Magic Quadrant For Identity Governance and Administration PDF

11.03.
2015
MagicQuadrantforIdentityGovernanceandAdministration
MagicQuadrantforIdentityGovernanceand
Administration
12January2015ID:G00261633
Analyst(s):FelixGaehtgens,BrianIverson,SteveKrapes
VIEWSUMMARY
TheIGAmarketistransforminglegacy,onpremisesIAMproducts.IGAvendorsareinvestingheavilyto
meetclientneedsineaseofuse,mobility,businessagility,andlowertotalcostofownership.User
provisioningandaccessgovernancefunctionscontinuetoconsolidate.
ADDITIONALPERSPECTIVES
CompanySize:Small&Midsize(<1000
Employees)
Industry:HealthcareProviders
STRATEGICPLANNINGASSUMPTIONS
MarketDefinition/Description
Identitygovernanceandadministration(IGA)solutionsmanageidentityandaccesslifecyclesacross
multiplesystems.Corefunctionalityincludesautomatedprovisioningofaccountsamongheterogeneous
systems,fulfillmentofaccessrequests(includingselfservice),passwordmanagement,governanceover
useraccesstotargetsystemsviaworkflowsandautomatedpolicies,andaccesscertificationprocesses.
AdditionalcapabilitiesoftenincludedinIGAsystemsareriskscoringofauser'scombinedentitlements,
segregationofduties(SOD)enforcement,rolemanagement,rolemining,auditcaseincident
management,andanalytics(historicalchange,performance,recommendationsforentitlementsor
certifications,andsoon).
VendorsinthisMagicQuadrantareratedbasedontheironpremisessolutions,butmanyalsohave
solutionsthataredeliveredasidentityandaccessmanagementasaservice(IDaaS)cloudsolutionsor
leveragethirdpartiestohostcloudsolutions.ClientslookingforSaaScentricorcloudonlysolutions
shouldconsultGartner's"MagicQuadrantforIdentityandAccessManagementasaService."
AkeyaspectofunderstandingthefutureoftheIGAmarketisknowinghowdigitalbusinesswillinfluence
IGAsystemsandpracticesoverthenearandlongterm.Gartnerbelievesdigitalbusinesswillleadto
adoptionofbimodalITandbimodalIAM.Bimodalidentityandaccessmanagement(IAM)means
runningsystemsintwomodes:onethatis"builttolast,"andonethatis"builttoadapt"toaconstantly
disruptivetechnologyenvironment.TheadaptivemodewillrequireIGAtechnologythatismoreagileand
flexible,andfacilitatesinnovationmorerapidly.
MagicQuadrant
Figure1.MagicQuadrantforIdentityGovernanceandAdministration
By2018,30%oforganizationswillhavereplaced
morethan50%ofmanualaccesscertificationand
requestapprovalsbyautomatedintelligentpolicies
drivenbyanalytics.
By2018,40%ofIGAvendorswillprovide
preconfiguredbusinessprocessframeworkstoease
deploymentforsmalltomidsizeorganizations,up
fromlessthan10%today.
EVIDENCE
Thefollowingsourceswereusedinthecreationofthis
research:
Gartnerclientinteractions
Phoneinterviewsandonlinesurveysforvendor
providedreferencesandvendorchannelpartners
Acomprehensivevendorsurveythatalignedwith
theevaluationcriteria
Secondaryresearchservicestosupporttheoverall
viabilityevaluationcriteria
Productdemosfromallparticipatingvendors
EVALUATIONCRITERIADEFINITIONS
AbilitytoExecute
Product/Service:Coregoodsandservicesofferedby
thevendorforthedefinedmarket.Thisincludes
currentproduct/servicecapabilities,quality,feature
sets,skillsandsoon,whetherofferednativelyor
throughOEMagreements/partnershipsasdefinedin
themarketdefinitionanddetailedinthesubcriteria.
OverallViability:Viabilityincludesanassessmentof
theoverallorganization'sfinancialhealth,thefinancial
andpracticalsuccessofthebusinessunit,andthe
likelihoodthattheindividualbusinessunitwillcontinue
investingintheproduct,willcontinueofferingthe
productandwilladvancethestateoftheartwithinthe
organization'sportfolioofproducts.
SalesExecution/Pricing:Thevendor'scapabilitiesin
allpresalesactivitiesandthestructurethatsupports
them.Thisincludesdealmanagement,pricingand
negotiation,presalessupport,andtheoverall
effectivenessofthesaleschannel.
MarketResponsiveness/Record:Abilitytorespond,
changedirection,beflexibleandachievecompetitive
successasopportunitiesdevelop,competitorsact,
customerneedsevolveandmarketdynamicschange.
Thiscriterionalsoconsidersthevendor'shistoryof
responsiveness.
MarketingExecution:Theclarity,quality,creativity
andefficacyofprogramsdesignedtodeliverthe
organization'smessagetoinfluencethemarket,
promotethebrandandbusiness,increaseawareness
oftheproducts,andestablishapositiveidentification
withtheproduct/brandandorganizationintheminds
ofbuyers.This"mindshare"canbedrivenbya
combinationofpublicity,promotionalinitiatives,
thoughtleadership,wordofmouthandsalesactivities.
CustomerExperience:Relationships,productsand
services/programsthatenableclientstobesuccessful
withtheproductsevaluated.Specifically,thisincludes
thewayscustomersreceivetechnicalsupportor
accountsupport.Thiscanalsoincludeancillarytools,
customersupportprograms(andthequalitythereof),
availabilityofusergroups,servicelevelagreements
andsoon.
Operations:Theabilityoftheorganizationtomeet
http://www.gartner.com/technology/reprints.do?id=127CNZU9&ct=150112&st=sb
1/19
11.03.2015
itsgoalsandcommitments.Factorsincludethequality
oftheorganizationalstructure,includingskills,
experiences,programs,systemsandothervehicles
thatenabletheorganizationtooperateeffectivelyand
efficientlyonanongoingbasis.
CompletenessofVision
MarketUnderstanding:Abilityofthevendorto
understandbuyers'wantsandneedsandtotranslate
thoseintoproductsandservices.Vendorsthatshow
thehighestdegreeofvisionlistentoandunderstand
buyers'wantsandneeds,andcanshapeorenhance
thosewiththeiraddedvision.
MarketingStrategy:Aclear,differentiatedsetof
messagesconsistentlycommunicatedthroughoutthe
organizationandexternalizedthroughthewebsite,
advertising,customerprogramsandpositioning
statements.
SalesStrategy:Thestrategyforsellingproductsthat
usestheappropriatenetworkofdirectandindirect
sales,marketing,service,andcommunication
affiliatesthatextendthescopeanddepthofmarket
reach,skills,expertise,technologies,servicesandthe
customerbase.
Offering(Product)Strategy:Thevendor'sapproach
toproductdevelopmentanddeliverythatemphasizes
differentiation,functionality,methodologyandfeature
setsastheymaptocurrentandfuturerequirements.
BusinessModel:Thesoundnessandlogicofthe
vendor'sunderlyingbusinessproposition.
Vertical/IndustryStrategy:Thevendor'sstrategy
todirectresources,skillsandofferingstomeetthe
specificneedsofindividualmarketsegments,including
verticalmarkets.
Innovation:Direct,related,complementaryand
synergisticlayoutsofresources,expertiseorcapital
forinvestment,consolidation,defensiveorpre
emptivepurposes.
Source:Gartner(January2015)
VendorStrengthsandCautions
GeographicStrategy:Thevendor'sstrategytodirect
resources,skillsandofferingstomeetthespecific
needsofgeographiesoutsidethe"home"ornative
geography,eitherdirectlyorthroughpartners,
channelsandsubsidiariesasappropriateforthat
geographyandmarket.
AlertEnterprise
CaliforniabasedAlertEnterpriseoffersitsflagshipEnterpriseGuardiansuiteofproductsthathasthe
abilitytoextendbeyondtraditionalIAMforlogicalassetstowardareasofphysicalsecurityandoperational
technology(OT),includingvisitormanagement,badging,andrealtimeinterfacestosupervisorycontrol
anddataacquisition(SCADA)industrialcontrolsystems.Theplatformalsoincludesthreatandrisk
behavioralanalyticsbycombiningidentityinformationwithuseractivityfeeds,suchasaccesstointernal
computersystemsoutsideofanemployee'sworkhours.
TheAlertEnterpriseplatformhasarangeofverticalofferingsaimedatoilandgas,utilities,chemicals,
pharmaceuticals,andotherregulatedindustriesthatmakeupalargepercentageofitscustomerbase
followedbyairportsandgovernments.Themajorityofitscustomersmanagebetween5,000and25,000
users(theaverageis7,000).
Strengths
Itsproductexcelsatmanaginganentitlementcatalogwithvalueaddedmetadataandprovidesfull
supportforthekeyproductscenariosfromtheevaluationcriterialistedbelow.
AclearfocusontheintegrationofIAMandOTgivesAlertEnterpriseauniquestandingamongall
vendorsintheIGAmarket.
FiftyfivepercentofitsstaffworkinR&D,enablingthecompanytoinnovatequickly,asevidenced
bytherecentreleaseofcompliancecontentpacksforNERCCIPV5andTSATeloscredentialing
systems.
Cautions
AlertEnterpriseneedstogrowitslimitedpartnernetworkinordertoincreasedeliverycapacityand
salesthathavebeengrowingbutlatelyhavetaperedofftoaratewellbelowtheindustryaverageof
15%annualgrowth.
CustomersatisfactionwithsupportandmaintenanceisbelowtheaverageforvendorsinthisMagic
Quadrant,butpositiveoverall.
BuyersshouldbevigilantinverifyingthattheirfutureIGAplansalignwithAlertEnterprise'sroad
map,becauseitisfocusedonIT/OTintegrationratherthanmoregeneralIGAtrends.
Atos
Atos,headquarteredinFrance,hasanIGAdivisioninGermanyproducingDirXIdentityandAccess
Management.TheDirXproductsappealtoorganizationswithcomplexITenvironmentsoruniquevertical
requirementsthatarelookingforaturnkeysolutionorforAtostoprovideamanagedservice.
Itscustomerbaseismadeupofmanyverticals,withthelargestbeinggovernmentatover25%,
manufacturingandnaturalresourcesat20%,andhealthcareat15%.Themajorityofitscustomers
managebetween25,000and1millionusers(theaverageis375,000)andautomatedprovisioningto
betweensixand50targets.
Strengths
AtosishighlyfocusedonprovidingIGAsolutionsthatarespecializedfortheneedsofdifferent
verticalindustries.
2/19
11.03.2015
AmajorityofreferencecustomersrankedDirXasstronginflexibility,scalability,connectorsupport
andstability.
Itisoneofafewvendorstofeaturephysicalandlogicalsecurityintegration,aswellasITandOT
integration,initsproductstrategy.
Cautions
AtosrecentlyacquiredBull,whichownsEvidian,soAtosisnowinpossessionoftwoIGAproducts
withsignificantoverlap.ClientsarestronglyadvisedtoseekclarityfromAtosonproductroadmaps.
ItdoesnothavedistinctivemarketingforitsIGAproductsandhaslowvisibilityinthegeneral
market.
Itsuserinterfaceandworkflowprocessesuseamixofdifferenttechnologies:Tcl,Javaand
JavaScript,makingtheproductmoredifficulttomaintain.
Avatier
Avatier,basedinCalifornia,offerstheAvatierIdentityManagementSuite(AIMS)withmultiple,
separatelylicensedmodules.AIMSisagoodfitfororganizationswithlimitedresourcesthatemphasize
simplicityandautomationthroughselfservice.TheproductextendstheIAMselfserviceinterface,
workflowandgovernancecapabilitiestoamoregeneralservicecatalogtoletusersrequest,governand
administerotherassetsbeyondaccountsandpermissions,suchascomputers,officesupplies,andsoon.
Avatier'scustomersarediversifiedacrossindustryverticals.Manufacturingandnaturalresources,
followedbyhealthcareandeducationarethestrongestsectors.Themajorityofitscustomersmanage
between3,000and50,000users(theaverageis15,000)andprovisionbetweenoneandfivetarget
systems.
Strengths
AvatierremainsanimbleIAMplayerthatisbroadeningitssuitewithoutlosingfocusonusability,
fasttimetovalueandeaseofmaintenance.
Itsadministrativeandenduserinterfacesupports30languages,includingmanydoublebyteAsian
languagesandnearlyeveryEuropeanlanguage,andithasrecentlyopenedsalesofficesinAustralia
andSingapore,though80%ofitssalesareinNorthAmerica.
Itrespondedrapidlytomobilemarketandcompliancerequirementsbyofferingappsforaccess
requestandpasswordmanagementonallmajormobileplatforms.
Cautions
ItlagsbehindtheaveragevendorinthisMagicQuadrantinbringingIGAfeaturestomarket,which
maybearesultofhavingfewerR&Dresourcesthanexpectedforacompanyofitssize.
ItsIGAchannelnetworkisstilllimited,asmostpartnersresellonlyAvatier'spasswordresetand
singlesignon(SSO)offerings.
Itsproductlagsbehindincapabilitiessuchasthelackofarolebasedapproachformanagingand
certifyingaccessentitlements,andscoresinthelowestquartileofthe"productorservice"
evaluationcriterion.
BetaSystems
GermanybasedBetaSystemsoffersitsSecurityAccessManagerEnterpriseIdentityManager(SAMEIM)
forgovernanceandprovisioningfunctions,andGarancyAccessIntelligenceManager(AIM)foranalytics.
BetaSystemsisagoodfitforenterpriseswithcomplexrequirements,andthosethatneedhighly
customizableenvironments.BetaSystems'supportformanagingmainframesecurityisricherthanthat
ofmostcompetingproductsbecauseSAMEIM'soriginswereinthemainframemarkethowever,more
thanhalfofitscurrentcustomersrunonnonmainframeplatforms.
AboutthreequartersofitscustomersareinEuropetherestareinNorthAmerica.Mostcustomers
servicethebanking,securitiesandinsurancesectors.Transportationandhealthcarefollow.Themajority
ofitscustomersmanagebetween2,000and250,000users(theaverageis27,000)withautomated
provisioningofbetweenfourand900targetsystems.
Strengths
BetaSystemsappealstoclientsbeyonditstraditionalfinancialandinsurancesectorcustomerbase
througheffectivetargetedmarketingpairedwithgoodmarketunderstanding.
IthasinvestedheavilyinIGAoverthepastyearandisprogressingwellonatechnologyrefresh.
Ithasastronginternalfocusonquality,andreceiveshighcustomersatisfactionrankingswith
productandsupportandmaintenance.
Cautions
Itsgeographicalreachislimited,andeffortstoexpandinternationalofficesinEuropeandNorth
Americahaveyettoyieldresults.
SAMEIM'senduserinterfaceisdesignedforthetechnicaluser,notthebusinessuser,althougha
newUIisintheworksaspartofthetechnologyrefresh.
BetaSystemsisclosingmoredeals,butdealsizeissmaller,causingsalesgrowthtobelargelyflat.
CATechnologies
NewYorkbasedCATechnologiesofferstheCAIdentitySuitethatincludestheCAIdentityPortalasa
commonuserinterfaceforthetwodistinctproducts:CAIdentityManager(provisioning)andCAIdentity
Governance(governance).Itisagoodfitfororganizationsemphasizingrequirementsforaccessrequest
androleandmanagement.
CATechnologiesisamajorvendorintheIAMmarketandoffersanextensivesuiteofenterprisesecurity
products.Itscustomerbasespansallmajorindustrieswithaparticularlydeeppresenceinbanking,
securitiesandinsurance,government,andutilities.Themajorityofitscustomersmanagebetween
10,000and200,000identities,withautomatedprovisioningbetweentwoand2,700targetsystems.
Strengths
3/19
11.03.2015
IthasaglobalpresenceandlargechannelnetworkthatenablesitsIGAproductstobesoldand
deployedworldwide.
IthasmadesignificantinvestmentsinitsIGAproducts,includingSystemforCrossDomainIdentity
Management(SCIM)connectorsforSaaSendpoints,SOAPandRESTWebservicesinterfaces,and
theCAIdentityPortalthatcentralizesauser'sviewofentitlementdataandprovidesanintuitive
accessrequestshoppingcartexperience.
Itstandsoutformakingcreativeuseofsocialmediainitsmarketingandingettingmainstream
mediaattention.
Cautions
Itsworkflowengineiscomplextoconfigure,especiallywhenworkingwithrequestsformultiple
resources.
Referencecustomersrateditinthelowestquartileinsatisfactionforproductand
support/maintenancethoughitisstillratedpositiveoverall.
Ithasfallenbehindincore,onpremisesenterpriseproductcapabilities,sinceitsinnovationhas
beenfocusedmostlyonsupportingconsumeridentitymanagementandcloudusecases.
Courion
Courion,basedinMassachusetts,offerstheCourionAccessAssuranceSuite(AAS),consistingofseveral
modulesthatcanbelicensedseparately.TheAccessInsightmodulecanbedeployedontopofincumbent
IGAsolutionsfromothervendorstoprovidedetailedidentityandaccessintelligencethroughanalytics.
Courionhasastrongstandingwithenterprisesofupto25,000users,anddoeswellinregulated
industrieswithrequirementsingovernance,auditingandanalytics.
MorethanathirdofCourion'scustomersareinhealthcare,followedbybanking,securitiesandinsurance,
andmanufacturingandnaturalresources.Themajorityofitscustomersmanagebetween1,500and
30,000users(withanaverageof20,000)withautomatedfulfillmentofthreeto80systems.However,
somereferenceshadsignificantlyhigheridentityandsystemnumbers.
Strengths
AASwastheonlyproducttoconsistentlyperformwellacrosseveryproductscenariowithinthis
MagicQuadrant'sevaluationcriteria,incontrastwiththeothervendors'productsthateachhad
poorresultsinseveraloftheevaluatedproductscenarios.
Referencecustomersreportedsatisfactionwiththeproduct,andsupportisamongthehighestofall
vendorsevaluated.Allreferencecustomersindicatedthattheywerehighlylikelytorecommendthe
producttoothers.
Itsuniquelydifferentiatedmarketingmessageemphasizesanalyticsfor"intelligent"IAMand
resonateswithcustomersandprospects.
Cautions
Somepartnerrelationshipshavebeenproblematicandhaveaffecteditscustomers.
GartnerhearsfrequentcomplaintsaboutthetimelinessandconsistencyofCourion'sdeliveryof
professionalservices.
Courionlistsmorethan350connectorsavailableforitsproducts,butGartnerclientsindicatethat
Courionhasdifficultieswiththequalityofnewlydevelopedconnectorsandwithproviding
maintenanceupdatesinatimelymanner.
Dell
TexasbasedDelldevelopsitsIGAproduct,DellOneIdentityManager,inGermany.Itissoldinseparate
editionswithdifferentmodules.IthasastrongfollowinginEurope,whereithasbeenlocalizedin13
languages.ItisagoodfitforcompaniesrequiringstronggovernanceanddeepSAPintegration.
Customers'verticalsarebanking,securities,insurance,communicationsandmediaservices.Themajority
ofitscustomersmanagebetween1,000and37,000identities(theaverageis20,000),andmostrun
automatedprovisioningfromoneto10targetsystems.
Strengths
Itsproductprovidesverygoodpolicymanagement,contextualinformationforapproversand
certifiers,andworkflowreroutingcapabilities.
Allreferencecustomersreportedthattheproductwaseasytouseandhadtechnicallyproficient
outofboxfunctionality.
TheDellCommunityisasuccessfulforumfacilitatinginteractionsbetweenproductengineeringstaff
andcustomers.
Cautions
DellhasnotmanagedtoreplicateitsEuropeanIGAsuccessinothergeographiesnotablyinNorth
America.
Itsreferencecustomers'satisfactionratewithsupportandmaintenance,whilestillpositiveoverall,
isamongthelowestofallvendors.
SeveralreferencecustomersnotedthatfindingexperiencedtalentforDell'ssolutionisdifficult.
ResourcesfromDellareinlimitedsupplywhichhasbeenconfirmedbyGartnerclients.
EMC(RSA)
MassachusettsbasedRSA,theSecurityDivisionofEMC,acquiredoneofthepioneersintheIGAspace,
Aveksa,lastyear.RSAIdentityManagementandGovernance(RSAIMG),isofferedinmodulesthatare
pricedandlicensedseparately.Itisagoodfitfororganizationswithheavygovernancerequirements.RSA
hasworkedhardonanautomatedfulfillmentandprovisioningmodulehowever,thisisnewandnotin
wideuse.
RSAhascustomersacrossallmajorindustryverticals,withhalfofitscustomersinbanking,securities
andinsurance.Themajorityofitscustomersmanagebetween5,000and250,000identities(the
4/19
11.03.2015
averageis35,000).OnlyathirdofcustomerreferencesusedRSAIMGtoautomaticallyprovisionto
targetsystemswithmostprovisioningbetweenthreetoeighttargets.
Strengths
RSAIMGscoredabovetheaverageacrossallproductcapabilitiesexceptforidentitylifecycleand
passwordmanagementandscoresveryhighinscalabilityandperformance.
RSAisleveragingitsArchergovernance,riskandcompliance(GRC)andIGAproductsforupsell
opportunitiestoorganizationswithheavycompliancerequirements.
RSAisveryresponsivetomarkettrendsanddemonstratesoneofthehighestlevelsofinnovation.
Cautions
Itsambitiousglobalpartnerstrategyisintheearlydaysofexecution,whichmaystrainits
professionalservicesdeliverycapacityintimesofhighdemand.
Referencecustomersatisfactionscoresareinthelowestquartileamongallvendors(thoughstillin
positiveterritory).
RSAIMGisbeingsoldforpricesoverthemarketaverage.
Evidian
FrancebasedEvidianoffersIdentityandAccessManager(EvidianI&AM),whichincludesWebaccess
management(WAM)capabilitiesandsynchronization,policy,provisioningandmanagementmodules.
Duetoitslowerintegrationandmaintenancecosts,Evidianisagoodfitforarangeofsmallandmidsize
business(SMB)andenterpriseclientsthatneedselfserviceinterfacesandworkflowautomationwith
modestgovernancerequirements.
Healthcare,banking,securitiesandinsuranceaccountfor50%ofEvidian'scustomers.Government,
communications,mediaandservices,manufacturing,andnaturalresourcesarestrongestwithother
verticals.Themajorityofitscustomersmanagebetween400and20,000identitiesandautomated
provisioningbetweentwoand17targetsystems.Somecustomershavesignificantlyhigheridentity
counts.
Strengths
Goodvisibilityacrossmediaandfrequentparticipationatindustryeventshavegrownthebrandin
relevantmarketsandverticals.
Ithasastrongchannelnetworkthatisresponsiblefornearlyhalfofitsrevenueandsurveyed
partnersgiveconsistentpositivefeedback.
Itsresponsivenesstomarkettrends,standardsandregulatoryneedsisaboveaverageand
demonstratesagoodmarketunderstanding,productstrategyandinnovation.
Cautions
SupportforaccesscertificationandSODisbasic,andtheproductlacksrolemininganalyticsrole
miningisavailableonlyviaprofessionalservices.
AtosrecentlyacquiredBull,whichownsEvidian,soitisnowinpossessionoftwoIGAproductswith
significantoverlap.ClientsarestronglyadvisedtoseekclarityfromAtosandEvidianonproductroad
maps.
Evidian'sproductsarenotusedoutsideEMEA,apartfromalimitednumberofJapanese
deployments.
FischerInternational
FloridabasedFischerInternationalhasalonghistorywithIGA.MostcustomersarerunningitsFischer
IdentitySuiteasaservicehowever,manyrunthisproductonpremises.Itsofferingallowsextensive
configurationandisappealingtoorganizationswithlimitedgovernancerequirementsthatneedto
managemanyexternalidentities.
FischerInternationalisstronginhighereducation(nearly50%inthatvertical),followedby
manufacturingandnaturalresources,bankingsecuritiesandinsurance,andutilities.Themajorityofits
customersmanagebetween1,250and250,000identities(theaverageis16,000),withautomated
provisioningforbetweenfiveandsixtargetsystems.
Strengths
Referencecustomersatisfactionratingsfortheproductandforsupportandmaintenanceareamong
thehighestofallvendorsevaluated.
FischerInternational'sclearanddifferentiatedmessagingforhighereducationcreatesstrong
awarenessandbrandrecognitionattheexpenseofbeingignoredbymanycustomersinmost
otherverticals.
Itsturnkeyhighereducationofferingisquicklydeployedandintegrateswithtypicaloncampusand
cloudbasedsystems.
Cautions
FischerInternationalhasnopresenceoutsidetheU.S.andonlyaverysmallnumberof
internationalpartners.
Buyersshouldbevigilantinverifyingthatthevastmajorityoftheirbusinessneedsarealignedwith
theproduct'soutoftheboxcapabilities,becauseFischer'sproductstrategyemphasizes
configuration,withlimitedsupportforcustomizedcodetointegratenonconformingbusiness
processes.
Limitedgovernanceandanalyticscapabilitiesmakeitdifficulttoestablishafootprintinregulated
industries.
HitachiIDSystems
CanadabasedHitachiIDofferstheHitachiIDIdentityandAccessManagementSuite,withseveral
modulesthatcanbelicensedseparately.ItispopularwithNorthAmericanITbuyerswhoarelookingfor
aflexibleaccountandpasswordmanagementsolutionwithstrongsupportforpolicybasedadministration
5/19
11.03.2015
andisofferedin17languages.
Thethreelargestcustomerverticalsincludebanking,securitiesandinsurance,whichaccountforone
thirdofthebusiness,followedbymanufacturing,naturalresourcesandeducation.Themajorityofits
customersmanagebetween5,000and25,000identities,withautomatedprovisioningofbetweenthree
and140targetsystems.Only25%ofreferencecustomersareusingitsaccesscertificationcapabilities.
Strengths
Allreferencecustomersindicatedthattheywereeitherlikelyorhighlylikelytorecommendthe
producttoothers.
Theproductreducesdeploymentriskandtotalcostofownershipbyprovidingoutofthebox
referencebuildsthatsupporttypicalidentitylifecyclepatterns.
HitachiIDprovidesalloptionsandallconnectorsinoneproduct,thusavoidingthemultimodule
purchasingdilemma(buynoworlater)thatcustomersfacewithsomeothervendors.
Cautions
BytargetingITbuyersonly,itrisksbeingoverlookedbybusinessdecisionmakers.
ItsenduserinterfaceisatechnicallyefficientdisplayoftextandtablesthatwillbeacceptabletoIT
usersbutmaynotbeappealingtobusinessusers.
Itlacksastronginternationalcustomerbase,as85%ofitscustomersareinNorthAmerica.
IdentityAutomation
TexasbasedIdentityAutomationoffersRapidIdentityforselfserviceanddelegationandincludes
workflow,accessrequests,accesscertification,passwordmanagement,auditing,reporting,group
management,andfolder/fileaccessmanagement.IdentityAutomationisagoodfitforNorthAmerican
customerswhorequireasolutionwithautomatedprovisioning,accessrequestandworkflowcapabilities.
IdentityAutomation'scustomerstypicallybuyanIGAsystemthatisconfiguredand/orcustomizedbythe
vendorviaanaddedcostprofessionalservicesengagement.Mostreferencecustomersareineducation
anduseautomatedprovisioningofupto10targetsystems.Themajorityofitscustomersmanage
between7,000and250,000identities(theaverageis75,000),althoughthereisonenotablecustomer
withasignificantlyhigheridentitycount.
Strengths
IdentityAutomation'spricingstrategyappealstotheeducationmarket,sinceitcountsonlyfulltime
employeesbutnotstudents.
Referencecustomersindicatetheyliketheflexible,highlyconfigurableandeasytocustomize
products.
Referencecustomersatisfactionratesareamongthehighestofallvendorssurveyed.The
customersallcommentedonthestronglevelofsupport,easeofuse,andflexibility.
Cautions
Thelackofapartnernetworkcouldimpedelongtermgrowthitisasmall,emergingproduct
companythathastransformedfromaconsultancy.
ItsgeographicalcoverageislimitedtoNorthAmerica,anditsproductsareonlyavailableinEnglish.
IdentityAutomationprovidesreapprovalstiedtospecificresourcesbutthereisnosupportfor
creatingadhoccertificationcampaignsorforidentityanalytics.
IBM
NewYorkbasedIBMoffersIBMSecurityIdentityGovernanceandAdministration,asuitethatcombines
IBMSecurityIdentityManager(ISIM)withtherecentlyacquiredCrossIdeasplatform,nownamedIBM
SecurityIdentityGovernance.IBMisagoodchoiceforlargeorganizationswithcomplexprocessesthat
needautomationandgovernancecapabilitiesandarewillingtoinvestinsignificantprofessional
services.
Onefifthofitscustomersareinbanking,securitiesandinsurance,withtherestevenlydistributedacross
allotherindustryverticals.Mostreferencecustomersaremanagingbetween4,500and85,000identities
(theaverageis27,000),withautomatedprovisioningofbetweentwoand100targetsystems.
Strengths
TheCrossIdeasacquisitionhasreinvigoratedIBM'sGlobalAccount(IGA)productline,addingsomeof
themostadvancedgovernancecapabilities.
Itslarge,globalpresenceallowsproductstobesoldeffectivelyeverywhere.
IBMhasaverysuccessful,heavilyinvestedchannelnetwork.Surveyedvalueaddedresellers(VARs)
indicatehighpartnershipsatisfaction.
Cautions
TheISIMbusinessuserinterfacehasgarneredcriticismfromGartnerclients,whichIBMhasstarted
toaddress,butthereisstillalargeamountofworkahead.
TheintegrationofCrossIdeasintoaharmoniousofferingwilltakesignificantworkandtime.
HalfofIBM'sreferencecustomersmentionedthattheproductiscomplexandrequiresasteep
learningcurve,whichisinlinewithourinteractionswithGartnerclients.
NetIQ
TexasbasedNetIQoffersitsNetIQIdentityManagerwithseveraloptionalmodules,includinganAccess
Reviewgovernancecomponent.Additionally,itoffersNetIQAccessGovernanceSuite(AGS),whichisa
whitelabeledversionofSailPoint'sgovernanceproductthatissoldandsupportedbyNetIQunderanOEM
agreement.BothNetIQIdentityManagerandAGSwereevaluatedasacombinedsolutionforthe
purposesofthisMagicQuadrant.NetIQ'sproductsshouldespeciallyappealtoorganizationsthatare
lookingforaflexiblesolutionthatprovidestheabilitytoscaleovertimewithstrongautomationand
provisioningcapabilities.
6/19
11.03.2015
Itscustomersareevenlydistributedovermultipleverticals,ledbygovernmentwithaboutonefifth.The
majorityofitscustomersmanagebetween100to50,000(theaverageis7,000)identities,with
automatedprovisioningofbetweenthreeand250targets.Somecustomershavesignificantlyhigher
identitycounts.
Strengths
NetIQisratedhighlyforsupportandmaintenancebyreferencecustomers.
Ithasawelldeveloped,worldwidechannelnetworkthatprovideslocalexperienceandhelpstosell
itsproductsglobally.
Severalreferencecustomersfromsmallerinstallationstoverylargedeploymentshave
commentedpositivelyonscalability.
Cautions
NetIQdoesnotpromoteitsverticalindustrycapabilitiestotheirfullpotential,withdifferentiated
marketingmessagingortargetedofferings.
WithoutAGS,NetIQ'scapabilitiesforaccesscertificationandidentityanalyticsarebelowtheaverage
ofothervendorsinthisMagicQuadrant.
Ratherthanofferingalibraryofreadytousetemplatesorworkflows,NetIQreliesheavilyonsystem
integratorstoaddtheseinclientdeployments.
Omada
DenmarkbasedOmadaofferstheOmadaIdentitySuite(OIS).OISshouldparticularlyappealto
organizationswithcomplexITenvironmentsorthosethatareheavilyinvestedinMicrosoftand/orSAP
systemsandthatrequireaflexiblesolutionwithstrongreportingcapabilities.
OnequarterofOmada'scustomersarewithinbanking,securitiesandinsurance,andonefifthisin
healthcare.Therestofitscustomersareevenlysplitacrosstheremainingverticals.Themajorityofits
customersmanagebetween1,600to100,000identities(theaverageis35,000)withautomated
provisioningofbetweenoneand250targets.
Strengths
Omadahasahighlyflexibledatamodel,ranksinthehighestquartileforoverallproductscores,and
scoredveryhighinauditing,reportinganddashboards.
Omada'sgeographicstrategyispayingoff,withincreasedcustomernumbersinNorthAmericaand
stronggrowthinCentralEurope.
Pricingforitsproductisverycompetitive,especiallyforusercountsoflessthan20,000.
Cautions
AlthoughOmadaisprofitableandgrows,revenuegrowthfromsoftwarehassloweddownoverthe
pasttwoyears,reflectinglowinvestmentinsalesandmarketing.
OmadahasinvestedinprovisioningcapabilitiesasanalternativeoptiontoutilizingMicrosoft
ForefrontIdentityManager(FIM)synchronizationforfulfillmentandconnectors,butitsreplacement
capabilitiesarebelowaverage.
Itsdesiretouseitsownprofessionalservicesimpedesneededpartnerexpansionandresultsin
somecompetitivepartnersituations.
Oracle
CaliforniabasedOracleoffersitsOracleIdentityGovernance(OIG)Suite,whichisespeciallysuitedfor
largeorganizationswithcomplexprocessesandthatrequireflexibilityintheproduct.
IGAcustomersarespreadevenlyacrossindustryverticals.Itsreferencecustomersmanagebetween
about1,100and500,000identities(theaverageis95,000),withautomatedprovisioningbetweenone
and450targets.
Strengths
Itisthemostfrequentlyshortlistedvendoramongothervendors'referencecustomersandthe
vendormostoftencitedasthecompetitortobeatbytheothersincludedinthisMagicQuadrant.
AddingOracle'sIGAsolutiontoaportfolioofotherOracleIAMproductscanleveragesynergies
betweenthoseproducts,makingitappealingtoexistingOraclecustomersthatviewthecompanyas
astrategicpartner.
Itsglobalpresenceandglobalchannelpartnersenableittobedeployedworldwide.
Referencecustomershighlightedreliability,scalability,performanceandflexibilityasstrongpoints.
Cautions
Twothirdsofreferencecustomersciteproductcomplexityasachallengeandweakpoint.Expect
significantprofessionalservicesinvestment.
OIGisbydefaultlicensedonaperprocessoror,uponrequest,onaperuserbasis.WhileCPUbased
licensingcanbeattractiveforlargeuserpopulations,additionalprocessorlicensesmaybenecessary
whenoverallactivityincreases,whichcancomplicatelongtermbudgeting.
SeveralreferencecustomershaveexperiencedchallengeskeepingupwithOracle'sproduct
consolidationandrefurbishmentoverthepasttwoyears,whichisinlinewithourinteractionswith
Gartnerclients.ThisisexpectedtostabilizewithOIGversion11gR2PS3.
SailPoint
TexasbasedSailPoint,oneofthepioneersofidentityandaccessgovernancetechnology,offersIdentityIQ
withseveraloptionalmodules.Itsproductshouldappealtoorganizationswithstringentgovernance
requirementsthatalsoneedamoderatelevelofprovisioning(upto250targets).
Almosthalfofitscustomersareinbanking,securitiesandinsurance.Therestaredistributedevenly
amongotherverticals.Themajorityofitscustomersmanagebetween5,000and80,000identities(the
7/19
11.03.2015
averageis40,000),withautomatedprovisioningofbetweentwoand94targets.However,therearea
fewcustomerswithsignificantlyhigheridentitycounts.
Strengths
AwellfunctioningandlargepartnernetworkgivesSailPointmomentumtosellanddeployits
productsworldwide,andprovidesanabundanceofprofessionalservicesskillsets.
Referencecustomersindicatesatisfactionratesfortheproduct,andsupportandmaintenancearein
thehighestquartileinthisreport.
Itsproductscoresamongthehighestacrosstraditionalgovernancecapabilitiesbecauseofits
excellentaccesscertificationandrolemanagementfeatures.
Cautions
Itsproductisoneofthemostexpensiveonesforusercountsoflessthan10,000.
Onethirdofitsreferencecustomersreportperformanceandscalabilityproblemshowever,those
referencecustomersusingthelatestreleasereportearlysignsofimprovement.
SailPointhasredesignedandupgradeditsprovisioningandfulfillmentcapabilities,yetthequalityof
someconnectorsisstilllaggingbehind.
SAP
GermanybasedSAPoffersanIGAsolutionconsistingoffivemodules,includingSAPIdentityManagement
andSAPAccessControl.ItssolutionadministratesusersandprovisionsaccountswithinSAPapplications
andoutsidetargetsystems,andprovidesgovernancecapabilitiesforheterogeneousenvironmentsand
SODcontrolsmanagementforSAPapplications.ItsproductsareanexcellentfitforexistingSAP
customerswhocantakeadvantageofitsextensiveandunequalledSAPapplicationintegration.
ItscustomersarefoundacrossabroadrangeofSAP'sbusinessandtechnologysoftware,leveraging
commonmasterdataandprocessesforidentityandaccess.Itscustomersaredistributedevenlyacross
verticals,withutilities,manufacturingandnaturalresourceseachmakinguponefifth.Customer
referenceswereintherangeof1,200to60,000identitiesmanaged(withanaverageof20,000),and
usedupto70targetsforautomatedprovisioning(withanaverageof20).
Strengths
SAPAccessControlisastrongroleperformer,includesdeeptransactionsupportandisabletowork
withmultipleapplicationspecificrolestructures.
SAPhasanextensiveglobalpresenceandalargenetworkofVARsandsystemintegratorsthatcan
deliverglobalservices.
SAPhasastrongfocusonproductqualityaspartsofitsoperationalprocesses.
Cautions
SAP'smarketingcommunicationstargetonlyexistingSAPcustomersandlackdifferentiationfrom
typicalmessagesintheindustry.
OrganizationswithoutasignificantcommitmenttoSAPapplicationsandtechnologyshouldlookfor
otherIGAalternatives.
Referencecustomershaveindicatedthattheoveralladministrationofthesolution,andtrackingand
monitoringerrorsinprovisioningworkflowsisdifficult.
TheDotNetFactory
OhiobasedTheDotNetFactoryoffersEmpowerIDarichsuiteofIAMtoolsthatincludeIGA
capabilities.ItsproductshouldappealtoorganizationsthataremainlyrunningonaMicrosoft
environmentandarelookingforflexibilityandstrongautomationcapabilities.
Gartnerestimatesthatabouttwothirdsofitscustomersaredividedamonghealthcare,banking,
securitiesandinsurance,andgovernment.TheDotNetFactorydidnotrespondtorequestsfor
supplementalinformation,butitdidreviewthedraftcontentsofthisdocument.Gartner'sanalysisis
basedonothercrediblesources,includinginformationthatTheDotNetFactoryprovidedforlastyear's
research,publicinformation,andconversationswiththreeusersofitsproduct.Themajorityofits
customersmanagebetween1,000and25,000identities.Somecustomershavesignificantlyhigher
identitycounts.
Strengths
Allusersinterviewedwerepositiveabouttheflexibilityoftheproductandthe"candoattitude"of
thecompany.
TheDotNetFactoryiseffectiveatleveragingsocialmediaandonlinecommunityforumstoprovide
responsiveanddetailedproducttrainingandsupport.
Itsproducthasextensiveworkflowcapabilitiesandcomeswithhundredsofpredefinedworkflows.
Cautions
Averysmallchannelnetworkandlimitedtechnicalresourceshamperthecompany'sabilityto
extenditsreachandscalethebusiness.
Customersreportthatdocumentationforinternaldatastructuresandproprietaryfunctionsis
lacking,socustomershavetoengageTheDotNetFactoryformostcustomizations.
Thecompany'smarketingstrategyandmarketingexecutionlagsthenormofothervendorsratedin
thisresearch.BytargetingITbuyersonly,itrisksbeingoverlookedbybusinessdecisionmakers.
VendorsAddedandDropped
WereviewandadjustourinclusioncriteriaforMagicQuadrantsandMarketScopesasmarketschange.As
aresultoftheseadjustments,themixofvendorsinanyMagicQuadrantorMarketScopemaychange
overtime.Avendor'sappearanceinaMagicQuadrantorMarketScopeoneyearandnotthenextdoes
notnecessarilyindicatethatwehavechangedouropinionofthatvendor.Itmaybeareflectionofa
changeinthemarketand,therefore,changedevaluationcriteria,orofachangeoffocusbythatvendor.
8/19
11.03.2015
Added
IdentityAutomation
TheDotNetFactory
Dropped
ThefollowingvendorshavecredibleIGAofferingsbutdidnotmeettheelevatedinclusioncriteriaforthis
MagicQuadrant:
Caradigm,basedinthestateofWashington,hasasingularfocusonthehealthcaremarketand
hasforthatreasonbeenexcludedfromthisMagicQuadrant.
Brazilbasedetrust'sHoraciusproducthasbeendevelopedwithafocusonsecurityand
governance.Itemphasizesconfigurationovercustomization,andhasspecialcapabilitiestohelpits
customerscomplywithBrazilianfederalregulationsconcerningdataprivacyandintegrationwiththe
eSocialgovernmentportal,makingitpopularinthatgeography.
SingaporebasedDeepIdentityoffersanIGAsolutioninformofitsDeepIdentityAudit&
ComplianceManager(DeepIACM),DeepIdentityManager(DeepIM)andDeepDataGovernance
Manager(DeepDGM)products.TheproductsarepopularinAsia,andthecompanyisstartingto
expanditsgeographicalreachthroughpartnerships.
iSMSecuSysisbasedinGermanyandoffersIGAfunctionalitythroughitsbiCubeIAMsuite.The
producthasalonghistoryandappealstobuyersintheGermanspeakingDACHregion(Germany,
Austria,Switzerland),asitalignswithtypicalbusinessprocessesandusagepatternscommonto
thatgeography.
OtherNotableVendors
ThefollowingvendorshavecredibleIGAofferings,butdidnotmeettheelevatedInclusionCriteriaforthis
MagicQuadrant:
Brainwave,basedinFrance,offersitsIdentityGRCsolution,withafocusonthemanagementand
monitoringofcontrolsoveruseraccess,withastrongemphasisonanalyticsandreporting.Its
primarycustomerverticalisbankingandfinanceinFranceandtheBeneluxregionofEurope.
ForgeRock,basedinCalifornia,offersanopensourceproductcalledOpenIDMwithafocuson
RESTbasedAPIsandonscalability,whichmakesitpopularwithorganizationsneedinglarge
customerorcitizenfacingprovisioningsolutions.Itisgainingtractionamongenterprisecustomers
worldwide.
GermanybasedFSP'sproductOrganizationandResourceGuards(ORG)providesIGAfunctionality
onz/OS,UnixandWindows.ItenjoyspopularityintheGermaninsurancesector.
Microsoft'sForefrontIdentityManager(FIM)productprovidesaccessmanagementanddata
synchronizationfeaturestoMicrosoftandnonMicrosoftapplicationsandinfrastructure.UpuntilMay
2014,Microsoftdidnotconfirmplanstoevolvethisproductwithmajorreleasesbeyond2015.Since
then,MicrosofthasannouncedalongtermroadmapandhasrebrandedtheproductasMicrosoft
IdentityManager(apublicpreviewwasreleased13November2014).Thepublicpreviewdisplayed
manynewcapabilitieshowever,veryfewofthemfallintoGartner'sdefinitionofIGA.Microsofthas
announcedinvestmentinIGAspecificcapabilitiesforsubsequentversions(after2015).Gartnerwill
closelymonitorMicrosoftIdentityManagerforpotentialinclusioninfutureIGAMagicQuadrants.
NewYorkbasedOpenIAM,providesanopensourceproduct,IdentityManager,thatincludesIGA
functionality,includinguserprovisioning,passwordmanagement,auditinganddelegated
administration.Itisdeployedworldwidebycustomersacrossmultipleverticals.
SpanishvendorSoffidprovidesanopensourceproductcalledIdentity&AccessManagement.The
producthascomprehensiveIGAcapabilitiesandenjoyspopularityinSpain,andthecompanyis
extendingitsgeographicalreachthroughpartnershipsinotherregions,notablyEurope,Asia/Pacific
andLatinAmerica.
InclusionandExclusionCriteria
InclusionCriteria
WhilethereareIAMproductsthatdeliversomeofthefunctionalitylistedbelow,thisIGAMagicQuadrant
coversvendorsthatcontainallofthesefeaturesinaproductspecificallytailoredandsoldtomanage
accessrequestlifecycles.Thesecorefeaturesconsistof:
Userinterfaceconfigurationformultipleuserprofiles
Capabilitiestosupporttheidentityandentitlementlifecycles
Toolsforapplicationentitlementdiscovery,miningandmanagement
Toolsforrolediscoveryandengineering(thatis,theidentitydatamodel)
Capabilitiestocreateandeditmasterdatarelatedtoidentityandaccess
Capabilitiestoconsumedatafrommultipleauthoritativesourcesoftruth
Toolstocertifydatarelatedtoidentityandaccessdatabyspecifiedactors(managers,
resource/applicationowners,andsoon)
Comprehensiveworkflowcapabilities
ToolstoreconciledatafromtargetsystemswithIGAdata
Toolstomanageandsynchronizepasswordsamongdifferenttargetsystems
Toolstosupportauditing,andsegregationofdutyadministrationandcompliance
Toolsforuserorapplicationroleandentitlementadministration,andmanagement
Toolsfordefiningandenforcingidentityandaccesspolicies,aswellasremediationofviolations
Configurableloggingforidentityandaccessactivitiesandactionsforadministrativeandendusers
Analyticsandreportingofidentityandaccessactivitiesandactionsforadministrativeandendusers
Underlyingarchitecturefortheabove,includingconnectorarchitecturefordatacollectionand
fulfillmentactions
Productsmustbedeployedincustomerproductionenvironments,andcustomerreferencesmustbe
9/19
11.03.2015
available.
ExclusionCriteria
IGAvendorsthatarenotincludedinthisMagicQuadranthavebeenexcludedforoneormoreofthese
reasons:
Thesevendors:
DonotmeetatleasthalfoftheInclusionCriteria
SupplyIGAcapabilitiesforonlyonespecific/targetedtechnicalenvironmentforexample,
Windows,IBMi,Unix/Linux,andsoon
SupplyIGAcapabilitiesonlyasaservice
Had2013licenserevenueforonpremisesIGAproductsthatwaslessthan$1million
ArenottheoriginalmanufactureroftheIGAproductsincludingvalueaddedresellersthat
repackageIGAproductsthatwouldqualifyfromtheiroriginalmanufacturers
IncludeothersoftwarevendorsthatsellIAMrelatedproductsbutdon'thaveanIGAproductoftheir
own
Areexternalserviceproviders(ESPs)thatprovidemanagedservicesforexample,datacenter
operationsoutsourcing
EvaluationCriteria
Gartneranalystsevaluateprovidersonthequalityandefficacyoftheprocesses,systems,methodsor
proceduresthatenableITproviderperformancetobecompetitive,efficientandeffective,andtopositively
impactrevenue,retentionandreputation.Ultimately,providersarejudgedontheirabilityandsuccessin
capitalizingontheirvision.
EachMagicQuadranthastwoevaluationcategories:AbilitytoExecuteandCompletenessofVision.
Eachisdescribedbelow,withsubcriteriaandweightingsprovided.
AbilitytoExecute
ProductorService
Coreonpremisesproductsofferedbythevendorservethedefinedmarket.Thisincludescurrentproduct
capabilities,quality,featuresets,skills,andsoon,asdefinedinthemarketdefinitionanddetailedinthe
subcriteria(capabilities).Thespecificsubcriteriaare:
Identitylifecycle
Entitlementsmanagement
Accessrequests
Workflow
Policymanagement
Accesscertification
Fulfillment
Passwordmanagement
Rolemanagement
Auditing
Analytics
Reportinganddashboards
Easeofdeployment
Scalabilityandperformance
OverallViability
Viabilityincludesanassessmentof:
Thevendor'soverallfinancialhealth
Thepracticalandfinancialsuccessofthebusinessunit
ThecontinuedinvestmentbyabusinessunitinitsIGAproduct
Theadvancementofstateoftheartfunctionalitywithintheorganization'sportfolioofIGAproducts
Ahistoryofinvestmentinidentityandaccessmanagementproductdevelopment
ThecontributionofIGAtorevenuegrowth
SalesExecution/Pricing
TheIGAprovider'scapabilitiesinallpresalesactivitiesandthestructurethatsupportsthem.Thisincludes
dealmanagement,pricingandnegotiation,presalessupport,andtheoveralleffectivenessofthesales
channel.Factorsincludepricing,marketshareandadditionalpurchases(forexample,relationaldatabase
managementsystem[RDBMS],applicationserver,Webserver,andsoon).
MarketResponsiveness/Record
Thevendor'sdemonstratedabilitytorespond,changedirection,beflexibleandachievecompetitive
successasopportunitiesdevelop,competitorsact,andmarketdynamicschange
Howthevendorcanmeetcustomers'evolvingIGAneedsoveravarietyofusecases
HowthevendorhasembracedstandardsinitiativesintheIGAandadjacentmarketsegmentsand
respondedtorelevantregulationandlegislation
10/19
11.03.2015
MarketingExecution
Theclarity,quality,creativityandefficacyofprogramsdesignedtodeliverthevendor'smessageto
influencethemarket,promotethebrandandbusiness,increaseawarenessoftheproducts,andestablish
apositiveidentificationwiththeproduct/brandandvendorinthemindsofbuyers.
Thismindsharecanbedrivenbyacombinationofpublicity,promotionalinitiatives,thoughtleadership,
wordofmouthandsalesactivities.
CustomerExperience
Relationships,productsandservices/programsthatenablecustomerstobesuccessfulwiththeIGA
productsevaluated.Specifically,thisincludesthewayscustomersreceivetechnicalsupportoraccount
support.Thiscanincludeancillarytools,customersupportprograms(andthequalitythereof),availability
ofusergroups,servicelevelagreements,andsoon.Factorsincludecustomersupportprograms,service
levelagreements,andGartnerclientandreferencecustomerfeedback.
Operations
TheabilityoftheorganizationtomeetitsgoalsandcommitmentsregardingitsIGAproduct.Factors
includethequalityoftheorganizationalstructure,includingskills,experience,programs,systemsand
othervehiclesthatenabletheorganizationtooperateeffectivelyandefficientlyonanongoingbasis.
Factorsincludestaffingandrecruitmentandnumberofmajorreorganizationsinpast12months.
Table1.AbilitytoExecuteEvaluation
Criteria
EvaluationCriteria
Weighting
ProductorService
High
OverallViability
Medium
SalesExecution/Pricing
Medium
MarketResponsiveness/Record
Medium
MarketingExecution
Medium
CustomerExperience
High
Operations
Medium
CompletenessofVision
MarketUnderstanding
Theabilityofthevendortounderstandbuyers'needsandtranslatetheseneedsintoproductsand
services.Vendorsthatshowthehighestdegreeofvisionlistenandunderstandbuyers'wantsandneeds,
andcanshapeorenhancethosewantswiththeiraddedvision.Factorsinclude:
Understandingcustomerneeds
Identifyingmarkettrendsandchanges
MarketingStrategy
Theclarity,differentiationandperformancemanagementofthevendor'smarketingmessagesand
campaigns.
Theappropriatenessofthevendor'suseofsocialmedia,otheronlinemediaandtraditionalmediaaspart
ofitsmarketingefforts.
SalesStrategy
Thestrategyforsellingproductthatusestheappropriatenetworkofdirectandindirectsales,marketing,
service,andcommunicationaffiliatesthatextendthescopeanddepthofmarketreach,skills,expertise,
technologies,servicesandthecustomerbase.
Offering(Product)Strategy
Thevendor'sapproachtodevelopinganddeliveringitsIGAofferingsthatmeetcustomers'andprospects'
needswithrespecttotheirkeyselectioncriteria,theneedscreatedbytheNexusofForcesandother
marketdynamics.
Factorsinclude:
Howthevendorwillincreasethecompetitivedifferentiationofitsproducts
Thevendor'sabilitytoexploittheNexusofForcestoimproveitsproducts
Thevendor'sparticipationinIGAandadjacentstandardsdevelopment
BusinessModel
Thesoundnessandlogicofthevendor'sunderlyingbusinessproposition.
Vertical/IndustryStrategy
Thevendor'sstrategytodirectresources,skills,andofferingstomeetthespecificneedsofindividual
marketsegments,includingSMBs,serviceprovidersandverticals.
11/19
11.03.2015
Innovation
Thevendor'scultureofinnovation,continuingtrackrecordinmarketleadinginnovation,andthe
provisionofdistinctiveproducts,functions,capabilities,pricingmodels,andsoon.Wefocusontechnical
andnontechnicalinnovationsintroducedsinceJuly2013,aswellasthevendor'sroadmapoverthenext
fewyears.
GeographicStrategy
Thevendor'sstrategytodirectresources,skillsandofferingstomeetthespecificneedsofgeographies
outsidethe"home"ornativegeography,eitherdirectlyorthroughpartners,channelsandsubsidiaries,as
appropriateforthatgeographyandmarket.
Table2.CompletenessofVision
EvaluationCriteria
EvaluationCriteria
Weighting
MarketUnderstanding
High
MarketingStrategy
Medium
SalesStrategy
Medium
Offering(Product)Strategy
High
BusinessModel
Medium
Vertical/IndustryStrategy
Low
Innovation
High
GeographicStrategy
Low
QuadrantDescriptions
Leaders
IGALeadersdeliveracomprehensivetoolsetforgovernanceandadministrationofidentityandaccess.
Thesevendorshavesuccessfullybuiltasignificantinstalledcustomerbaseandrevenuestream,andhave
highviabilityratingsandrobustrevenuegrowth.Leadersalsoshowevidenceofsuperiorvisionand
executionforanticipatedrequirementsrelatedtotechnology,methodologyormeansofdelivery.Leaders
typicallydemonstratecustomersatisfactionwithIGAcapabilitiesand/orrelatedserviceandsupport.
Challengers
IGAChallengersdeliverarelativelystrongsetofgovernanceandadministrationfeaturesforidentityand
access.SomehavemajorclientsusingtheirIGAsolution.Challengersalsoshowstrongexecution,and
mosthavesignificantsalesandbrandpresence.However,Challengershavenotyetdemonstratedthe
featurecompleteness,scaleofdeploymentorvisionforIGAthatLeadershave.Rather,theirvisionand
executionfortechnology,methodologyand/ormeansofdeliverytendtobemorefocusedorrestrictedto
specificplatforms,geographiesorservice.ClientsofChallengersarerelativelysatisfiedbutaskfor
additionalIGAfeaturesastheymature.
Visionaries
VendorsintheVisionariesquadrantprovideproductsthatmeetmanyIGAclientrequirements,butmay
nothavethemeans(suchasbudget,personnel,geographicpresence,visibilityandsoon)toexecuteas
Leadersdo.Duetosmallersize,theremaybeinitialconcernsamongsomepotentialbuyersoflongterm
viability.VisionariesarenotedfortheirinnovativeapproachtoIGAtechnology,methodologyand/or
meansofdelivery.Theyoftenmayhaveuniquefeatures,andmaybefocusedonaspecificindustryor
specificsetofusecases,moresothanothers.Visionariesareoftenthetechnologyleadersinevolving
marketssuchasIGA,andenterprisesthatseekthelatestsolutionsoftenlooktoVisionaries.
NichePlayers
NichePlayersprovideIGAtechnologythatisagoodmatchforspecificIGAuses,casesormethodology.
Theymayfocusonspecificindustriesandcanactuallyoutperformmanycompetitors.Theymayfocus
theirIGAfeaturesprimarilyonaspecificvendor'sapplications,dataand/orinfrastructure.Vendorsinthis
quadrantoftenhaveasmallinstalledbase,alimitedinvestmentinIGA,ageographicallylimitedfootprint,
orotherfactorsthatinhibitprovidingabroadersetofcapabilitiestoenterprisesnowandduringthe12
monthplanninghorizon.Inclusioninthisquadrant,however,doesnotreflectnegativelyonthevendor's
valueinthemorenarrowlyfocusedservicespectrum.Nichesolutionscanbeveryeffectiveintheirarea
offocus.
Context
In2013,GartnercoveredtheIGAmarketforthefirsttimewithabrandnew,inclusiveMagicQuadrant,
withacomprehensivelistofvendorsthatestablishedtheIGAmarketasthecombinationofuser
administrationandprovisioning(UAP)andidentityandaccessgovernance(IAG).In2014,Gartner
recalibratedtofocusonclientswhowillbemakepurchasingdecisionsforIGAproductswithinthenext
year.Thesearesignificantinvestments,andclientswillneedtobeassuredthattheirpurchasing
decisionsalignwiththetrendsthatimpacthoworganizationswillrunIGAtechnologyovermanyyears.
AnticipatingfutureneedsisacrucialandimportantcomponentofhowGartnerweighsitsevaluation
criteria,ratingsandscoringofIGAvendors.
GartnerbelievesdigitalbusinessisanimportantoverallITtrendthatwillleadtoadoptionofbimodalIT,
andwithitwillcomebimodalIAM.BimodalIAMmeansrunningsystemsintwomodes:onethatis"built
tolast"andonethatis"builttoadapt"toaconstantdisruptiveenvironment.Theadaptivemodewill
requiretechnologythatismoreagile,flexibleandfacilitatesinnovation.
Forthesereasonsstatedabove,wehaveadjustedourevaluationcriteriaweightingtoreflectthe
12/19
11.03.2015
following:
Theadaptive/agilemodeofITwillrequireorganizationstolookforatransformationalproduct
strategythatreflectsconstantinnovationanddevelopmentfromvendors.Forthisreason,Gartner
loweredtheweightingsformarketingstrategy,salesstrategy,vertical/industrystrategyand
geographicstrategyintheCompletenessofVisioncategoryinordertogivearelativelystronger
focustomarketunderstanding,offering(product)strategyandinnovation.
ForAbilitytoExecute,Gartnerloweredtheweightingformarketingexecutionandsales
execution/pricingbecauseinnovations,excellentproductsandgoodcustomerexperiencesshould
carrymoreweightthanrevenuenumbersandmindshare.Gartnerloweredmarket
responsiveness/recordbecausetrueinnovatorswillleadfuturetrendsbeforethemarkethastimeto
adopt.
YourneedsandcircumstancesshoulddeterminehowyouusetheMagicQuadrant,nottheotherway
around.ToevaluatevendorsintheLeadersquadrantonlyandignorethoseinotherquadrantsisrisky
andthusdiscouraged.Forexample,avendorintheNichePlayersquadrantcouldofferfunctionsthatare
ideallysuitedtoyourneeds.Similarly,aLeadermaynotofferfunctionsthatmeetyourrequirements
forexample,itsofferingsmaycostmorethancompetitorsoritmaynotsupportyourregionorindustry.
UseaMagicQuadranttonarrowyourlistofchoices,butdonotbaseyourdecisiononlyonthemodel.
TalktotheGartneranalystswhocreatedtheresearchformoredetailsandinsight.
VendorpositioninginMagicQuadrantsillustratesusefulinformationaboutvendors.Forexample,ifyou
wanttomakeastrategicinvestmentinatechnology,avendor'sviabilitywillbecritical.Therefore,weight
avendor'sAbilitytoExecutemoreheavilythanitsCompletenessofVision,andevaluateChallengers
beforeVisionaries.Conversely,ifyoucangainacompetitiveadvantagebyinvestinginanemerging
technology,evaluateVisionariesbeforeChallengers.
OrganizationsthattakeonIAMinitiativeswillrequireacombinationofseveraltechnologies.IGAisthe
centraltechnologythatmanagestheinformationaboutidentities,accountsandentitlements.It
interacts,andinsomecasesevenoverlapswith:
Authentication:Corroborationofclaimedidentitiesandcredentialmanagement.IGAproducts
oftenincludepasswordmanagementaspartoftheoffering(see"MarketGuideforPassword
ManagementTools").
Authorization:TheseincludeWebaccessmanagement(WAM),APIgateways,managementtools,
andexternalizedauthorizationmanagement.Thesefunctionsleverageidentityinformation
managedbyIGAproducts,andworktogetherwithauthenticationtechnologytocontrolaccessto
resources(see"MarketGuideforWebAccessManagementSoftware").
DirectoryServices:TheseholdinformationaboutusersandgroupsandareprovisionedbyIGA.
PrivilegedAccountManagement(PAM):Thesetoolsareusedtoenforcepoliciesconcerning
privilegedaccess,andtheycomplementIGAtools.WhereIGAtoolsmanageaccountsandidentities,
PAMtoolscontrolaccesstoprivilegedaccountsandwillenforceprocessesandmonitortheuseof
administrativeprivileges(see"MarketGuideforPrivilegedAccountManagement").
AlternativestoIGASoftware
ActiveDirectoryfocus:OrganizationswhoseusecasesarecenteredaroundtheMicrosoft
environmentmaybeabletouseMicrosoftcentricresourceadministrationtoolsinlieuofIGAtools
tomanageidentities,accountsandpermissionswithinthisrestrictedscenario(see"Technology
OverviewforActiveDirectoryIAMTools").
CloudandSaaS:OrganizationsmayopttorunIGAservicesinthecloudbysubscribingtoan
IDaaSvendor.Thisisaviablealternativeforsmallorganizations,thosethathavesimpleIGA
requirementsorthosethatrunaconsiderableamountofinfrastructureinthecloud.Maturityand
capabilitiesforpurecloudIGAisstillbehindonpremisesIGAwiththeexceptionofservice
providersthatrunadedicatedinstanceofanonpremisesIGAproductasamanagedserviceinthe
cloud(see"MagicQuadrantforIdentityandAccessManagementasaService").
SelectionCriteria
OrganizationsshouldconsiderIGAproductsfromvendorsineveryquadrantofthisMagicQuadrantbased
ontheirspecificfunctionalandoperationalrequirements.Productselectiondecisionsshouldbedrivenby
severalfactors:
Whatisthetotalcostrelatedtodeployingthetool,includinganyconsultingorprofessionalservices?
Whatistheestimatedlengthoftimeneededtodeploythetools?
Doesthevendorhaveanefficient,workingpartnernetworkthatcanquicklydeliverspecialized
servicesaroundthedeploymentandoperationoftheIGAproducts?
Issupportavailablelocally,inthelanguageofmyorganizationandduringregularbusinesshours
withinmygeographies?
Howeasyisittointegratethistechnologyintomyexistinginfrastructure?WillmyITorganization
beabletosupportit?
Willmybusinessusersfinditeasytoworkwiththistechnology?Howwillitenablethem,andthe
business?
Doesthisvendorhelpmyorganizationdelivercompliancewithsecuritypoliciesandregulationsmore
effectively?
MarketOverview
In2013,Gartnerobservedanincreaseintheconsolidationofgovernanceandadministrationfunctionsas
forcesinsocial,mobile,cloudandinformationcontinuedtotakeroot.Thisyear,majorvendorsare
expandingcapabilitiesinareaswheretheywerenotlastyear:Provisioningcentricplayersareinvestingin
IGAgovernancefocusedspecialistsarebuildingoutprovisioningandfulfillment.
Gartnerobservesthefollowingtrends:
MostvendorshaveaddedmobileappsorspecialmobileWebinterfacestocatertotargeted
13/19
11.03.2015
businessrequirementssuchasapprovalprocesses,passwordreset,accessrequestsand
certifications.Demandforintegrationwithenterprisemobilitymanagement(EMM)productshas
grown.
Whilesomeproductsofferanalyticsfortraditionalusecasessuchasrolemining,othervendors
movebeyondtheseusecasestoaddsupportforadvancedriskanalysis,finegrainedSODanalysis
forERPproducts,anddecisionsupportforapprovalsandcertifications.Inthelongrun,analyticsis
expectedtoenableautomationofpoliciestoeventuallymakemanualapprovalsorcertifications
obsolete.
Anacceleratedconsolidationofgovernanceandprovisioningfunctionsintoasingleproduct,
ratherthantwodistinctproductswithdifferentinterfaces,istakingplace.Provisioningcentric
vendorsareinvestingingovernancegovernancecentricvendorsarebuildingouttheirprovisioning
andfulfillmentcapabilities.
SCIMsupportforSaaSprovisioningisgrowing,andsomevendorsareevenusingSCIMinternallyin
thebackboneoftheirconnectorframework.
Emphasisontotalcostofownershipasaselectioncriterionhascontinued.Thisdrivesadoptionof
"goodenough"solutionsfromsmallervendorsinsideandoutsidetheMagicQuadrant.Thisisalso
puttingpressureonsalestooffercompetitivepricinganddiscounts,ratherthanvaluebasedpricing.
Thereiscontinuedinterestintheuserexperienceasaselectioncriterionacrossarangeof
businessusecases.TheageofIGAusersbeingstrictlyITusersisrapidlydeclining.
Anincreasedfocusonthreatprotection,includinginsiderthreats,isdrivingintegrationofIGA
productswithoverallthreatdetectionandanalysistools,specificallywithSIEMproducts.
IntegrationbetweenIGAproductsandPAMproductsisstillinitsearlystages,drivenbyinterest
fromclientsandcompetitionfromvendorsthatstraddlethePAMandIGAmarkets.
Afewvendorsareaddingbusinessagilitycapabilitiestoembraceteambasedprojectusecases
(suchasaccessandapprovalchainstiedtoprojectmembership)orpeoplehavingmultiplepersonas
(suchasanemployeewhoperformsadifferentsetoftasksunderadifferentsupervisorasaresult
ofastrikeorweatherrelatedemergencyassignment).
Thereisarushtoalleviatecomplexdeploymentandupgradeprocesses,withvirtualappliance
basedmodelsbecomingmorepopular.Severalvendorshavealsomadesignificanteffortstomake
theirproducteasiertodeploy,administrate,customizeandtrace/debug(especiallyintermsof
workflowsandconnectors).
Similarly,afewvendorsareprovidinglibrariesofworkflowtemplatestobetterfitcommon
businessprocesses,therebyreducingstartupcost/timeandsimplifyingcustomization.
Someofthosevendorsareeventakingthelaststepfurther,providingasetofreferencebuilds
thatbringtogetherworkflowtemplatesanduserexperienceelementstoproduceaspecific
configurationoftheirproductthatismorecloselyalignedwiththeneedsofthecustomer.
OrganizationsthathavehadIGAplatformsforfiveplusyearsarebeginningtoreevaluatetheir
vendorplatforms,lookingforabetteruserexperience,reducedoverhead(fewerpeopleneedto
support/configuretheproduct),easeofdeploymentandincreasedscalability.
In2014,themarketsizeforIGAisestimatedtobe$1.52billionwithanannualgrowthrateof13.94%
from2013to2014($1.31billionto$1.52billion).Thisyear,GartnerhasrevisedtheformulaforIGA
marketsizebasedonadetailedreevaluationofthemarketbasedonthenumberofvendorrevenue
guidanceandforecastgrowthexpectations.VarianceinIGApricingisdecreasingasseveralmajorvendors
arecompetingmoreonpricewithheavierdiscounts.Totalcostofownershiphasbeenunderclient
scrutiny,soseveralvendorsaresimplifyingdeployments,offeringmorepricingoptionsorreducingpricing.
In2015,GartnerexpectstheconsumerizationofIGAwhichbeganin2014formanyvendorsto
continuetogrow:Businessdemandforuserfriendlyinterfacesissostrongthatmanyvendorshavecited
UIupgradesonproductroadmaps.Fourotherareasthatareemergingincludebusinessagility,data
accessgovernance,privilegedaccessandsecurity.
Businessagility:ThisisanemergingdriverforIGAproductsspecifically.Somevendorsareadding
capabilitiestoextenddatamodelsforteambasedprojectusecasesandpartnershipsbetween
organizationsthatdrivecollaborativeefficiencies.
Dataaccessgovernance:Severalvendorshavereportedasignificantuptickincustomerinterest
forintegrationofIGAwithdataaccessgovernance(DAG)products.Onevendorhasanofferingand
manyarepartneringwithDAGvendors.
Privilegedaccess:IntegrationbetweenIGAproductsandPAMproductsisstillintheearlystages,
butisdrivenbyinterestfromclientsandcompetitionfromvendorsthatstraddlethePAMandIGA
markets.
Security:Anincreasedfocusonthreatprotection,includinginsiderthreats,isdrivingintegrationof
IGAproductswithoverallthreatdetectionandanalysistools,specificallywithSIEMproducts.
Small&Midsize(<1000Employees)Context
10March2015
Analyst(s):FelixGaehtgens,BrianIverson,SteveKrapes
MidsizeorganizationshavesimilarIAMbusinessrequirementstothoseoflargerorganizations,buttheir
smallersizedictatesasimplerIGAproductthatfocusesonachievinglowcostITefficiency.Thisresearch
helpsmidsizeorganizationswithselectingandevaluatingIGAvendors.
MarketDifferentiators
Midsizeorganizationshavenotuniformlyadoptedidentitygovernanceandadministration(IGA)
technologyforseveralreasons:
Manyarenotpubliclytradedorregulatedand,therefore,donotfacethesamelevelofcompliance
pressure.
IGAtechnologyhashistoricallybeenexpensivetobuy,difficulttodeployandrequiredexpertskillsto
beusedeffectively.
14/19
11.03.2015
Stakeholdersinmidsizeorganizationshavefewerresourcesavailableandaredifficulttoconvinceto
makelargeinvestmentsonimprovinginternalsecuritypostureandimprovinguserandaccess
management.
However,manymidsizeorganizationsfacemanyofthesameissuesaslargerorganizations:
RepetitivetimeconsumingadministrationtasksaroundgrantingentitlementsleavetheIT
departmentwithlittleornoaccountabilityorproperjustification.Thisisabiggerproblemformidsize
organizationsbecausetheytypicallyhavefewerITstaff.
Longturnaroundtimesforaccessrequestsleadtoalossofemployeeefficiency.
Alackofafullidentityandentitlementlifecycleleadstoaccessbeinggrantedwhenitshouldnot,
anditnotbeingremovedwhenitisnolongerneededtherebyincreasingrisk.
Forthesereasons,midsizeorganizationsshouldnothesitatetoadoptIGAtechnologyespeciallysince
itsoveralltotalcostofownership(TCO)hascomedown.Themostcommonlycitedbusinessdriverfor
midsizeorganizationsisreducedoperationalcostviaITefficiency(processautomationthateliminated
tediousmanualtasks).Governanceisrarelyontheradarofprivatelyheldmidsizeorganizations,except
forthosethatareregulated.However,riskmanagementisatangibleandachievablegoalevenby
companiesthatdonothavealargededicatedsecurityandriskstaffandshould,therefore,notbe
forgotten.Indeed,aninitialfocusongovernancemeansanunderstandingofwhohasaccesstowhatand
sincewhen,whoauthorizedit,andwhenwasthislastreviewed?Gettingtheanswerstothesequestions
willmotivatemanyorganizationsto"cleanupthehouse,"identifyrisksandgaps,andintheprocess,
streamlinethedeploymentofautomationfunctions.
ConsiderationsforTechnologyandServiceSelection
Midsizeorganizationsrarelyhavetheoptiontostaffdedicatedidentityandaccessmanagement(IAM)
teams,andcanonlydedicatelimitedorexternalresourcestotheoperationofIGAinfrastructure.IGA
productswillthereforeneedtobeeasytodeployandintegrateformostmidmarketITdepartments.They
alsoneedtobemaintainablewithfewresources.Formidsizeorganizations,thisoftenrequiresadopting
solutionswithoutoftheboxfeatures,andavoidingorminimizingcustomizationasmuchaspossible.
ThistypicallyrequirestheadoptionofstandardIAMidentityandentitlementlifecycleprocessesthatare
providedbymostproducts.Midsizeorganizationsmayfinditeasiertoadoptprocesses,buteveninthat
case,rememberthatIAMisfirstandforemostabusinesschangeinitiativeratherthanatechnical
project.Thischangewillrequireexecutivesponsorshiptobringstakeholdersfromotherlinesofthe
businessonboard.
Managingrelationshipswithlargeandcomplexvendorsisalwayschallengingformidsizeorganizations,
especiallybecausetheydonothavethecloutorimportanceintermsofaccounttogainspecialattention
fromthelargervendor.Unlessanestablishedrelationshipwithalargecomplexvendoralreadyexistsand
isworkingwell,midsizeorganizationsshouldlookforsmaller,moreagilevendors,orvendorswhohavea
largeandeffectivechannelpartnernetwork,tofindavendororresellerthatworkswellforthem.
Costofthesolutionisanotherimportantconsideration.Theoverallcostofownershipisaffectedbymany
factors,oneofthembeingthelicenseprice.Somevendorshavehighlistpricesbutdiscountheavilyfor
largerusercounts.Thesediscountsareunobtainablebymidsizeorganizations,makingthosevendorsless
attractivecomparedtovendorswhostartwithreasonablepricingforsmallerdealsizes.
Similartothelicenseprice,compositionoftheofferisanotherimportantfactor.Bundledsolutionsthat
includeeverything(especiallyallrequiredconnectors)foronesetpricecanbeattractivebecausethey
eliminatesurpriseadditionalcosts.Ontheotherhand,somevendorsofferrightsizedentrylevelbundles
thatmaywellfittheIAMrequirementsandscaleofmidsizeorganizations.WhentheIAMleaderclearly
understandsthescopeoftheIGArequirementsforthenextthreeyears,bundleshaveproventobea
goodfitformostmidsizeorganizations.Iftherequirementsarelikelytochange,theformeroptionmay
provetobemoreattractive.
"CriticalCapabilitiesforIdentityGovernanceandAdministration"hasausecaseforSmallorMidsize
Business.Theusecaseusesweightingsoptimizedforsmallandmidsizebusinessestorankseveral
vendorsagainsteachotherbasedontechnicalcapabilities.
ManymidsizeorganizationshavesystemarchitecturesthatarecenteredonActiveDirectoryand
Microsofttechnologies.Theseorganizationsshouldalsomaptheirrequirementsagainstofferingsby
vendorsofferingdelegatedmanagementtoolsforActiveDirectory(see"TechnologyOverviewforActive
DirectoryIAMTools").ThosedelegatedmanagementtoolsarelessfunctionalthanfullyfledgedIGAtools,
buttheymaybejustenoughifActiveDirectoryistheonly,orpredominant,targetforidentityand
access.Theyaredescribedinalisttowardtheendofthisdocument.
NotableVendors
VendorsincludedinthisMagicQuadrantPerspectivehavecustomersthataresuccessfullyusingtheir
productsandservices.SelectionsarebasedonanalystopinionandreferencesthatvalidateITprovider
claimshowever,thisisnotanexhaustivelistoranalysisofvendorsinthismarket.Usethisperspective
asaresourceforevaluations,butexplorethemarketfurthertogaugetheabilityofeachvendorto
addressyouruniquebusinessproblemsandtechnicalconcerns.Considerthisresearchaspartofyourdue
diligenceandinconjunctionwithdiscussionswithGartneranalystsandotherresources.
AvatierisfocusedonlowTCOforitssolutionsandstandsoutinusability,spendingconsiderableefforton
makingitsproductseasytouse,whichisconfirmedbycustomerreferences.SelfserviceonPCandall
majormobileplatformsiswellintegratedandservestoincreaseefficiencyandreduceadministrationtime
fortheITdepartment.Thesolutionisavailableinmultiplemodules,allowingorganizationstostartsmall
andexpandovertime.AnoptionalAdvancedConnectorPackageincludesmorethan100additional
connectorsinadditiontotheActiveDirectoryconnectorthatisincludedinthebasepackage.
BetaSystemshastraditionallybeenfocusedmoreonlargeaccounts,butismakingaconcertedeffortto
makeitsproductappealtothemidmarket.Itofferstwostarterpackages,calledFastForwardIAM,for
midsizebusinesses.Theyarepricedat120,000forupto2,000users,or180,000forupto4,000
users.ThepackagesincludeSAMEnterprise,includingthreestandardconnectors,SAMBusinessProcess
Workflowandprofessionalservicesinafixedpricepackagethataddressesthecoreneedsofmidsize
organizationsandisfocusedonaquickreturnoninvestmentbythoseclients.Thisisanewoffering,
15/19
11.03.2015
however,andGartnerdoeshavefeedbackfrommidmarketreferencecustomers,butnotfromcustomers
whopurchasedthisparticularstandardpackage.BetaSystemsisstronginEuropeandhasgrownits
presenceandmarketshareinNorthAmericaoverthepastfewyears.
Dellhasmanymidmarketcustomersthathavecommentedontheeaseofadministration.ItsIGA
productcomeswithmanypredefinedworkflowsandishighlyconfigurable.Itsuserinterfaceisintuitive
bothforadministratorsaswellasforendusers.Dellachievesthehighestscoreofallvendorsforthe
SmallorMidsizeBusinessusecasein"CriticalCapabilitiesforIdentityGovernanceandAdministration."
Itsbaseversionincludesoutoftheboxconnectorsformajordirectories,databasesandMicrosoft
technologies.Pricingisamongthelowestfromallvendorsfortypicalmidsizeenterpriserequirements.
ConnectorsforERPsystemssuchasSAPandOracleEBusinessSuite(EBS)areavailableasanadditional
option.
OnethirdofEvidian'scustomersaremidsizeorganizations,reflectingafocusonthismarketwithan
integratedsolutionthatismatchedtotypicalrequirementsforthisconstituency.Thecompanyoffersa
quickstartmethodologytodeployasimpleIAMsolutionformidsizeorganizationsthatallowsthemto
certifyandmanageaccessforabusinessapplication.Midmarketcustomershavecommentedpositively
onthecompletenessandmodularityofthesolution.Pricingformidsizeconfigurationsisattractive.
EvidianwillmostlyappealtoEuropeanorganizationsduetoalimitedpresenceelsewhere.
FischerInternationalhasastrongstandingintheNorthAmericanmidsizeenterprisemarket.Its
solutionsareeasytodeploy,maintainandconfigure,andtheycomewithanintuitiveuserinterfacefor
usersandadministrators.Pricingisamongthelowestfromallvendorsfortypicalmidsizeenterprise
requirements,includingallexistingconnectors.Connectorsfortargetsystemsthatarenotyetavailable
canbedevelopedbythevendorforafee.Referencecustomershaveconsistentlylaudedthecompanyfor
deliveringexcellentsupport.
HitachiIDSystems'IGAsolutionisavailableinseveraldifferentreferencebuilds(preconfiguredand
packagededitions)thatminimizetimetodeployand,therefore,lowerTCO.HitachiIDistiedforsecond
placefortheSmallorMidsizeBusinessusecasein"CriticalCapabilitiesforIdentityGovernanceand
Administration."Theproducthasmodesthardwarerequirements,andpricingisamongthelowestfrom
allvendorsfortypicalmidsizeenterpriserequirements,andincludesallfeaturesandconnectors.Italso
hasmanyuniquepasswordmanagementfeaturessuchasmanagingprebootpasswordsthatcansave
valuabletimefortheITdepartment.HitachiIDhasaworldwidenetworkofpartnersthatcandeliverlocal
supportformidsizeorganizations.
iSMSecuSys'biCubeisanattractiveoptionformidsizeorganizationsintheGermanspeakingregion,
becausethecompanyisprimarilyfocusedonthatmarket.Theproductisbuiltonanunderstandingofa
businesscentricrolemodelthatfitscommonbusinessprocesswithinthatregion.Apowerfulpolicymodel
canautomaticallyassignaccessrightsbasedonuserattributesorothercontextualinformation,reflecting
afocusonmatureprocessesanddataquality.Itssolutionishighlymodularizedandhasalowentrypoint
intermsofpricing.
MicrosoftcustomerswithenterpriseagreementscanuseexistingWindowsServerClientAccessLicenses
(CALs)fortheirusersinordertodeployForefrontIdentityManager(FIM).Theproductispopularwith
manymidsizeorganizationsandhasalargepoolofexperiencedprofessionalsandconsultantsthatcan
deliverintegrationservices.Potentialcustomersshouldbeaware,however,thatMicrosofthasnot
innovatedtheproductfortwoyears,andMicrosofthasannouncedaninvestmentinIGAspecific
capabilitiesonlyforsubsequentversions(after2015).FIMwillberebrandedtoMicrosoftIdentityManager
(MIM),andMicrosoftAzureActiveDirectoryPremiumclientswillreceiveaCALforMIMaspartofthe
package.
NetIQhasasizablenumberofmidmarketclients,anditsmidmarketreferencecustomersprovided
positivefeedbackaboutNetIQ'sIGAsolution.NetIQscoredinthehighestthirdfortheSmallorMidsize
Businessusecasein"CriticalCapabilitiesforIdentityGovernanceandAdministration."Thereisalarge
poolofexperiencedindependentconsultantsaswellasalargenetworkofchannelpartnerswhocan
deploy,configureandsupportNetIQ'ssolutionworldwide.NetIQIdentityManagerispricedattractively
withinthelowestquartileofallproductsinthisMagicQuadrant.
OpenIAMoffersitsopensourceIdentityManagerasdownloadablesoftware,oralternativelyasa
physicalappliance.Formidsizeorganizations,atypicalIGAusagescenarioincludesprovisioning,access
requestandgovernancestartingat$25peruser.Thecompanyalsooffersa"jumpstartservice"for
midsizeorganizationstobeupandrunningwithin30days.
DelegatedAdministrationToolsforActiveDirectory
MidsizeorganizationscanalsopotentiallytakeadvantageofMicrosoftcentricdelegatedadmintoolsfrom
otherproviders(see"TechnologyOverviewforActiveDirectoryIAMTools").Whilethesetoolsarenota
fullblownreplacementforIGAproducts,theysimplifythemanagementofusers,groups,systemsand
policiesbyofferingcapabilitiesbeyondthoseofthenativeActiveDirectoryUsersandComputers(ADUC)
utilityprovidedbyMicrosoft.Someofthemoresophisticateddelegatedadministrationtoolsfeature
workflowcapabilities,selfserviceinterfacesforusers,entitlementcentricadministration(allowinggroups
tobemanagedbyspecificindividuals)aswellasbasicgovernancecapabilitiesbyofferingcertificationsof
existingaccess.SomevendorsforMicrosoftcentricdelegatedadministrationtoolsare:
CionSystems(www.cionsystems.com):ActiveDirectoryManagerPro
DellSoftware(software.dell.com):ActiveRolesServerandActiveAdministrator
Imanami(www.imanami.com):GroupID
ManageEngine(www.manageengine.com):ADManagerPlus
Namescape:(www.namescape.com):rDirectory
NetIQ(www.netiq.com):NetIQDirectoryandResourceAdministrator
Softerra(www.softerra.com):Adaxes
STEALTHbits(www.stealthbits.com):AccessInformationCenter
Thycotic(www.thycotic.com):GroupManagementServer
Varonis(www.varonis.com):DataPrivilege
VisualClickSoftware(www.visualclick.com):DSRAZORforWindows
Zohno(www.zohno.com):ZohnoTools
16/19
11.03.2015
Thesetoolsaretypicallylicensedonaperentryorperuserbasis.Pricingandcapabilitiesofproductsvary
significantly,from$3peruseronthelowendto$40peruseronthehighend,wheretheyareatparin
termsofpricingwithmanyIGAtools.
HealthcareProvidersContext
10March2015
Analyst(s):BrianIverson,FelixGaehtgens,SteveKrapes
Thehealthcareindustryhasuniqueregulatory,identitylifecycleandintegrationrequirementsforIGA
productsduetothenatureoftheirinformationsystems,data,personnelandworkflows.IAMleaders
shouldevaluatevendors'IGAofferingsforhowwelltheyfitwithintheseuniqueenvironments.
MarketDifferentiators
Thehealthcareverticalhasbeenalateadopterofidentitygovernanceandadministration(IGA)
technologies,especiallyontheproviderside,withgoodreason:Thevastmajorityofhealthcareproviders
havebeenrelativelyindependenthospitalsandclinicnetworkswitheclecticITenvironmentsandfluid
workforces,whichhasmadeintegratingIGAproductschallenging.Inaddition,IGAproductsare
expensive,andhealthcareprovidersusuallyhavehadlimitedITbudgets.
Worldwide,healthcareishighlyregulated,andoccasionally,theprovisionofandpaymentforhealthcare
servicesareundergovernmentcontrol.Theincreasingregulationoversharinganddisclosureofpersonal
healthinformationforpatientsisauniquerequirementforthehealthcareindustry,whichaddstothe
regulatoryburdensthathealthcaremaysharewithotherindustriesinvariouscountries.FearofPHI
disclosuresandtheft,aswellasthepossibilityofheftyfines,hasdrivenmuchoftherecentuptickin
interestinIGAproducts.
Moderntrendsinmedicalpracticemanagementhavedrivenatransitiontoelectronichealthrecords
(EHRs),whichareoftenmanagedbycomplexapplicationsfromvendorslikeAllscripts,Cerner,Epic,
McKessonandMeditech.Healthcareprovidersalsomakeuseofcomputerizedphysicianorderentry
(CPOE)systems,radiology,pharmacyandlaboratorysystems.Manyotherclinicalapplicationsusedby
healthcareprovidersarelegacysystemsorselfcontainedproductsthatwerenotdesignedwiththe
conceptofautomatedaccountadministrationinmind,sointegrationforprovisioningischallengingat
bestandimpracticalinmanycases.Supportforthesetypesofapplicationsintheformofconnectorsor
integrationframeworksisasignificantrequirementforhealthcareproviders.
Applicationsintendedforuseinclinicalsituationsareoftendeliveredthroughserverbasedcomputing
usingremoteorvirtualdesktoptechnologies.Multiplepersonnelneedtousethesamemachines
continually,andthereisadesireforcontext(openpatientrecordsorimages)tofollowuserslikedoctors
ornursesastheymovefromroomtoroom.Thishasdrivenbroadadoptionofenterprisesinglesignon
(ESSO)productsfromvendorslikeCaradigm,Evidian,HealthCast,IBM,ImprivataandOraclethatcan
supportClinicalContextObjectWorkgroup(CCOW)standardsforuserinterfacecontextintegration
amongmultipleapplicationsinclinicalenvironments.ESSOintegrationisusuallyarequirementforIGA
solutionstargetinghealthcareproviders.
Thefluidnatureoftheworkforceinmanyhealthcareproviderorganizationspresentscomplicationsfor
theidentitylifecyclecapabilitiesprovidedbymanyIGAproducts.Doctors,nurses,techniciansandother
specialistsareoftencontractedindividuallyorthroughspecialtyvendors.Manyhealthcaresystemsare
associatedwithmedicalschools,whichmeansthatstudentsandfacultyneedtobeconsidered.In
addition,staffmayoccasionallyfloatamongmultiplefacilitiesandresponsibilitiesthatmayrequireaccess
todifferentinformationsystems,whichcanpresentchallengesforroleandpolicymanagement.
ConsiderationsforTechnologyandServiceSelection
WhenselectingIGAvendorsfordeploymentinthehealthcareindustry,lookforandanalyzethese
featuresfromproductsorservicestomeetyourneeds:
1. Adequateidentitylifecyclecapabilitiesthatcouldadapttotheinstitution'sapproachtopersonnel
management.SomeorganizationswillhavemultipleHRsystems,andmostwillhavemultiple
typesofrelationshipswithspecialtyvendorsforcontractmedicalpersonnel.
2. Demonstrablesupportforthemultitudeofhomecountryregulatoryobligationsfacedbythe
organization.
3. Availabilityofconnectors,eithernativeorthirdparty,fortheEHRandfinancialmanagement
systemsinuseorplannedfordeploymentthroughouttheinstitution.
4. IntegrationwithESSOsolutionsthatmaybeinusebytheinstitution.AnIGAproductorservice
usuallywillprovisiondirectlytoanESSOsolutionorprovisiontothedirectoryusedbytheESSO
solution.
5. Flexibleoptions(suchasintegrationwithservicedeskticketingsystemsoreven"screenscraping")
forintegratingwithclinicalsystemsthatdonotoffereasysupportforremoteaccount
management.
6. Scalability.Someproductsareoptimizedforusebylargeorganizationswheretherearemany
usersandapplicationswithgeographicallydistributedaccountrepositories.Othersaretargetedat
midsize,communityhealthcareproviders,wherethenumberofusersandcomplexityofsystems
maybemoremodest.
NotableVendors
VendorsincludedinthisMagicQuadrantPerspectivehavecustomersthataresuccessfullyusingtheir
productsandservices.SelectionsarebasedonanalystopinionandreferencesthatvalidateITprovider
claimshowever,thisisnotanexhaustivelistoranalysisofvendorsinthismarket.Usethisperspective
asaresourceforevaluations,butexplorethemarketfurthertogaugetheabilityofeachvendorto
addressyouruniquebusinessproblemsandtechnicalconcerns.Considerthisresearchaspartofyourdue
diligenceandinconjunctionwithdiscussionswithGartneranalystsandotherresources.
Thevendorsreviewedherewereselectedforinclusioninthiscontextualizationbecausetheydemonstrate
17/19
11.03.2015
twoormoreofthefollowingcharacteristics:
Thehealthcareindustryistheirlargesttargetedverticalmarketoraccountsforasignificant
percentageoftheirtotalrevenue.Allvendorsincludedearnedatleast10%oftheirpastyear
revenuefromhealthcarecustomers.
TheyprovidepackagedconnectorsandcontentforEHRsystemsandotherclinicalapplications.
TheyhaveIGAspecificmarketingthatisfocusedonthehealthcareindustry.
Avatier
Healthcarerepresentsthesecondlargestindustrysegment(aftermanufacturing)forAvatier,witha
focusontheU.S.market.Avatier'ssimplifiedsetupandadministrationforIGAandaconsolidated
approachtoservicedesk,accountadministration,provisioningandpasswordmanagementareattractive
tohealthcareproviderswithleanoperationsandtightprojectdeadlines.
Caradigm
Caradigm,aU.S.companybasedinBellevue,Washington,wasformedasajointventurebetweenGE
HealthcareandMicrosoftin2012.Caradigm'sentrantintheIGAmarketisCaradigmProvisioning,which
ispackagedasacompletesolutionaimedexclusivelyathealthcareproviderstoaddressprivacyand
securityregulations,likeHealthInsurancePortabilityandAccountabilityAct(HIPAA)intheU.S.Caradigm
Provisioningisakeycomponentofthevendor'sidentityandaccessmanagementportfolioofproducts,
includingofferingsforSSOandcontextmanagement.Akeydistinguishingfeatureisitsabilitytoprovide
detailedandproductspecificrolebasedprovisioningforEHRsoftwaresuchasEpic.
Courion
Courionderivesmoreofitsrevenuefromhealthcarethanfromanyotherindustry,withafocusonthe
U.S.market.Theirstrengthinthehealthcaremarkethasbeendrivenbyitsfocusondeliveringreporting
andcompliancefeaturesspecificforHIPAA/HealthInformationTechnologyforEconomicandClinical
Health(HITECH)regulations.Courionhasalsodevelopednumerousconnectorsforabroadrangeof
clinicalapplicationsaswellasmultipleconnectorsforESSOintegration.Itisalsocapableofintegrating
withhealthproviderlicensingsystemstodisableaccounts(afterprovidingwarnings)whenacaregiver's
licensehasexpiredtoensurethatphysiciansandnursesrenewtheirlicenses.
EMC(RSA)
Healthcareisthesecondlargestindustrysector(afterfinancialservices)fortheRSAIdentity
ManagementandGovernance(IMG)product.IncreasingregulationsworldwidehaveallowedRSAto
bridgeIMG'sgovernanceandcompliancestrengthswithitsArcherGRCofferingtoextendrichcoverage
overregulationslikeHIPAA.RSAhasalsoutilizedtheHealthLevel7(HL7)standardtodevelopmore
connectorsforclinicalapplications,andrecentlydevelopeditsownconnectorforEpicusingHL7andWeb
services.
Evidian
Evidianderivesmoreofitsrevenuefromhealthcarethanfromanyotherindustry,withafocusonthe
uniqueneedsofEuropeanmarkets.Evidian'sHealthpackage,consistingofthecompany'sIdentity&
AccessManagement(I&AM),EnterpriseSSOandWebSSOproducts,hasallowedittoaddress
confidentialityregulationsandrequirementsforstrongauthenticationthathavebeensignificantdrivers
forhealthcareprovidersinEurope.Evidian'spurchasebyAtosisexpectedtoexpanditssalespresence
beyondthemarketswhereithasalreadydemonstratedsuccess.
NetIQ
NetIQhasanextensivepartnernetworkthatitleverageswhenapproachingspecificindustries.Inthe
healthcaremarket,NetIQ'spartnershaveassembledofferingscomposedofmultipleNetIQproductsthat
areintendedtosatisfythespecificneedsofhealthcareproviders.IdentityManagerisofferedaspartof
IAMsolutionsthatalsoincludeNetIQ'sAccessManager(Webaccessmanagement[WAM])and
SecureLogin(ESSO)productstoassisthealthcarepersonnelgetaccesstopatientdatafromdifferent
locationswithvariousdeviceslikedesktopmachinesinexaminationrooms,laptops,tabletsand
smartphones.IdentityManagertiesthesolutiontogetherbyprovidingforidentitylifecycleneeds,
passwordsynchronization,andprovisioninganddeprovisioningofaccessinclinicalsystems.
Oracle
OracleIdentityandAccessManagementSuitePlushasbeenpositionedasthekeysecurityelementof
Oracle'sapproachtothehealthcareindustry.OneadvantagethatOraclehashadinthehealthcare
industryhasbeentheintegrationofOracleIdentityGovernance(OIG),withOracleEnterpriseSingle
SignOnPlus.CombinedwithOracleAccessManagerforWAMandOracle'sdirectoryproducts,Oracle
solutionscancoverthefullrangeofIAMneedsforhealthcareproviders.BothOracleIdentityManager
(OIM)andOracleIdentityAnalytics(OIA)havebeenusedbyhealthcareproviders,eithertogetheror
individually,toprovideautomationandaccessgovernanceformanagementofclinicalapplications.
SailPoint
HealthcarehasseenanincreasingpresenceinSailPoint'sindustrycoveragebecausehealthcarehasseen
anescalationinregulatoryobligationsinrecentyears.Thisexpansionintohealthcarehasbeenfacilitated
bysuperiorsupportofSailPoint'sIdentityIQforgovernanceandcomplianceneedsoforganizationsin
heavilyregulatedindustries.SailPointhassolidifieditspositioninthehealthcaremarketthroughpersona
supportandspecialtyconnectorsforclinicalapplications.
Saviynt
Saviynt,aU.S.companybasedinCalifornia,isoneoftherarevendorsthatapproachesIGAand
segregationofduties(SOD)controlsmonitoringwithacommonsuiteofproducts.WhereasmostSOD
controlsmonitoringvendorstendtofocusexclusivelyonfinancialapplications,Saviynthasexpandedits
coveragetoincludehealthcareapplicationsprovidingcontentforidentifyingSODviolationsand
sensitiveaccessforleadingclinicalapplications.SaviynthasstrongsupportforEpic,withtheabilityto
18/19
11.03.2015
performroleengineering(alongwithroletransport),emergencyaccess(withactivityreview),compliant
provisioningandaccesscertification.ItalsosellsastandaloneEpicconnectorthatcanbeusedwithother
vendors'IGAproducts.
2015Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.oritsaffiliates.Thispublicationmaynotbe
reproducedordistributedinanyformwithoutGartnerspriorwrittenpermission.Ifyouareauthorizedtoaccessthispublication,youruseofitissubjecttothe
UsageGuidelinesforGartnerServicespostedongartner.com.Theinformationcontainedinthispublicationhasbeenobtainedfromsourcesbelievedtobereliable.
Gartnerdisclaimsallwarrantiesastotheaccuracy,completenessoradequacyofsuchinformationandshallhavenoliabilityforerrors,omissionsorinadequacies
insuchinformation.ThispublicationconsistsoftheopinionsofGartnersresearchorganizationandshouldnotbeconstruedasstatementsoffact.Theopinions
expressedhereinaresubjecttochangewithoutnotice.AlthoughGartnerresearchmayincludeadiscussionofrelatedlegalissues,Gartnerdoesnotprovidelegal
adviceorservicesanditsresearchshouldnotbeconstruedorusedassuch.Gartnerisapubliccompany,anditsshareholdersmayincludefirmsandfundsthat
havefinancialinterestsinentitiescoveredinGartnerresearch.GartnersBoardofDirectorsmayincludeseniormanagersofthesefirmsorfunds.Gartnerresearch
isproducedindependentlybyitsresearchorganizationwithoutinputorinfluencefromthesefirms,fundsortheirmanagers.Forfurtherinformationonthe
independenceandintegrityofGartnerresearch,seeGuidingPrinciplesonIndependenceandObjectivity.
AboutGartner|Careers|Newsroom|Policies|SiteIndex|ITGlossary|ContactGartner
19/19

Magic Quadrant For Identity Governance and Administration PDF

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Magic Quadrant For Identity Governance and Administration PDF

Uploaded by

Copyright:

Available Formats

11.03.

You might also like