What is your primary use case for One Identity Active Roles?

I am an implementer for the product. I install Active Roles for companies.

We use Active Roles to bring our decentralized environment into a single pane of glass. Our entire customer base is in a single directory, and they can manage their objects without interfering with other entities in our environment.

We use the solution for managing access to, shared drives and access for Active Directory.

We're using it for identity management, including the creation of accounts and synchronizing them with our HR system.

The solution is used for lifecycle management and can be deployed on-prem or cloud.

We use Active Roles as a single point to manage all our users. We're using all of the system's management capabilities, like setting group policies and delegating roles. We have around 1,400 users and 25 or 30 admins. The company uses Active Roles as a standalone solution because we don't have HR or ERP systems connected to applications. We aren't using it to migrate from Active Directory to Azure AD. We use a Microsoft solution called AD Sync. We had this functionality before implementing Active Roles, but we hope to get that improved connectivity to Azure AD and Exchange Online.

We started using Active Roles because we wanted protection against user errors by our frontline service desk. We have an on-premises solution.

Our primary use case for ARS is for the ease of delegating administrative access and the ability to limit direct access to the domain controllers. Those were the primary purposes for purchasing it. We do much more with it now, probably more than anyone else. We're still working through that primary use case. But in addition to that, over the course of the last seven years, we've been able to leverage ARS to allow us to do a lot more and be more efficient. We use it for dynamic groups. We automatically group users together by department, reporting structure, etc., to leverage them for access, authorization, and authentication. And we automatically group computer objects for management authorization. We have also started leveraging ARS as an identity platform. It was an interim solution until we move over to our final solution, for which we're going through vendor selection right now. The way we use it for identity is that we use custom scripts and workflows and scheduled tasks. We were able to migrate off of our legacy identity platform and move everything we currently do into ARS. While migrating to ARS, we also implemented role-based access for the administrative users and customized views for each role in ARS, in the web interface. So if you're a level-one support, you only see the tasks that you are allowed to do, versus if you're a full-blown administrator, you see everything. In addition, we use it for account creation at the university. We expose native Azure AD user group properties to assist with support increase. We provision and de-provision applications, and we create the necessary reports.

We use Active Roles to facilitate the synchronization between our Active Directory environment, SAP, and our school information system which is Trillium. Trillium and SAP feed data for employees and students into the Active Directory. We use password managers to manage passwords and provide us with three sets of passwords and options for our users.

We are using Active Roles for provisioning Active Directory objects and we also use it to connect, through Active Roles Synchronization Service, to our HR system and to provision and deprovision employees. In general, we use it to provision any object: security groups and computer objects, in a delegated manner. Active Roles Server allows the security of Active Directory to be changed to delegate access for provisioning to different IT teams, without changing the actual security of Active Directory. The solution is co-located in our data centers.

Our primary use case has definitely evolved since our very first use case, which was for delegation of rights within Active Directory without having to give folks native rights through Active Directory. That was our biggest driving factor into the use of Active Roles. All the other stuff that it does is a benefit, and we use it all heavily. However, we're very big into using the least privileged model and having the least amount of Active Directory native rights out there, as this cuts down on issues later. By having less people with native Active Directory rights, this cuts down on potential issues that we have to troubleshoot. It is used in our on-prem Active Directory, but the servers themselves are hosted out of Azure. So, we use IaaS, which is just having VMs in the cloud versus having our VMs on-prem. The only cloud aspect is that VMs are hosted in the Azure IaaS instance. It's a normal VM, which is part of our on-prem Active Directory, but it just happens to be hosted in Azure.

We use ARS to manage multiple domains. Our organization owns over thirty companies and we needed a tool that would give us the ability to apply consistent access rules across all of the businesses.

* It is mainly for delegation of permissions inside the domains for large companies. * It is for provisioning and deprovisioning users in the Active Directory (AD) and their licenses in Office 365.

We use it to lock down the interface between helpdesks and Active Directory.

We primarily use it for delegation access permissions, to helpdesks for example. We use it to automate certain things, like onboarding new users, deprovisioning leaving users, or when we add somebody to a group it triggers some kind of automation workflow. Lastly, we use it to sanitize data entry, to make sure that the first letter of the street name is capitalized, certain zip codes are allowed, others aren't; it's a type of data control.

RBAC for AD and Exchange Provisioning, Re-provisioning, De-provisioning and Undo-De-Provisioning of user accounts User Self Service Virtual AD firewall