servers. We also have a lot of our dev, test, and acceptance environments connected to the solution. It allows us to manage those as well based on the production user's life cycle. We have no issues there.

It helps consolidate procurement and licensing a little bit. We do not manage our procurement or licensing in the tool. We have our own procurement tools for that. However, when we know, for example, that there are limits to the amount of licenses we can give out, we use the tool to ensure we do not pass those limits. We use it more as an enforcement tool or safety valve to ensure we follow the guidelines set by procurement on how much we can do.

It streamlines application access decisions, application compliance, and application auditing. We use the segregation of duty framework. We use the attestation framework. It is one of the core pillars for the regulatory and compliance set where we show we are in control of our identities, accounts, and the access they have. We can show that we meet all the regulations in regular reviewing that ensure that no toxic combinations or toxic pairs are assigned.

It helps achieve an identity-centric zero-trust model. We are currently using it for one body, and we are looking into extending it to machine identities. For our current human employees, we are in the identity-centric model. We also have multiple sources from where identities come. We have a lot of subsidiary companies. We have a lot of statements of work or external contractors, and sometimes people come in from multiple sources at the same time. It also allows us to consolidate that to see that it is actually the same identity.

It helps create a privileged governance stance to close the security gap between privileged users and standard users. For the management of privileged accounts, we use another solution called CyberArk Privileged Access Management, and we do have a close automated connection between One Identity and CyberArk where we use One Identity to decide who should have access to which privileged accounts and why. CyberArk is a tool that we use to actually hand out access to those accounts and monitor usage of those accounts, etc. The governance part of who can use which account is managed from One Identity, and then the actual usage is done through CyberArk, and that integration works well for us.

One Identity Manager streamlines our entire identity lifecycle management. It handles onboarding new joiners, assigning and controlling roles with role-based access control, and automates user access reviews twice a year. Additionally, the system facilitates reporting for audits, providing auditors with necessary information on demand. This centralized system acts as a one-stop shop, managing everything from onboarding and role assignment to offboarding and emergency access control.

With centralized user management, data is effortlessly pulled from various systems like SOAR and HR, simplifying user creation and data maintenance. This allows for easy user editing, role assignment based on HR attributes or department affiliation, and streamlined account allocation based on review levels, departments, or the entire organizational structure.

Our Access Control in One Identity Manager is 99 percent automated saving us nearly 100 percent of our time.

One Identity Manager simplifies SAP administration by providing a centralized view of even logically disconnected SAP accounts. It offers a flexible helpdesk approach. We can either leverage its built-in model or create our own UI accessible to specific teams based on their applications. This ensures each team sees only relevant tickets for their area, streamlining access management for disconnected applications.

One Identity Manager can connect SAP accounts to employee identities under governance.

One Identity Manager simplifies Identity Governance and Administration for SAP, a complex system to manage in this regard. It empowers us to effectively manage SAP profiles, roles, and groups, ensuring their proper assignment to corresponding SAP accounts.

The solution delivers SAP-specialized workflows and business logic.

One Identity Manager integrates with its Privilege Access Management solution to provide more granular control. This means we can define different account types within One Identity Manager, such as normal, admin, and privileged accounts. By assigning privileged access only to designated accounts, we can restrict access and permissions and enhance overall security control.

One Identity Manager offers a user-friendly experience with an intuitive interface. It even provides a webshop for end users, allowing them to easily request new roles or accounts in various systems with a simple two-click process.

Having the right resources makes customization a breeze. While understanding customer needs and translating them into technical specifications requires some processing upfront, One Identity's suite of tools simplifies the actual back-end work. From drag-and-drop interfaces for workflows and reports to scripting and C# coding supported by existing SDKs, customization options cater to all users.

This dynamic application provisioning solution uses business roles to map our company's organizational structure. In other words, access to applications is determined solely by our assigned role within the company hierarchy. This role-based approach ensures users only receive the permissions they need based on their specific function, preventing unnecessary access.

One Identity Manager streamlines our cloud governance by providing a centralized platform to manage user access permissions across all connected cloud applications. This eliminates the need for individual provisioning for each app, ensuring efficient authorization control.

We have significantly improved our compliance posture with One Identity Manager. Previously, auditors identified numerous findings during manual audits, requiring extensive time and resources to address. With One Identity Manager, we've automated the onboarding, offboarding, and joiner processes, achieving a 95 percent closure rate on audit points. This centralized solution streamlines the auditor experience, allowing them to efficiently obtain information from the IAM team, saving both the organization and auditors valuable time.

We have minimized inconsistencies in how our governance policies are applied across test, development, and production environments.

One Identity Manager helps us create a privileged governance stance to close the security gap between privileged users and standard users by managing those accounts separately. This segregation prevents unauthorized access, as standard accounts cannot hold privileged rights and vice versa. This clear separation helps to close the security gap between these user types.

One Identity Manager streamlines our procurement and licensing processes, allowing our initially large operations team to focus on more strategic tasks. By automating license management for connected applications like SAP and Azure Active Directory, the solution eliminates the risk of human error – forgotten access removals for unused licenses are a thing of the past. Now, licenses are automatically assigned and reclaimed based on user activity, ensuring efficient resource allocation. This means new hires receive immediate access, and vacated licenses become readily available, freeing the operations team from manual license management headaches.

One Identity Manager streamlines application access decisions by automating the provisioning and de-provisioning of user access based on HR data. This eliminates manual intervention and delays for both HR and department personnel. When an employee changes departments, their access permissions are automatically updated in the identity management system, granting them the necessary tools to perform their new duties immediately.

It also streamlines the automation of identity and access controls, making it easier to implement a zero-trust security model where every user and device is verified before granting access.

While our audit processes were once cumbersome, requiring auditors to chase down reports from individual SAP administrators, everything is now centralized. One Identity Manager stores all application and database information in a single location, streamlining reconciliation efforts.

The primary use case is the JML role-based access provisioning and access re-certification.

We don't use the solution exactly for SAP, but for provisioning and reconciliation. We manage an integrated environment. We use SAP as one of our information sources. Although SAP is one of our trusted sources, it is not an authorized source.

One Identity Manager connects SAP accounts to employee identities under governance which is important for our organization.

The solution delivers SAP-specialized workflows and business logic. The good part is the customization; whatever way we customize the solution, the product is superb. But at the same time, complexity can be difficult because if we do a lot of customization, it's not easy for the new team to think exactly the same way as someone who has implemented the solution. 

We use the solution's business roles to map company structures for dynamic application provisioning.

We use the solution to extend governance to cloud apps. I don't have real-time experience with One Identity Manager Cloud One. I believe the solution extends governance to cloud apps because some of our cloud-based target systems are currently integrated, including Azure. I don't see any challenges, and One Identity Manager seems to be functioning smoothly.

The solution has improved the way our organization functions. In the latest version, some of the basic challenges and bugs have been improved. One Identity Manager is definitely one of the most robust enterprise identity manager platforms. One of the advantages is the cost-effectiveness of the solution. The solution is also a light-based application, has easy-to-manage infrastructure, and an easy-to-use UI. The reporting features and auditing features are all up to the mark. There are no issues, no security concerns, or risks. The risk handling is up to par, with features like managing privileged systems and accounts. This makes it a safe and reliable choice for businesses.

The solution helps us minimize gaps in governance coverage among testing, development, and production servers. One Identity Manager provides a number of out-of-the-box tools to help migrate the solution from one environment to another. This makes it easy to transport our package from the development environment to the testing environment to the production environment.

It helped us create a privileged governance stance to close the security gap between privileged users and standard users. One Identity Manager is a data-based application that provides a large scope compared to other IGA products such as SailPoint and Saviynt. The solution separates the identifier between the privilege and standard account as well as access certification, auditing, and reporting.

One Identity Manager is compliant with our business requirements regarding procurement and licensing consolidation.

The solution helps streamline application governance and application access decision compliance. One of the benefits of using the solution to certify privileged accounts and users is that it minimizes risk. This is done by applying proper governance, which is something that is needed in any organization.

The solution helps enable application owners or line of business managers to make application governance decisions without IT.

One Identity Manager helped us to achieve an identity-centric zero-trust model through risk minimization and segregation of duties.

We have Premier support services. If there's any product work or product limitation based on the requirements or any new challenges that come up, we can access the Premier support services, but we need to opt in.

Premier support has added value to our overall investment. We have a weekly follow-up call with their support team.

Having Premier support has influenced us to purchase additional licenses and products from the vendor. We also use Password Manager.

I am a consultant for One Identity Manager and implement it for clients. They use it for ordering permissions, attestation of permissions, and reporting on permissions.

Customers use One Identity Manager to manage SAP. SAP integration is very important because clients have critical business processes in SAP systems. Governance of SAP users and permissions is important.

One Identity Manager is a good solution for providing a single platform for enterprise-level administration and governance of users, data, and privileged accounts. You have a view of all the users, permissions, and connected systems, and you can have a whole range of connected systems such as Active Directory, SAP, Entra ID, Exchange Online and others. You can import identities from HR systems or create them manually and join them with their accounts and permission. It gives you a view of the permissions and roles people have in different target systems. You can combine that with roles that are automatically populated through inheritance. You can also combine it with attestation so that you have an approval process for those rights. You can basically check that they are not assigned forever or when not needed.

Customers use One Identity Manager's business roles to assign permissions based on membership in organizational structures, such as departments, locations, job functions. This functionality is very important because you can model your business as a hierarchy and inherit permissions and accounts along with this hierarchy. It is a good solution to assign permissions automatically. For example, if you have different locations for your business, you can model those locations in the business roles and assign people to those roles automatically through HR import. That makes life easy and gives you a graphical view of that structure in One Identity Manager. For people who are not too technical, it makes it easy to understand how permissions are inherited.

It gives an overview of licenses. For example, in One Identity Manager, you can have an overview of Office 365 licenses being used. Apart from that, you can see how many and which accounts are being used, but it is not a license management tool.

Attestations help you determine if someone should have a certain permission or not. You can also have recurring attestation where, for example, a manager can decide if certain permissions are needed for certain people. For compliance, you can implement segregation of duties where you can specify that if you have permission A, the users cannot have permission B.

For auditing, you can see the permissions and the accounts people have, but it is a view from a certain point in time. There might be some gaps or synchronization delays between One Identity Manager and the target system, such as SAP. For auditing or a tracing without any gaps, you need tools that monitor permissions in those systems in real-time, similar to Change Auditor from Quest.

It helps to create a privileged governance stance to close the security gap between privileged users and standard users. You can have different types of identities. You can have a person with a non-privileged identity and also a privileged identity. It helps to separate those, but at the same time, you can see what kind of permissions a person has in total. You have a view of both the non-privileged and privileged identities.

The overall purpose for using this product is for identity management, which is our core requirement.

We adjusted the number of authorizations given to a person. Before, it used to just collect and collect under people. Now, we can adjust and remove authorizations so they don't just stack up. It's reduced the number of authorizations assigned. 

The workflow has improved from request to assignment. We've been able to accelerate the speed significantly. 

I used it in my last organization. We wanted to publish the applications present in the Oracle Database on the IAM portal. We used One Identity Manager to publish the apps on the portal so that end users could access product policies and workflows from this website. This included handling approvals, user workflows, SOD violations, SOX compliance, and other aspects.

We had users from Germany who wanted an SAP system accessible through One Identity. To integrate, we simply followed documentation from the SAP team and One Identity's website. 

One Identity Manager connects SAP accounts to employee identities under governance. For end users, logging into SAP systems is simplified as authentication is needed only once if SAP is linked with Active Directory accounts. 

We used the solution’s business roles to map company structures for dynamic application provisioning. For the Oracle EBS application, we used to have hundreds of business roles. A user used to get assigned roles automatically based on the team joined.

We utilize One Identity Manager for several key processes. Primarily, it manages the entire employee lifecycle, including joiners, movers, and leavers, for identity management. Additionally, we use its attestation module to conduct bi-annual recertification campaigns, validating existing access rights. Recently, we expanded its use to manage cloud entitlements, including EntraID.

We manage user and access management  for over 20 SAP systems using One Identity Manager and do not handle any disconnected SAP accounts.

One Identity Manager governs SAP accounts by linking them to employee identities, ensuring access is managed throughout the identity life cycle. This direct link enables automated processes, such as terminating SAP accounts and associated assignments when an employee is terminated.

One Identity Manager, certified by SAP, delivers specialized workflows and business logic through a dedicated connector for SAP R3 and native support for HANA systems, enabling direct connection to HANA databases. It offers numerous out-of-the-box templates for SAP, automatically loading schemas for users, roles, and assignments upon SAP module activation. While most use cases are covered by these templates, customization is possible for specific needs.

With a tool like One Identity, our organization can manage accounts across multiple target systems from a central identity management solution. This centralized data allows for flexible governance reporting, including custom SQL queries and pre-built reports, to validate information. Governance practices vary between companies but often involve specific access controls, timely re-certifications, and validations by data owners. For example, some companies implement frameworks with defined views, access levels, and re-certification processes to ensure data integrity and security.

The ease of customizing One Identity Manager depends on the user's skill set. Compared to three similar products, One Identity Manager is more straightforward to customize, particularly when modifying VB.NET code or writing SQL statements for reports. While some coding knowledge is necessary, the tool's predefined templates and SDK samples offer helpful references and starting points.

The user experience of the legacy web portal is unsatisfactory due to limited customization options and occasional slowness, especially during backend processes like attestation. However, One Identity is moving towards an Angular-based portal in version eight dot two and newer, which offers greater flexibility, customizability, and improved performance. This new portal may provide a more satisfactory user experience overall.

One Identity Manager helps manage the company structure for dynamic application provisioning. Our IAM system reads the company and department structures to automatically assign entitlements. Based on this structure, users are created, and permissions are assigned.

The business role functionality of One Identity Manager is crucial for businesses, especially from an audit and SOC perspective. Whether utilizing One Identity, SailPoint, or another tool, a solid IAM solution should include comprehensive audit trails, streamlined request processes, detailed approval workflow history, and other essential functionalities to ensure compliance and security.

We have begun extending governance with EntraID and are evaluating the Starling connector which provides access to many other SaaS-based applications.

Over the time we've used One Identity Manager since 2017, it has significantly improved our organization by automating the joiner, mover, and leaver process across all target systems. No more manual account management tasks are needed, which include account creation, updates, or termination when a user leaves the company. It has substantially reduced manual role assignments and made processes fully automated. The major benefit is the attestation process, conducted once or twice a year based on requirements, which ensures no unauthorized or unwanted accesses are left unchecked. It also provides clear reports on user statistics, such as active users, new joiners, and leavers.

We initially started with a small scope but have since expanded to connect numerous systems, automating the mobile egress process. Tasks like account creation, updates, and termination are now fully automated through IAM solutions, eliminating manual intervention. This automation also removes the need for teams to assign roles manually. A significant benefit is the ability to conduct periodic access attestation campaigns, ensuring only authorized users have access. One Identity Manager facilitates this process and provides comprehensive reporting, giving management clear visibility into user activity, including the number of active and inactive users, new hires, and departures.

One Identity Manager helps minimize governance gaps across our testing, development, and production environments. We utilize a three-tiered setup with a transport mechanism to move changes from the development environment to the quality assurance environment and finally to the production environment.

One Identity Manager enhances privileged governance to mitigate security risks associated with privileged users. A custom solution within the One Identity framework allows users to link multiple secondary identities to their primary identity for tasks requiring elevated privileges. This framework provides a robust privilege access management system within the One Identity environment.

One Identity Manager streamlines application access, compliance and auditing. It supports the SOX audit process conducted twice or thrice yearly. For applications connected to the One Identity Manager, governance is managed through the IAM solution itself. Instead of checking the target system, administrators use the One Identity Manager to validate requests, approvals, denials and assignment periods for connected applications.

One Identity Manager empowers application owners and business managers to make independent application governance decisions, eliminating the need for IT involvement and siloed teams. Once applications are onboarded to One Identity self-service model allows users to request roles and the defined approvers to approve them, streamlining the process and removing complexity for application owners. They no longer need dedicated teams for identity and access management or manual user access reviews for compliance requirements as One Identity Manager automates these functions. This simplifies operations and centralizes control, improving efficiency and reducing administrative burden.

Zero Trust is a broad security framework with varied implementations. Currently, our Zero Trust implementation focuses on identity and access management, specifically for privileged roles. To prevent unauthorized or accidental access, a three-stage approval process is required for privileged role requests. This ensures that multiple stakeholders validate the access, embodying the Zero Trust principle of never trust, always verify. While this is just one aspect of Zero Trust, it significantly enhances our security posture by preventing unauthorized access to sensitive systems and data.