For CyberArk Identity, a typical scenario involves using it with a federation, like Active Directory or Azure AD, to manage user identities. Since CyberArk Identity is a SaaS offering (not installable on-premise), identity connectors bridge the gap between the customer's directory (Azure AD or Active Directory) and CyberArk Identity.
These connectors essentially synchronize the two systems. For example, disabling an account in the customer's directory (either Azure AD or Active Directory) automatically disables the corresponding account in CyberArk Identity if the identity connector is present.
However, if you manage accounts manually within CyberArk Identity, you don't necessarily need a connector. This specific connector is called the CyberArk Identity Connector.
We can manage user access and permissions through CyberArk Identity. To fully manage it, we need a connector and whatever changes we want to make to user access or entitlements, if we do it in the CyberArk Identity end, the same will reflect in the customer's AD (Active Directory) also if you have the Identity Connector.
We use CyberArk Identity for multiple applications, like, for a single sign-on across multiple applications.
Some customers use it for managing server privileges through the SaaS version. In this case, CyberArk Identity facilitates the connection by federating the customer's Active Directory or Azure AD with the CyberArk SaaS environment. However, they only utilize a few features of CyberArk Identity, not its full potential.
I like the RBAC (Role-Based Access Control). This feature is quite common in other identity tools as well. It basically involves defining various roles, and then simply assigning those roles to users.
That's the RBAC feature that I find most valuable for security.
Moreover, CyberArk Identity offers multi-factor authentication, but I haven't configured this feature yet.
For instance, if the customer wants multi-factor authentication (MFA) or single sign-on (SSO), they usually prefer their own Azure MFA or Azure AD as a base or anything that is already integrated with their environment, so they don't have to subscribe to CyberArk SSO. But it's possible.