One Identity Active Roles Review

Deprovision option allows us to reverse any accidental deletions


What is our primary use case?

We started using Active Roles because we wanted protection against user errors by our frontline service desk.

We have an on-premises solution.

How has it helped my organization?

Instead of deleting accounts, we like the deprovision option so that we can reverse any accidental deletions. It also gives a higher level of quality control in terms of enforcing any number of variables, such as making sure that an account has a description entered before the account can be created. We can backtrack and know the history of it that way.

It has also eliminated admin tasks that were bogging down our IT department. Before we started using Active Roles, if one of our frontline staff members deleted a user or group, it could take several hours to try to reverse that mistake. Whereas now, the most our frontline staff can do is a deprovision, which just disables everything in the background, but it's still there. We can go in and have it back the way it was two minutes later. Instead of it taking two hours, it only takes two minutes.

In addition, it reduces risk by enforcing stronger and more complex passwords that not only conform but go above and beyond the default recommendations from our Microsoft policy. It makes sure that there's a certain level of completion with anything created or provisioned through ARS. It enforces compliance, and that is definitely helpful.

For how long have I used the solution?

I've been using One Identity Active Roles for about five years.

What do I think about the stability of the solution?

It's a stable product. We have very few issues with it.

What do I think about the scalability of the solution?

Up until our migration to Office 365 and Azure, our Active Roles architecture was very static. We didn't really have to scale it out at all during that time. The only scalability exercise that we've done is trying to adapt to Azure in Office 365, and it's a challenging process to do that.

How are customer service and technical support?

The product itself is fine and works well. I've had a difficult time getting it to cooperate with Azure in the cloud and, while the support staff are very good and very knowledgeable, what they assist with just on a call doesn't go deep enough to help with a number of issues. The answer that comes back is that we'd have to start an engagement with Professional Services, which is fine but that takes time to schedule and it takes budget. And during all that, you have a delay in getting a particular part of the platform working properly.

I've worked with several One Identity support folks and they're all very knowledgeable and pleasant to deal with. But sometimes I get the feeling that their hands are tied with how much support they can give me for a specific task because it gets into that gray area of what's break/fix and what goes off to Professional Services. If it falls in that gray area, it's hit or miss whether you're going to get support from your first call or whether you have to wait until you can dedicate a whole day to it.

Support could benefit from helping with a broader area of ideas on a first-call-resolution type of model, rather than just focusing on break/fix issues. They should also help with configuration issues.

How was the initial setup?

The process was complex. We had the help of an integrator from Quest, back then. We had him come onsite and work with us. There is definitely a learning curve when it comes to setting up templates. It's a complex product, but it's good once you get the hang of it.

The initial deployment took about a couple of weeks, but that was when everything was still on-premises. There wasn't any Office 365 or Azure back then. In terms of getting our Active Roles to cooperate with Azure now, I've been struggling with that, on and off, for over a year now. That's not necessarily a fault of One Identity. Their support is partially to blame for that, but a lot of it is on my shoulders too, due to the fact that I have other responsibilities at my workplace.

We have about eight admin staff who use Active Roles daily, and pretty much all day, for user functions. We don't have end-users with any control over delegation through Active Roles, although that might be something that we explore later; we might allow some office administrators to do various functions.

Which other solutions did I evaluate?

There are a lot of other benefits that we take advantage of that are above and beyond the native Active Directory functions that Microsoft provides. There's no comparison between Active Roles and the native Microsoft tools. You can customize the interface so that you can create a user account much more quickly. Active Roles also gives you a really nice audit log of when a user account was created and of any changes that happen to that account after the fact, as long as you do those changes within Active Roles. It's a really nice way to have a full view of the lifetime of an object created through Active Roles. It's much better than the native tools.

We researched various solutions before we narrowed in on what was Quest, back then. At that time we were going through a migration from an old Microsoft domain to a new Microsoft domain and we are using a different Quest product, but we haven't evaluated any other products.

What other advice do I have?

It is a good tool and anybody who works with Microsoft Active Directory and Azure can definitely benefit from using Active Roles. But it can be challenging to get Active Roles and Azure to play nicely together, depending on how your company is configured.

For some organizations, I could see that the product could help move staff to more important IT initiatives, but we don't use it at a level that it would help us in that capacity.

The big lesson learned—and it would depend on various people's skill levels or proficiency— for a new implementation where you're working with Azure and not Office 365, would be to budget for at least a one- or two-day session with Professional Services. That would save you a lot of time, and in terms of hourly costs, you would actually probably end up saving money by buying the Professional Services session.

I am in the process of scheduling a meeting with One Identity Professional Services to start using Active Roles for migration from AD to Azure AD. We've tried to mesh our Active Roles implementation with our new Azure setup and it's been challenging. Added support is definitely needed to get over the last few humps there.

I do find it a very useful tool. I have researched other players in the field and there's not a lot out there. Active Roles has the edge. I don't see us moving to a different product, but the biggest frustration has been getting enough support out of support.

Which version of this solution are you currently using?

7.4.3
**Disclosure: IT Central Station contacted the reviewer to collect the review and to validate authenticity. The reviewer was referred by the vendor, but the review is not subject to editing or approval by the vendor.
More One Identity Active Roles reviews from users
Learn what your peers think about One Identity Active Roles. Get advice and tips from experienced pros sharing their opinions. Updated: July 2021.
521,189 professionals have used our research since 2012.
Add a Comment
ITCS user
Guest