They could improve their security of the products to prevent vulnerabilities.

There are additional features like Single Sign-On, and Mobile App enrollment which I have not used.

The setup process needs to be improved and made easier for the remote component because it is extremely difficult. Getting the VPN to work, based on the end user's configuration, took a very long time. It took weeks to get it properly set up to work successfully.

The worst part is that the solution can only be installed or updated on a device if it is physically connected to the local network. I can't even use their software, Desktop Central, to deploy it to a remote device. Consequently, I had to call in 150 people to physically bring in their laptops and install this on their machine.

Similarly, when a new version is released, I can't update it without getting these devices back in-house again. This is not only for cases where updates are those that the vendor releases but also with any changes that we make to the configuration. For example, if we made a change in the policy that modified it from 180 days to 190 days, they would not get that policy update until they physically connected to our network. The need to be plugged in and have a local subnet address in order for the change to be pushed.

With respect to maintaining security, I feel that it would be better to push software or updates out to a remote device, so that they are fully up to date at all times, rather than having to wait for people to visit the office and use outdated software in the interim. It can take perhaps four months to get somebody back into the office, which is a long time to use an outdated security product.

The main point of this solution was to have our remote users change their password within the timeframe that we specify in the security policy. So, it makes little sense that you can't install the software or push updates out to remote users.

When I look at something like a server or a user who has an unsuccessful login, all they're giving me is what is from the domain controllers. When I click on the analytics portion that says give me information, it doesn't tell me what application is errored out. It doesn't tell me; it just tells me what is the same information from the domain controller. I'd like a little bit more robust information on actually giving me some useful information instead of some links that send me out to the Internet that says research here, and then I have to do additional research. It's kind of generic. And, basically, it's just a quick, I don't have to search through the domain controller logs, but once I pull those out, the logs are still very generic like you get from Microsoft. Area code four three one one. Okay. I had to go look that up. It doesn't take it any further than just a copy based on the domain controller.

The registration process could be improved. It should be easier for users to register for the service. That's the only area I would take away from it.

We need more reports for visualization for top management to understand the IT background of users and common user issues. It will also help us as an IT department eliminate user gaps.

The product is not user friendly compared to other solutions on the market. Azure MFA, for example, sends a notification that you click on. ADSelfService requires you to open the application and approve the login on the computer. It's more trouble than other solutions. 

Asset management/discover and reporting.