We just raised a $30M Series A: Read our story

One Identity Active Roles OverviewUNIXBusinessApplication

One Identity Active Roles is the #2 ranked solution in our list of top User Provisioning Software. It is most often compared to Azure Active Directory: One Identity Active Roles vs Azure Active Directory

What is One Identity Active Roles?

Active Roles is a single, unified and rich tool to automate the most troublesome user and group management tasks. With One Identity Active Roles, you can streamline user and group administration, solve security issues – and meet those never-ending compliance requirements by managing and securing on-prem, and cloud AD resources simply and efficiently with a single, intuitive solution.

One Identity Active Roles is also known as Quest Active Roles.

One Identity Active Roles Buyer's Guide

Download the One Identity Active Roles Buyer's Guide including reviews and more. Updated: October 2021

One Identity Active Roles Customers

City of Frankfurt, Moore Public Schools, George Washington University, Transavia Airlines, Howard County, MD. See all stories at OneIdentity.com/casestudies

One Identity Active Roles Video

One Identity Active Roles Reviews

Filter by:
Filter Reviews
Industry
Loading...
Filter Unavailable
Company Size
Loading...
Filter Unavailable
Job Level
Loading...
Filter Unavailable
Rating
Loading...
Filter Unavailable
Considered
Loading...
Filter Unavailable
Order by:
Loading...
  • Date
  • Highest Rating
  • Lowest Rating
  • Review Length
Search:
Showingreviews based on the current filters. Reset all filters
NP
IT Lead, Security services at a aerospace/defense firm with 10,001+ employees
Real User
Top 10
ARS has been instrumental in ensuring accounts get cleaned up when they get deprovisioned

Pros and Cons

  • "The biggest thing for us is Active Roles saves a lot of man-hours in keeping groups up-to-date manually or trying to write some sort of script that you have to run, so we don't have to reinvent the wheel. Instead of when every time somebody joins a department, then somebody has to remember to put in a request to add "meet user Joe" to this group, the solution does it automatically for us. Therefore, it saves our business and IT staff time because they do not have to process requests since Active Role can do it for them."
  • "When doing a workflow, we would like a bit better feedback on the screen, as we're trying to get it to work. For example, there is a "Find" function that you need set up in a workflow to do some of the automation. It is not the easiest to get a result from those finds when you're trying to do that. In the MMC, they have a couple different types of workflows. In this particular case, we use their workflow functionality to find all of X within the environment, then if you find it, do X, Y, and Z. You can have multiple steps. When you do that search function within that workflow, it's really hard to find out, "Is my search working?" It would be nice if there was some feedback on the screen so you could see if your search is working properly within the workflow."

What is our primary use case?

Our primary use case has definitely evolved since our very first use case, which was for delegation of rights within Active Directory without having to give folks native rights through Active Directory. That was our biggest driving factor into the use of Active Roles. All the other stuff that it does is a benefit, and we use it all heavily. However, we're very big into using the least privileged model and having the least amount of Active Directory native rights out there, as this cuts down on issues later. By having less people with native Active Directory rights, this cuts down on potential issues that we have to troubleshoot.

It is used in our on-prem Active Directory, but the servers themselves are hosted out of Azure. So, we use IaaS, which is just having VMs in the cloud versus having our VMs on-prem. The only cloud aspect is that VMs are hosted in the Azure IaaS instance. It's a normal VM, which is part of our on-prem Active Directory, but it just happens to be hosted in Azure.

How has it helped my organization?

The biggest thing for us is Active Roles saves a lot of man-hours, from keeping groups up-to-date manually or trying to write some sort of script that you have to run, so we don't have to reinvent the wheel. Instead of when every time somebody joins a department, then somebody has to remember to put in a request to add "meet user Joe" to this group, the solution does it automatically for us. Therefore, it saves our business and IT staff time because they do not have to process requests since Active Role can do it for them. 

We have about 2000 of these groups in a pretty substantial company of 55,000 employees. Active Roles cuts down on a good number of these tickets every time somebody is brought onboard.

We are a large company who does a lot of department codes. People are coming and going from the company daily. Active Roles probably saves us an upwards of 500 requests a week.

The solution has eliminated admin tasks that were bogging down our IT department. Now, nobody from IT has to take action to update the group in cases when someone joins or leaves the company.

Active Roles has assisted us greatly in provisioning and deprovisioning accounts as folks come and leave the company. We have automation in place that utilizes Active Roles to create and deprovision accounts as folks leave. ActiveRoles Server (ARS) has been instrumental in making sure accounts get cleaned up when they get deprovisioned. Other features of Active Roles, such as Dynamic Groups, have helped us to streamline the process. It's not taking everything away for us, but it's provided us a lot of streamlining. It probably saves, on a per user basis, a half an hour of man-hours between different tasks once you put everything together. This saves us about 40 hours of work for somebody a week.

When our HR department terminates an account, we have a script that talks to Active Roles and sends Active Roles a provisioning command. We have Active Roles set up to do a variety of tasks where deprovisioning is requested. The most important one for us is that after so many days of that account still being disabled and the person being gone, Active Roles will clean that account up for us and delete it out of AD. Therefore, we don't have to manually go in, terminate folks, clean up the accounts, and all that other stuff that happens when someone leaves.

Between the automation of using Active Roles to do our onboarding, policies, and workflows, we can ensure that the data that gets put into Active Directory during the onboarding of any type of object for Active Directory is accurate, meeting our standards so we don't get junk put in there. This has helped streamline things. One of the hardest things from an Active Directory management perspective, without a tool like Active Roles, is controlling how people do something. How I would want to install or set up a new user might be different than the person next to me, e.g., you can give somebody a set of policies to follow when you're not using a product like Active Roles, then it's up to them to interpret that and follow them. Active Roles allows us to enforce those policies so the data that gets put into Active Directory is cleaner and consistent. Having consistent data allows us to do a lot more automations and ensuring people and objects are set up properly.

It definitely improves our security. We are a larger company, so we have a lot of IT staff who are responsible for different parts. Someone does new groups while someone else does servers. There are a lot of hands touching Active Directory. Using a product such as Active Roles, we can delegate those rights to the hundreds of accounts for people to do their jobs. This reduces our risk for somebody's account being compromised. If they have native rights in Active Directory and an account is compromised, that is a higher security risk than just using Active Roles, because the only way somebody can make a change in Active Directory when ARS is involved is to use the Active Roles interface. If someone hacks in and tries that, they're not going to be able to do that. So, it definitely improves our security posture. We have only a handful of people with highly privileged accounts in our environment because of Active Roles.

Active Roles has a PowerShell interface that allows us to let other parts of our environment and other applications, which might need to interface with it, make changes within the Active Directory by utilizing PowerShell commands. We can apply the same principle as our security rights so they have to use Active Roles, reducing our risk from a security perspective.

What is most valuable?

All of the features have been valuable, and that is not often so. We use probably 90 to 95 percent of the features of Active Roles. The only one we don't use right now is the plugin to Azure because we just use Active Roles for on-prem management of our Active Directory. 

My favorite feature is probably the Dynamic Groups and the fact that Dynamic Groups are built pretty much on the fly and kept up-to-date. That is huge for us. There are so many features, if I had to pick one, then Dynamic Groups would be my favorite. We routinely will get requests from our business, saying, "We need a group that contains everybody in this particular department," whether it be a distribution list just for emails, a group to secure a file server, etc. With Active Roles, we can create this group and tell Active Roles, "Every user account that you find that has department equaling whatever 'this is', then put them in this group." 

The way Active Roles works: As soon as somebody gets the value in that department field changed to something that matches, then Active Roles puts it into that group in almost real-time. As soon as it replicates through Active Directory and Active Roles, the DC that Active Roles is using sees that change, then Active Roles take action and keeps those groups up-to-date for us.

One feature that we use a lot is temporal group membership. It allows us to put somebody in a group on a time basis. We can say, "You get put in this group," then you will automatically come out on this date at this time. We can either put them in on a date and time or take them out on a date and time. It's a great teacher, and it's also one of those things that native tools doesn't allow us to do.

What needs improvement?

When doing a workflow, we would like a bit better feedback on the screen, as we're trying to get it to work. For example, there is a "Find" function that you need set up in a workflow to do some of the automation. It is not the easiest to get a result from those finds when you're trying to do that. In the MMC, they have a couple different types of workflows. In this particular case, we use their workflow functionality to find all of X within the environment, then if you find it, do X, Y, and Z. You can have multiple steps. When you do that search function within that workflow, it's really hard to find out, "Is my search working?" It would be nice if there was some feedback on the screen so you could see if your search is working properly within the workflow.

There are other finds, like when you just simply go look in Active Directory, and say, "Find." I absolutely love that we can export the results from that one. It's only the search function within the workflow that could be a little bit better. 

In version 7.4.1, they added support for SAML authentication to the web pages and the documentation was quite lacking. The documentation for that, in particular, needs a lot of work. I ended up having to work with support over multiple sessions to try and get that to work properly. 

This was a newer function for 7.4.1, so I had never used it before in the previous versions. When you downloaded their product, the documentation was the same as they had posted on their website. It was the same in both places. It was very broken up and wasn't complete. It needed to be reworded and flow better so somebody new could follow it a bit better. Because even after following all the solutions, even the tech support said to do it differently than what was in the document before we could get it to work. Therefore, I would definitely like to see some work on the documentation for that area.

For how long have I used the solution?

I have been using it for 10 or 11 years: a long time. I've been around since version 6.1. Though, my experience mostly started at version 6.7 and up.

What do I think about the stability of the solution?

I have used so many different versions of it. Some of them were better than others. This current version seems to be very stable for us, so we're very happy with version 7.4.1.

What do I think about the scalability of the solution?

It is very scalable. We are an unusual environment. We have multiple Active Directories that we support and the product has been great in supporting those multiple directories. I would imagine a large majority of folks who might go to use this are going to have just a couple Active Directory domains. We have seven on our original instance, and we'll have those seven plus a few more on our other one when we're finished. We're doing some consolidation, but we're not quite there yet.

Active Roles is used for every change to Active Directory in our environment. Our usage is extensive. If there's a scale of one to 10, it might be over a 10 for how much we use this product. We're always adding to it. We find a need for something, and if we can automate something in Active Roles, we will use Active Roles to do that automation. What we really like about that is that it gives us one place to go whenever we need to do automation for Active Directory. We don't need to have multiple things all over the place. ARS can do all of it.

We have over 900 staff who don't all use it at the same time. However, at any given time, about 900 people could be using it. We have help desk staff who use it along with our One Identity staff. They're in there constantly all day, every day, 10 hours a day, for each person. They could be doing anything from password resets, creating new accounts, updating accounts, granting access to somebody for a new program, etc. We also have our end user support staff and our data center staff who use it to stage and get new servers and workstations setup. Those are probably our four main groups that use it. We have some other users, but those are the main ones who use it.

How are customer service and technical support?

The technical support is generally very responsive. There are a few that I know by name because we work with them quite a bit. Over the years, we have set up different products. If they can't get you going, they don't hesitate to involve their programming staff to get things going.

Which solution did I use previously and why did I switch?

Prior to using Active Roles, we were just using native Active Directory tools.

Active Roles is a thousand times better than native Microsoft tools. There is so much that this tool brings that the native Microsoft tool does not, such as Dynamic Groups and the ability for us to enforce policies. So, when we say, "Fill in this field," we make sure it gets filled in and it gets filled in with these values, because that's what we're expecting. We're getting clean data put into Active Directory. Automation doesn't come with the native tools either. 

How was the initial setup?

I have set up this product many times, including our current one. Because I have done the setup so many times, it is now pretty straightforward for me. For someone who has never done the setup before, they might consider it complex. However, because I have had so much experience doing the setup before, I didn't hardly even look at the document on it.

The deployment time depends on how many servers that I'm cloning. I can get an initial version of Active Roles up and running, if I have all my OS and everything ready to go, in under a workday.

What about the implementation team?

Going back a number of versions, we did have Quest come in and work with us on our initial setup. This is many years ago, probably nine, when I personally was just getting involved with it. I found it very helpful. I got a lot of very helpful tips, as I was still learning the product back then. I would maybe recommend for somebody who really wants to do a lot of the automation and use the product to the fullest to bring in somebody who could help add those parts to it and get them going faster.

I do the deployment myself. I also have a couple folks that we brought in who are coming up to speed and learning Active Roles from me now. I think it depends on the size of the environment. In our environment, we have 12 servers because we have to support a pretty large IT staff who will be using it. We're trying to get three to four subject-matter experts on Active Roles from a support perspective because we want one person to be the only person who knows the product. Because if something happens, they're out of luck if that person's not around. However, the deployment and maintenance can be done with just one person. It's not a huge product to worry about.

What was our ROI?

We have seen ROI. We did an initial look at Active Roles when we first started using it. We were smaller at that time and have sine gone through an acquisition, growing in size. At that time, we saw a reduction of about 150 tickets.

Which other solutions did I evaluate?

Last year, when we had just gone through a merger, we did do an evaluation. We had a consultant come in and do the evaluation for us. 

What other advice do I have?

If you are very new to the product and want to get your money's worth out of it when you utilize it, because it has a lot of features, use an implementer or get some consulting time to make sure that you're utilizing it to its full potential.

Biggest lesson learnt: Our IT staff, prior to using this, never really followed instructions.

We're not using Azure Active Directory with Active Roles in any way. We do love that we can manage multiple Active Directories from one console and have that single pane of glass on-prem. We have multiple Active Directory environments, so we can manage them and see them all in one place.

It's not integrated with a PAM solution at this time. We've thought about it, but we're not there yet.

I would rate this solution a 10 out of 10.

Which deployment model are you using for this solution?

On-premises
Disclosure: IT Central Station contacted the reviewer to collect the review and to validate authenticity. The reviewer was referred by the vendor, but the review is not subject to editing or approval by the vendor.
Becky Phares
Sr Business Analyst at George Washington University
Real User
Top 5Leaderboard
Flexibility and extensibility of the platform allowed us to achieve far more efficiencies than we ever expected

Pros and Cons

  • "With the use of the sync service we were able to import information from multiple external systems and populate them within our space and leverage them for downstream systems."
  • "There are some features that we think should be included in their next release. We think these things would take them to the next level: the ability to completely force or limit any dynamic group processing to specific servers, change-tracking reporting of virtual attributes, and the ability to use files as inputs to automation workloads. These things have also been talked about. Knowing them, they're probably working on them."

What is our primary use case?

Our primary use case for ARS is for the ease of delegating administrative access and the ability to limit direct access to the domain controllers. Those were the primary purposes for purchasing it. We do much more with it now, probably more than anyone else.

We're still working through that primary use case. But in addition to that, over the course of the last seven years, we've been able to leverage ARS to allow us to do a lot more and be more efficient. We use it for dynamic groups. We automatically group users together by department, reporting structure, etc., to leverage them for access, authorization, and authentication. And we automatically group computer objects for management authorization.

We have also started leveraging ARS as an identity platform. It was an interim solution until we move over to our final solution, for which we're going through vendor selection right now. The way we use it for identity is that we use custom scripts and workflows and scheduled tasks. We were able to migrate off of our legacy identity platform and move everything we currently do into ARS.

While migrating to ARS, we also implemented role-based access for the administrative users and customized views for each role in ARS, in the web interface. So if you're a level-one support, you only see the tasks that you are allowed to do, versus if you're a full-blown administrator, you see everything.

In addition, we use it for account creation at the university. We expose native Azure AD user group properties to assist with support increase. We provision and de-provision applications, and we create the necessary reports.

How has it helped my organization?

We reduced the development cycle for modifications to code, which enabled us to easily integrate and onboard services, applications, and areas of the university that were not previously centralized. We just centralized Law, for instance. 

We also have real-time alerting for failed tasks, which has reduced the troubleshooting tickets, user frustration, and allowed us to, in some cases, address the issue before it's even realized by the customer. In our previous system, if a task failed, we didn't know about it until the next day. Now, if a task fails, we're immediately notified by the system. That's how we're often able to clear it before the user ever even knows anything impacted them.

In addition, with the use of workflows and the scheduled tasks, we were able to automate and centrally manage a number of the processes as well as utilize them to work around other product limitations. Those include, but are not limited to syncing larger groups, which have 50,000-plus members, to Azure AD.

We sync up to Azure AD using ARS. If we had not already had ARS in place, it would have been impossible for us to have done so in the time period we did it in. We did it in under six months. If we had been migrating to a whole new platform, or an identity system, the way that things were, we would not have been able to do that in six months. ARS saved us. It was our bridge between an outdated solution, one that had not been matured. It gave us that time to breathe so that we could find the right solution for us. ARS won't go away, it will just stop doing the identity pieces. We will continue to use ARS.

ARS probably saves us at least two weeks out of every month. It's reduced our workload by 50 percent, easily.

We were able to introduce automated role-based provisioning for the first time, because we had ARS. We introduced role-based access. We introduced birthright access. Those had never been done before. We took ARS and turned it into an identity platform as our interim solution. That enabled us to eliminate Oracle Identity Manager completely. Per user, automated provisioning saves a couple of hours per week.

It has enabled staff to focus on more important IT initiatives. Because it is dependable, and because there aren't any issues with it, it allows the operational staff to also be development staff. A lot of our time has been freed up so that we can do things like interview vendors, come up with a logical strategy, and things of that nature. So ARS has certainly assisted in us being able to do that. We didn't reduce resources. Rather, time was freed up so that we could focus on more important things.

It also reduces risk because we use it to leverage dynamic groups, and with a dynamic group, if the person is no longer in the feed coming from the HR system, then that person is immediately and automatically removed from the group. We don't have to wait for a human being to go and look in every single group to see if that person is in there. It's a matter of internal best practice, ensuring that we meet the requirement to have least access.

What is most valuable?

With the use of the sync service we were able to import information from multiple external systems and populate them within our space and leverage them for downstream systems.

ARS also gives you a single pane of glass to manage AD and Azure AD. One of the things that we really like is that we can get to everything from ARS if we need to. So unless you are a system admin, there's no reason for you to go into Azure AD, because we have it set up so that everything syncs up with Azure AD. It gives us a level of confidence that things are matching from a governance perspective. We're trying to mature. I don't know that ARS will get us to our final destination, but it is helping us govern what we can see.

What needs improvement?

We would like to see 

  • extension of change-tracking auditing capabilities, especially in relationship to the virtual attributes 
  • more flexibility with group families
  • integration with cloud database path solutions
  • better integration with Azure AD; it integrates, but it could be better.

These are all things that our tech team has talked to their tech team about. And they're extremely responsive. 

In addition, there are some features that we think should be included in their next release. We think these things would take them to the next level: the ability to completely force or limit any dynamic group processing to specific servers, change-tracking reporting of virtual attributes, and the ability to use files as inputs to automation workloads. These things have also been talked about. Knowing One Identity, they're probably working on them.

For how long have I used the solution?

We've been using One Identity Active Roles since around 2013.

What do I think about the stability of the solution?

Maintenance is standard and periodic. There may be a release or update that comes along, but other than that it's a very stable tool and doesn't require much maintenance at all. It's probably one of those grunt tools that most would typically consider ubiquitous. However, we think about it because we're using it for more than what it was intended to be used for.

What do I think about the scalability of the solution?

We haven't had any problem at all, so far, with scalability. The only thing that we really saw was that syncing larger groups is a problem when we try to sync to Azure.

ARS went from just being our AD management tool to being our identity system, and it will continue to be that for the next 12 months. When we pick up and move the identity pieces out of ARS, it will remain the workhorse to keep all these things in sync.

We're pulling the identity components out because ARS is not an identity platform. It's not meant to be one. It's not robust enough to handle it all. If we continue to customize and build it out, we'd be building our own identity tool and that's not a good path to go down.

At last count we had around 50 users of ARS. They're either our middleware tech team, the CIS admins, including AD, Azure, etc., or it's our level-one support team. They use it to reset 2FA and to reset passwords. We built a custom interface for them.

How are customer service and technical support?

Excellent support. They truly are a partner. They want to be a partner, a collaborator. Their number-one goal is to solve people's problems, in the space of identity. That's really good. 

In all of these years, we've never had any problems. As a matter of fact, they are very proactive and always reaching out saying to us, "How can we help? How can we help?" We've had excellent service from them.

Which solution did I use previously and why did I switch?

We eliminated Oracle Identity Manager from our environment. Unfortunately, OIM was stood up about nine years ago but proved to require a lengthy life cycle to onboard applications and move to role-based provisioning, so we never moved beyond the first phase. We picked everything up out of that system and we created, if you will, a brand new ARS to handle everything that used to be in there. If OIM would choke, we would have to do constant reboots. We don't have any of that anymore now that we are in ARS. We haven't put a ticket in for a reboot in over a year, since we migrated.

We've been using ARS for our identity platform for a little over a year, and it was the right thing to do at the time. It could handle what we were doing, because what we're doing is actually very limited.

How was the initial setup?

I wasn't here for the initial setup in 2013, so I can't speak to that. I'm not part of the technical team that is in the process of doing the upgrade to 7.4.

But you can do deployment with two to three people. I know that from knowing the size of our team and who's doing it. If you've got two to three knowledgeable, skilled people, that's all it takes.

What was our ROI?

There has been return on investment in the time savings, although I can't put a number on it.

Which other solutions did I evaluate?

We looked into other options. The problem was that we needed to move quickly because OIM was out of maintenance. As a team we decided, "We have a tool here that can do this. We just need to make it do it". This provided the additional time we needed to decide on the right solution for access management and governance.

ARS is very clean and very easy to use. Sometimes, getting down to the level of detail that you need to see can be challenging, but its ease of use is comparable to any Microsoft tool or any other tool that's out there.

What other advice do I have?

If you're going to implement it out-of-the box, off-the-shelf, exactly as it's meant to be, you should be able to do it on your own. It's pretty straightforward. If you intend to do anything else with it, a good integrator is key.

The biggest lesson we've learned is that the flexibility and the extensibility of this platform allowed us to achieve far more efficiencies than we ever expected. What became the short-term certainly isn't going to be the long-term, but it proved credibility here, and that was what was really important. It gave us the credibility that we could do what we said we were going to do: take us off of a legacy tool that was broken, make things more efficient, and close the gaps until we could put in the full-blown solution.

Which deployment model are you using for this solution?

On-premises
Disclosure: IT Central Station contacted the reviewer to collect the review and to validate authenticity. The reviewer was referred by the vendor, but the review is not subject to editing or approval by the vendor.
Learn what your peers think about One Identity Active Roles. Get advice and tips from experienced pros sharing their opinions. Updated: October 2021.
541,462 professionals have used our research since 2012.
GS
Information Security Manager at a manufacturing company with 5,001-10,000 employees
Real User
Top 10
Synchronization Service allows us to process HR data and automatically update attributes and data fields in AD

Pros and Cons

  • "Another good feature is the change history. It's centralized in a single place and allows us to manage people's Active Directory domains from a central location. We can also drill down into individual objects in a troubleshooting or even an auditing situation. We can show evidence to auditors by drilling down into the individual history. It gives you all the history of what happened around an individual object. That is something that would be almost impossible to do in Active Directory, or extremely complicated."
  • "The third area for improvement, which is the weakest portion of ARS, is the workflow engine, which was introduced a few years ago. It's slow and not very intuitive to use, so I would like to see improvement there."

What is our primary use case?

We are using Active Roles for provisioning Active Directory objects and we also use it to connect, through Active Roles Synchronization Service, to our HR system and to provision and deprovision employees. 

In general, we use it to provision any object: security groups and computer objects, in a delegated manner. Active Roles Server allows the security of Active Directory to be changed to delegate access for provisioning to different IT teams, without changing the actual security of Active Directory.

The solution is co-located in our data centers.

How has it helped my organization?

With delegated access to Active Directory, it allows us to revoke a lot of the admin rights. It gives us a better lockdown and a more secure environment than we used to be.

It has eliminated tasks that were bogging down our IT department, especially in certain workflow automations. Through Active Roles Synchronization Service, we can process data coming from HR and automatically update those attributes and data fields straight into Active Directory, versus doing it on a manual basis or through bulk imports. Also, the fact that we can enforce data formats and policies saves us time since we don't have to go back and do a cleanup. 

In addition, because we are able to remove the main admin rights, there are fewer uncontrolled changes, and when you have fewer uncontrolled changes you have a higher availability of the service, overall, and fewer audit findings.

The solution automates provisioning. In our HR system we are automating the creation, termination, and ongoing management of all of our employee base. We have between 5,000 and 6,000 employees, and all those processes are fully automated, with IT being completely hands-off. It saves a lot of hours, easily on the order of hundreds of hours per year.

The fact that we have decreased certain operational costs, by means of automation, of course means we have been able to reallocate the time of some of our resources for more value-added activities. Because we implemented this 10 years ago, things have changed over time. It has become an established practice, process, and technology so it's hard to estimate how many FTEs we have been able to reallocate, but it would probably be at least one.

One Identity Active Roles has also improved the accuracy of our onboarding process. As a company, our onboarding process for people is subjected to SOX audits. Ten years ago we were in a situation where we had hundreds of nonconformities. Today, we essentially have zero nonconformities.

Another benefit is that the solution most definitely reduces risk for our organization. By avoiding changes to the native Active Directory security, and the fact that there is role-based access control to manage Active Directory itself through the application, there has been a dramatic reduction in risk.

What is most valuable?

The most valuable feature is the ability to delegate by using permissions and workflows. 

Another good feature is the Change History. It's centralized in a single place and allows us to manage people's Active Directory domains from a central location. We can also drill down into individual objects in a troubleshooting or even an auditing situation. We can show evidence to auditors by drilling down into the individual history. It gives you all the history of what happened around an individual object. That is something that would be almost impossible to do in Active Directory, or extremely complicated. 

We can also enforce data formats. That creates a higher quality in the data that we store in the directory by enforcing naming conventions and data formats. 

In addition, we can reach the data set by using virtual attributes, rather than extending that, so we can put schema attributes in ARS that live in AR without actually impacting the Active Directory environment.

One other thing that I really like about this product, as an engineer, is the design of it, meaning not how it looks, but how it was designed architecturally. This is one of the greatest strengths of the product. It's just designed right.

What needs improvement?

The overall UI needs a refresh; the web interface requires some modernization.

We would also like to have a SaaS version of Active Roles. Rather than implementing it in our data center, it would have been nice having a SaaS-delivered solution. 

The third area for improvement, which is the weakest portion of ARS, is the workflow engine, which was introduced a few years ago. It's slow and not very intuitive to use, so I would like to see improvement there.

For how long have I used the solution?

We have been using One Identity Active Roles for about 10 years.

What do I think about the scalability of the solution?

The scalability of the solution relies on the environment where it is deployed. We are a smaller company, but we are using the same design and architecture that we used initially, where we have about 15,000 to 20,000 users. We have added multiple domains, four or five, and we have never seen any issue from a scalability standpoint. I don't know if it scales to hundreds of thousand users, but for our environment, scalability has never been an issue.

We have a very good adoption rate, from a user standpoint. I can't see many areas where it could be expanded. We are leveraging the tool at a very good capacity. I don't foresee any expansion because we are using it pretty heavily.

How are customer service and technical support?

The support service provided by the vendor on this product is pretty solid. It is an excellent support service. I would rate them a solid nine out of 10. They always have a solution or a workaround. They're very responsive and very knowledgeable. Sometimes I wish that we had the same level of support from other vendors.

Which solution did I use previously and why did I switch?

We used the Microsoft native tools. We switched to Active Roles because the Microsoft native tools were really for managing the core components and didn't have all the capabilities of provisioning, deprovisioning, role-based access control, and change history. They didn't have the proxy approach to manage Active Directory in a centralized way. With Microsoft, Active Directory is distributed by nature, versus ARS which centralizes it.

How was the initial setup?

One of the strengths of Active Roles is that it is easy to implement, easy to upgrade, and very intuitive, except for the workflow engine. And it's not even resource-heavy. It works on a very lightweight infrastructure and doesn't need multiple servers or any complex architecture. It's a very lean, robust, and effective tool, with low maintenance costs.

Our deployment took a couple of months, maybe less.

The tool is so straightforward that the approach was very simple. We analyzed the requirements that we had, back in the day, especially in terms of access and provision, and we just mapped them into Active Roles Server. The overall first phase of installation was very simple.

In terms of maintenance of the solution we need a part-time person, a security engineer who specializes in access technologies. The maintenance of it is super-lightweight. It's really just a few hours a month.

What was our ROI?

ROI is a very tough question because we implemented it 10 years ago. I don't have a number. But I would say that, in a large organization, Active Roles is probably something that pays back quickly. It's so integrated into our processes today, that we couldn't even think about doing without it, and replacing it with manual work.

What other advice do I have?

If you have a need to put controls on your Active Directory environment, and there is significant manual work to put those controls in place, regardless of their effectiveness, or you have a risky native configuration that has to be addressed, my advice is that a solution like this is going to do the job pretty brilliantly.

It is a great solution with a lot of capabilities. It provides different types of value for each of the capabilities that it has. Over a decade, this solution has done its job.

It's a very stable system, easy to implement, easy to upgrade, and has very low operation maintenance costs. We are a very happy customer of Active Roles.

Which deployment model are you using for this solution?

On-premises
Disclosure: IT Central Station contacted the reviewer to collect the review and to validate authenticity. The reviewer was referred by the vendor, but the review is not subject to editing or approval by the vendor.
GN
Network Analyst at a government with 501-1,000 employees
Real User
Top 10Leaderboard
Deprovision option allows us to reverse any accidental deletions

Pros and Cons

  • "Instead of deleting accounts, we like the deprovision option so that we can reverse any accidental deletions. It also gives a higher level of quality control in terms of enforcing any number of variables, such as making sure that an account has a description entered before the account can be created. We can backtrack and know the history of it that way."
  • "I've had a difficult time getting it to cooperate with Azure in the cloud and, while the support staff are very good and very knowledgeable, what they assist with just on a call doesn't go deep enough to help with a number of issues. The answer that comes back is that we'd have to start an engagement with Professional Services, which is fine but that takes time to schedule and it takes budget."

What is our primary use case?

We started using Active Roles because we wanted protection against user errors by our frontline service desk.

We have an on-premises solution.

How has it helped my organization?

Instead of deleting accounts, we like the deprovision option so that we can reverse any accidental deletions. It also gives a higher level of quality control in terms of enforcing any number of variables, such as making sure that an account has a description entered before the account can be created. We can backtrack and know the history of it that way.

It has also eliminated admin tasks that were bogging down our IT department. Before we started using Active Roles, if one of our frontline staff members deleted a user or group, it could take several hours to try to reverse that mistake. Whereas now, the most our frontline staff can do is a deprovision, which just disables everything in the background, but it's still there. We can go in and have it back the way it was two minutes later. Instead of it taking two hours, it only takes two minutes.

In addition, it reduces risk by enforcing stronger and more complex passwords that not only conform but go above and beyond the default recommendations from our Microsoft policy. It makes sure that there's a certain level of completion with anything created or provisioned through ARS. It enforces compliance, and that is definitely helpful.

For how long have I used the solution?

I've been using One Identity Active Roles for about five years.

What do I think about the stability of the solution?

It's a stable product. We have very few issues with it.

What do I think about the scalability of the solution?

Up until our migration to Office 365 and Azure, our Active Roles architecture was very static. We didn't really have to scale it out at all during that time. The only scalability exercise that we've done is trying to adapt to Azure in Office 365, and it's a challenging process to do that.

How are customer service and technical support?

The product itself is fine and works well. I've had a difficult time getting it to cooperate with Azure in the cloud and, while the support staff are very good and very knowledgeable, what they assist with just on a call doesn't go deep enough to help with a number of issues. The answer that comes back is that we'd have to start an engagement with Professional Services, which is fine but that takes time to schedule and it takes budget. And during all that, you have a delay in getting a particular part of the platform working properly.

I've worked with several One Identity support folks and they're all very knowledgeable and pleasant to deal with. But sometimes I get the feeling that their hands are tied with how much support they can give me for a specific task because it gets into that gray area of what's break/fix and what goes off to Professional Services. If it falls in that gray area, it's hit or miss whether you're going to get support from your first call or whether you have to wait until you can dedicate a whole day to it.

Support could benefit from helping with a broader area of ideas on a first-call-resolution type of model, rather than just focusing on break/fix issues. They should also help with configuration issues.

How was the initial setup?

The process was complex. We had the help of an integrator from Quest, back then. We had him come onsite and work with us. There is definitely a learning curve when it comes to setting up templates. It's a complex product, but it's good once you get the hang of it.

The initial deployment took about a couple of weeks, but that was when everything was still on-premises. There wasn't any Office 365 or Azure back then. In terms of getting our Active Roles to cooperate with Azure now, I've been struggling with that, on and off, for over a year now. That's not necessarily a fault of One Identity. Their support is partially to blame for that, but a lot of it is on my shoulders too, due to the fact that I have other responsibilities at my workplace.

We have about eight admin staff who use Active Roles daily, and pretty much all day, for user functions. We don't have end-users with any control over delegation through Active Roles, although that might be something that we explore later; we might allow some office administrators to do various functions.

Which other solutions did I evaluate?

There are a lot of other benefits that we take advantage of that are above and beyond the native Active Directory functions that Microsoft provides. There's no comparison between Active Roles and the native Microsoft tools. You can customize the interface so that you can create a user account much more quickly. Active Roles also gives you a really nice audit log of when a user account was created and of any changes that happen to that account after the fact, as long as you do those changes within Active Roles. It's a really nice way to have a full view of the lifetime of an object created through Active Roles. It's much better than the native tools.

We researched various solutions before we narrowed in on what was Quest, back then. At that time we were going through a migration from an old Microsoft domain to a new Microsoft domain and we are using a different Quest product, but we haven't evaluated any other products.

What other advice do I have?

It is a good tool and anybody who works with Microsoft Active Directory and Azure can definitely benefit from using Active Roles. But it can be challenging to get Active Roles and Azure to play nicely together, depending on how your company is configured.

For some organizations, I could see that the product could help move staff to more important IT initiatives, but we don't use it at a level that it would help us in that capacity.

The big lesson learned—and it would depend on various people's skill levels or proficiency— for a new implementation where you're working with Azure and not Office 365, would be to budget for at least a one- or two-day session with Professional Services. That would save you a lot of time, and in terms of hourly costs, you would actually probably end up saving money by buying the Professional Services session.

I am in the process of scheduling a meeting with One Identity Professional Services to start using Active Roles for migration from AD to Azure AD. We've tried to mesh our Active Roles implementation with our new Azure setup and it's been challenging. Added support is definitely needed to get over the last few humps there.

I do find it a very useful tool. I have researched other players in the field and there's not a lot out there. Active Roles has the edge. I don't see us moving to a different product, but the biggest frustration has been getting enough support out of support.

Disclosure: IT Central Station contacted the reviewer to collect the review and to validate authenticity. The reviewer was referred by the vendor, but the review is not subject to editing or approval by the vendor.
Flag as inappropriate
Kiril
Senior IT Manager at Toronto District School Board
Real User
Top 5
Captures data and transforms it into ways that are usable for the Active Directory but it could be more user-friendly

Pros and Cons

  • "Because of Active Roles, we're able to synchronize on an even more regular basis. It enables us to provide even more information to the Active Directory, which helped us to group our users in a more consistent manner."
  • "In terms of improvement, it could be made even more user-friendly for administrators when they need to create new workflows and rule sets."

What is our primary use case?

We use Active Roles to facilitate the synchronization between our Active Directory environment, SAP, and our school information system which is Trillium. Trillium and SAP feed data for employees and students into the Active Directory.

We use password managers to manage passwords and provide us with three sets of passwords and options for our users.

How has it helped my organization?

Because of Active Roles, we're able to synchronize on an even more regular basis. It enables us to provide even more information to the Active Directory, which helped us to group our users in a more consistent manner.

What is most valuable?

The way it captures data and transforms it into ways that will be usable for the Active Directory is the most valuable feature. 

We haven't found a different solution that is able to do this. We have been relying on manual scripting, which proved to be very unreliable. Active Roles is definitely much better.

It also improved our automation. It was already automated, but it improved it. It was able to capture more data out of Trillium and SAP and populate the Active Directory in an open-minded manner.

We have two staff members and so per staff member, Active Roles saves us 0.2 FTE.

Active Roles has improved the accuracy of our onboarding process. There are fewer errors during the sync.

What needs improvement?

In terms of improvement, it could be made even more user-friendly for administrators when they need to create new workflows and rulesets.

It's a bit difficult. I'm not the technical person that uses it, it's my team, but I heard comments that it is quite difficult for them to get to know the product and set up the tasks that are required.

For how long have I used the solution?

I have been using Active Roles for three years. 

What do I think about the stability of the solution?

It's very stable.

What do I think about the scalability of the solution?

I would call it scalable because we look at over a quarter of a million students' data but not on a day-to-day basis. It is pretty scalable.

Right now we have two system administrators that are using it effectively. We are still deploying further automation and optimizations.

Which solution did I use previously and why did I switch?

Previous to Active Roles, we had an in-house scripting solution.

We switched because of their better support and because of the succession of old, unsupported manual build scripting. This way we have a product that we know has a future and we have proper support.

In comparison to native Microsoft, Microsoft tools are basically non-existent for what we are using it for. The connectors for user federation and synchronization with the other solutions are non-existent.

How was the initial setup?

The initial setup was very complex. There's a steep learning curve to get to know the product and to start using it. The deployment took almost two years. 

We started first with students and then with employees for the deployment. 

What about the implementation team?

We used One Identity and we also had external resources, a contractual workforce, for the deployment. We had a positive experience. I appreciate the help that we got.

What was our ROI?

We don't see ROI in a monetary way. We are a public organization, so we don't sell anything, but I definitely have a better user experience, fewer incidents, and, therefore, better user satisfaction. From that perspective, we have absolutely seen ROI. 

What's my experience with pricing, setup cost, and licensing?

Active Roles is above average on pricing compared to similar solutions. There are no additional costs to the standard licensing fees. 

What other advice do I have?

My advice would be to make sure that you have a full-time team assigned to the solution. Take your time for the onboarding. It takes more time than we initially thought.

I would rate One Identity Active Roles a seven out of ten. 

Which deployment model are you using for this solution?

On-premises
Disclosure: IT Central Station contacted the reviewer to collect the review and to validate authenticity. The reviewer was referred by the vendor, but the review is not subject to editing or approval by the vendor.
Buyer's Guide
Download our free One Identity Active Roles Report and get advice and tips from experienced pros sharing their opinions.