Sometimes you have one of those meetings that leave you baffled afterwards. This one was about the need for data insights when rolling out an IGA and I had never heard someone articulate it as neatly before.
Picture this: A large vendor of financial software, complex as they come, with ten thousand employees spanning five regions and five thousand customers across more than a hundred countries. MeetFrank, the IAM manager, entrusted with leading the global IAM strategy.
Get our free ebook on how you can level up your B2B SaaS content marketing
Get our free ebook on how you can level up your B2B SaaS content marketing
His predecessor had done what so many IAM managers had done before: "We need to take control of IAM, so let's deploy an IGA tool and a PAM tool". The company had bought themselves a SailPoint and a CyberArk and both were up and running for a few key systems.
However, the complex organization also led to a complex IAM environment. Frank was tasked with taking control of over one hundred and sixty Active Directory forests, forty Azure AD environments and an even higher number of custom applications.
To cope with this complexity, Frank needed to prioritize. He wanted to know where he should focus the attention of his team. In his words:
"I need to be able at a bare minimum to see what I'm dealing with. Is there an AD out there that has a bunch of administrative credentials? We don't know. I need to know what I need to worry about, right now I worry about everything."
Frank could even already go as far as listing the data insights (he called these KPIs) that he wanted to investigate and track:
- accounts in all of these systems,
- accounts that have not been authenticated in the last x months,
- accounts that belonged to people that already left the company,
- groups in these systems,
- empty groups,
- admin accounts,
- test accounts,
- service accounts,
- members of critical groups,
- accounts that could not be correlated with SailPoint,
- privileged accounts that were not managed by CyberArk any more ("how many do we still have to go?"),
- local accounts,
- domain accounts,
- meta-data issues such as accounts without a manager,
- ...
His list was long, but clear and to the point.
[FYI - We have listed the most important KPIs in our guide: "KPI-driven approach to IAM"]
In my opinion, Frank's vision was focused and spot on. His words: "We can't do much more with SailPoint before we have cleaned everything up. I want to achieve burn-down lists of what we need to tackle and I want these lists fast."
The crazy thing however was that even though the people around Frank had been working in this environment for years, even after buying and deploying SailPoint and CyberArk, this vision was new. His colleagues had no idea of the state they were in and his managers were surprised that they still needed this.
To me, this feels like a discrepancy between IAM practitioners and their management. Managers expect all of this to be solved by acquiring a market-leading platform such as SailPoint, while practitioners understand that you have to have these data insightsexactly to successfully deploy those platforms.
In Frank's words again: "Up until a year ago we heard no one talk about this piece of the puzzle. Until then, everyone just said 'connect your IGA to everything' but those tools and their data models were really never built for reporting and visibility of what you're dealing with in your IAM landscape. I now believe that we need a purpose-built platform for this. Separately from the other tools. Almost like oversight of the other tools."
As I said at the beginning, I was blown away by Frank's vision. And now I wonder how it can be that he is fighting an uphill battle with this vision. What can he do to more effectively communicate these challenges to the decision-makers?
I’d love to hear from you about this topic. Have you ever been faced with data questions in IAM? Please hit reply and let me know your thoughts.
FYI - We have outlined a customer case mirroringFrank's transformative IAM journey: "Speed up and de-risk IGA deployment with Elimity".
