What is our primary use case?
We primarily use it for delegation access permissions, to helpdesks for example. We use it to automate certain things, like onboarding new users, deprovisioning leaving users, or when we add somebody to a group it triggers some kind of automation workflow. Lastly, we use it to sanitize data entry, to make sure that the first letter of the street name is capitalized, certain zip codes are allowed, others aren't; it's a type of data control.
How has it helped my organization?
It helps mitigate risks. With traditional, native Active Directory delegation, it can become really messy, really fast. You lose oversight on who has access where. We are an acquisitions and mergers company so we let go of certain companies and we onboard new ones. With native delegating, we can lose track of who has access and to what. With Active Roles, we can always see who has access, what they can do, in a very granular way. A user can modify the street name, but can't modify the city, for example; or can modify the picture, but not the names. That granularity is not normally available.
It has eliminated a lot of tedious IT tasks, especially when people leave. There are ten or 15 scripted actions that Active Roles does, always the same way and at the same time. Before, there would literally be a list of things that the admin would have to do, like hide the mailbox, disable the user, remove the groups, etc. Also, the auditing history that it keeps is very handy for us. It gives us a change record of what's been done to a user, who did it, when they did it, and that really helps out.
And now that we are outsourcing a lot of activities, we're dealing with a changing audience. Tools like this make sure that they do everything in a structured manner, that everybody does the same thing at the same time.
What is most valuable?
It's valuable to us in that it resembles the native tools that most people have grown accustomed to. Most people come from another company where they may have not used Active Roles. Active Roles resembles traditional tools, such as from Microsoft. That is really good because it eases the way people to interact with the tool.
The AD and AAD management features of this solution are really good. They're better than the native tools. They offer added value by showing more fields such as password age and the statuses of some things that we normally wouldn't see. What I really like is the fact that we have the mailbox and the user information all on one screen. With native tools, you need two tools to show that information.
What needs improvement?
Active Roles allows policies and there are a lot of example policies that come with it. It has Access Templates and there are a lot of Access Template examples in it. It also has workflows and those are really powerful, but there are no built-in workflows. When it comes to them, it's empty. I would personally love for it to come with ten, 15, or 20 workflows where each achieves a certain task but that are not enabled. I could just look at how each is done, clone them, copy them, modify them the way I want them, and be good to go. Right now we have to invent things from scratch.
For how long have I used the solution?
More than five years.
What do I think about the stability of the solution?
It's very stable. Even if components lose connectivity or the database dies, as soon as they come back up, it just reconnects and goes.
What do I think about the scalability of the solution?
It covers everything we want. It's scalable. We can make it redundant, we can replicate databases. We don't use a lot of those features, but it's very scalable.
Which solution did I use previously and why did I switch?
The reason we went with this solution - and it was ten or 15 years ago - was the Active Directory delegation. We could not allow everyone to have native access to our Active Directory. The delegation feature was really the trigger. In addition, the automation was attractive. There was so much room for human error that we wanted to script activities, rather than relying on the admin knowing what to do.
How was the initial setup?
It requires a bit of getting used to, where you set what. But once you get the hang of it, it's really straightforward.
What was our ROI?
The ROI is in the mitigation of risks: The risk of leaving unauthorized access behind, the risk of having Active Directory pollution. With that comes risks of people getting access they shouldn't have. There is the risk of having multiple accounts for the same thing; that's the biggest part. There's no actual money there, but risk management is really what you pay for.
Which other solutions did I evaluate?
We considered using the Microsoft solution because it's free and built-in, and already there. That's what everybody does. But when you grow beyond a certain size, you find out that it just does not cut it anymore.
We also considered using other tools, but at the time, Active Roles was very much alone in this world. I have to admit, now there are other vendors available, which I don't have any personal experience with, but on paper, they seem to do some of the same things. But at the time, there was simply nothing else that could even come close.
What other advice do I have?
I would give this solution a nine out of ten. There's always room for improvement. With every product, nothing is completely done. But this product is definitely up there.