Archive for the ‘Provisioning’ Category

Emerging Best Practices – Extending Microsoft Active Directory to SaaS and Cloud Applications

November 13, 2009

Though cloud and SaaS solutions are seeing rapid adoption in the enterprise, management of these applications is not aligned with traditional IT controls and policies.  SaaS has been deployed and managed largely by business users, with limited input from CIOs and IT organizations.  As these cloud-based technologies replace mission-critical on-premise applications and host sensitive organizational data, enterprise IT is now regaining their ‘seat at the table’.   When seeking to extend policies and controls to SaaS, these IT organizations are disappointed to learn that existing directories and  IT management technologies don’t easily extend to the cloud.  These organizations struggle to achieve alignment of SaaS and cloud solutions with established enterprise identity sources including Human Resources Information Systems (HRIS), directory services, and Identity Management (IdM) solutions.  This alignment and resulting visibility and control is critical for IT and Finance departments concerned with regulatory compliance, governance, and identity and access management.

Given the role that Microsoft Active Directory and associated proxy services play in  providing centralized authentication, access control, and identity synchronization for on-premise applications  it would seem to be a logical integration point to also harness SaaS and cloud solutions.  Unfortunately IT organizations are finding that AD itself does not easily extend into leading SaaS applications, with direct integration difficult if not impossible.

Despite this inability to directly integrate AD with major cloud applications, forward-thinking enterprises are focusing on a “loose coupling” of on-premise Microsoft Active Directory and SaaS solutions through new third party management solutions.  This approach allows an integration path with the existing, deployed directory technologies and does not require major adjustments in the SaaS vendor technology roadmaps.  By integrating the current SaaS and directory solutions, the enterprise can align critical services including user identity and attributes, login services (Single Sign-On), and IT policies.  This alignment can lead to immediate benefits in security, IT efficiency, and governance and regulatory compliance.  In our new white paper, Extending Microsoft Active Directory to the Cloud, we explore the approaches and solutions organizations are leveraging to identity synchronization, policy enforcement and single sign-on (SSO).

Click here to request a free copy >>

Advertisements

Top Ten Mistakes Companies Make When Adopting SaaS

November 3, 2009

While billions of dollars will be spent on SaaS and cloud applications by the end of 2009, executives continue to question data security inside the cloud.  A recent article in CIO Magazine notes a growing majority of execs are worried about cloud security.  These executives recognize that each SaaS application, like Salesforce.com, represents a potential highway of highly sensitive corporate data outside the firewall and outside IT’s security protocol.  While no means exhaustive, here is a list of mistakes we’re seeing companies make when deploying SaaS applications, creating unnecessary risk and cost for their organizations:

  1. Creating the ‘three-headed admin’ – granting multiple people administrator-level roles inside a single SaaS application, or having multiple admins share the same credentials.  Aside from the obvious security issues, resulting SaaS app management data typically ends up reflecting multiple perspectives of users and permissions.
  2. Hoping that everyone ‘locks the door’ – relying on manual workflows, phone calls and emails to de-provision SaaS users’ access in an accurate and timely fashion across SaaS apps.   If there’s not an automated way to guarantee deprovisioning across all apps, then it’s unlikely that it’s happening.
  3. Applying a short term ‘band-aid’ for management – using trouble ticketing and help desk systems to coordinate administration between central IT and departmental SaaS admins.  This is typically a short term fix that just kicks critical provisioning and identity management issues down the road, and does it in a way that creates more pain later.
  4. Attempting the IT ‘end-run’ – not engaging IT on management and support until SaaS app(s) become “mission critical” within the organization.  As SaaS and cloud are now becoming more mainstream technologies, IT is regaining their seat at the table to help extend existing policies and controls – ignore this dynamic at your own peril.
  5. Delegating policy enforcement – relying on individual SaaS administrators to enforce corporate policies for roles and permissions.  Most organizations have access control policies and controls exist for on-premise apps and data, but few think about how to extend them to SaaS and cloud applications prior to deployment, particularly in environments with distributed administration.
  6. Believing in a management ‘silver bullet’ – assuming that existing on-premise directories (such as Microsoft Active Directory) or identity management tools (including SSO) extend to support all SaaS-related identity challenges.  They don’t.
  7. Creating ‘two sets of rules’ – treating SaaS governance differently than on-premise applications with regard to user identity and compliance.  Governance frameworks and best practices should consistently apply to applications no matter how they’re delivered.
  8. Failing to create a ‘rearview mirror’ for audit and compliance – failure to identify and approach for capturing an audit trail of access, usage, user change and permissions history.  Though delivered by a 3rd party, companies are still responsible for implementing and enforcing access control policies, and for demonstrating it at audit time.
  9. Forgetting about compliance reporting – wasting 20-30 executive hours each quarter to manually compile reports for internal or external compliance audits.  Forgetting to consider compliance reporting needs up front when evaluating SaaS vendors and overall SaaS/cloud strategy can be painful.
  10. When in doubt, spending more – buying unnecessary subscription seats because of a lack of visibility to actual subscriptions and current usage.

We’d be interested in hearing what others are seeing and hearing in these areas as well…

Extending Active Directory to the Cloud

October 17, 2009

One of the use cases we’re almost universally supporting across our midsize enterprise customer base here at Conformity is integration with Microsoft Active Directory (AD), and providing the ability to extend and link employee, role and organizational data with identity stores contained in leading SaaS applications such as Salesforce.com, NetSuite, Google Apps and others. With our AD connector, customers of the Conformity platform are extending capabilities today in two major areas:

  • User provisioning / deprovisioning – by normalizing and synchronizing role and permissions models across AD and Conformity and through deploying our event monitoring capabilities customers can automate user provisioning, deprovisioning and change management activities.    When a new employee is onboarded and set up within AD, access and permissions to cloud services appropriate for the employee’s role are automatically provisioned via Conformity.  For example, when a new outside sales rep joins the organization, when added in AD they then can also be provisioned against Salesforce.com, Xactly and Google Apps with appropriate access and permissions.   When the sales rep changes title or role, or leaves the organization, changes in AD also then trigger appropriate changes in cloud application access and permissions.  In effect, we’re providing users a cloud provisioning extension for AD that enables IT to extend access policies and controls to the cloud.
  • Chargeback models – integration of department and other organizational identifiers between AD and Conformity’s role model also streamlines our customers ability to automate extension of internal chargeback and financial management models to cloud applications.  By linking SaaS administrative siloes to AD  via Conformity, enterprises can track and manage departmental usage not just at the application level, but also within specific modules within the cloud services themselves.

In addition to dramatically reducing administrative headaches, synchronizing and normalizing identity data across AD and major cloud applications is also enabling them to streamline audit prep activities, reduce operational costs and strengthen access control and security.  More to come on this…

The Three Key SaaS Management Challenges

October 15, 2009

We find very few people today that would dispute the notion that SaaS and cloud applications have become mainstream technologies in SMB and the midmarket.  The challenges for the SaaS industry are also changing as a result.   With the battle over the viability of the on-demand model largely won,  the questions are now turning to the operational and IT management  implications of a SaaS-centric environment.

Our customers and prospects here at Conformity are forward-thinking organizations that are aggressively leveraging the cloud delivery model for multiple, if not a majority of their business applications.  Given our strong  belief in the SaaS and cloud model, we believe that they are a good indicator of trends we’ll shortly be seeing more broadly in the market.    All of these organizations are struggling with what their management processes and approaches look like in a purely ‘on-demand’ model.   Among these multi-SaaS organizations we’re consistently seeing three general problem domains:

  1. User provisioning and administration – as they’re optimized for different problem sets, all major SaaS applications have fundamentally different ways of thinking about users, roles, profiles and permissions.  Organizations have tended to have separate business administrators for say Salesforce.com, NetSuite and SuccessFactors.  Each of these admins as a result has had to develop a separate model of their organization, deparments and role structures, with the result being that various siloed identity stores have been created across the organization.  These stores are are all independent from each other and from on-premise directory services (Microsoft AD) and identity management solutions.  Normalizing these identity stores in support of centralized, streamlined administration and reporting is a common theme we’re hearing, and what what our solution here at Conformity is addressing.
  2. Single sign-on (SSO) / authentication – another common challenge we’re hearing is the desire to provide end-users the ability to access multiple SaaS applications (and often on-prem apps as well) using a single set of credentials, both for end-user convenience and security purposes.  This is the problem set being  addressed by vendors such as Ping Identity, Tricipher and Symplified.
  3. Data integration – the final theme we’re hearing is around cross-application data integration, and the desire to integrate multiple ‘best of breed’ applications across a common business processes or workflow.  This issue set consists of integration of cloud apps to both cloud and on-premise applications.   This is the domain being addressed by vendors such as Cast Iron Systems, Pervasive and Boomi.

While the data integation challenge is fairly distinct from the first two challenges, significant market confusion exists around provisioning and SSO, and whether a solution in one addresses both areas.  The short answer is no – the very simple analogy we use is that SSO tells you if you should let the visitor knocking on the front door into the house – provisioning and permissions management provides guardrails around what they can and cannot do once they’re in the front door.  Both are needed, but complementary capabilities – more to come on this….

Conformity Announces GA Release of First Enterprise-Class Management Platform for SaaS and Cloud Apps

September 30, 2009

We’re excited to announce today the general availability of the Conformity solution, which provides customers the first enterprise-class management platform for cloud applications and users.  The Conformity solution is designed to arm enterprises with the same level of visibility and control over on-demand applications as they’ve come to expect with traditional packaged apps.  With our solution, enterprises can now be confident bringing new cloud applications into their business environments, knowing there will no longer be compromises made in the areas of management processes, insight and control.  With today’s GA, enterprises can:

  • Increase data security and reduce compliance risks
  • Optimize license allocation and expenses
  • Automate and streamline administration
  • Expand and extend enterprise usage of SaaS and cloud applications

Specific capabilities of the Conformity solution include:

  • User provisioning – provides centralized point of provisioning and deprovisioning of users accounts within cloud applications, and ongoing management of user permissions and authorizations.
  • Role and profile management – enables organizations to centrally manage cloud application roles, profiles and permissions through normalized permission models, and maps policies to users and roles.
  • Approval workflows – provides auditable cross-functional approval processes for users requiring new or amended access permissions, or role and profile changes.
  • Directory integration – enables organizations to seamlessly synchronize Conformity’s user repository with on-premise directory services.
  • Compliance reporting – provides reports required for effective preparation for audits for SOX, HIPAA, PCI and other regulatory mandates and standards.
  • Usage analytics – provides visibility, analytics and reporting on cloud application and license utilization.
  • Change management – enables archiving, management and recovery of application configurations and role models.

The Conformity platform provides templates, tools and workflow needed to manage all cloud applications in a customer’s environment.  Conformity also provides additional analytics, reporting and provisioning automation through integrations with the following leading cloud applications:

The Conformity platform also supports directory integration for Microsoft Active Directory, and is compatible with industry standards such as SPML, SAML and WS-Federation.

Please click here to read the full announcement, and stay tuned for more upcoming news!!!

Conformity and SuccessFactors Announce Technology Partnership

September 10, 2009

We’re very excited to announce our participation in the SuccessFactor’s new SuccessCloud™ program, which was introduced earlier today.  Conformity’s AppConnect integration with SuccessFactors’ Business Execution Software Suite will enable customers to synchronize critical employee information across 3rd party applications and on-premise directory services.  Customers will be able to ensure Cloud application access and permissions are consistent with organizational roles, and to automate service provisioning and change management across the employee lifecycle.  With Conformity, SuccessFactors’ customers will be able to reduce data security and compliance risks as well as streamline costly, time-intensive activities associated with management of cloud applications and associated users.  Click here to read the full announcement and to learn more about the partnership…

Success in the Enterprise – Making SaaS Manageable

August 3, 2009

As we heard once again last week at Catalyst from end-users, partners and vendors alike, many large enterprises are now finally taking a serious look at how to effectively leverage SaaS and cloud applications in their environments.   As we’ve observed in this blog before, enterprise CIOs are also finding that there are no easy answers to how to address the fundamentally disruptive impact that SaaS and cloud-based applications have on current IT management approaches.

The issue comes down to this: if a third party controls the software, data and access, and the CIO no longer has the capabilities to directly monitor and manage software operations, how can the CIO fulfill his or her responsibility for governance and compliance?  It’s a question that SaaS vendors must address if they expect to effectively compete and succeed in the enterprise marketplace

Our new white paper titled Success in the Enterprise: Making SaaS Manageable examines the CIOs need to manage SaaS applications as part of the larger responsibility for systems management in the enterprise.  It also looks at steps SaaS vendors can being to take to meet this need, and outlines best practices in the following areas:

  • APIs
  • Activity access
  • Performance monitoring
  • Back office visibility
  • Standards

The enterprise continues to present an enormous opportunity for SaaS vendors, but to capture this opportunity vendors need to take the next steps to ensure their services provide the management visibility needed to be truly enterprise-ready, and that they address the unique identity and systems management challenges created by the SaaS model.

This is the first in a series of best practice white papers that Conformity will be publishing for SaaS vendor executives to help the industry meet the needs of enterprise CIOs and their teams.  Please visit our website to download a copy of Success in the Enterprise and to subscribe for future white papers, and to learn more about how we can help SaaS vendors address IT enterprise challenges.

Closing the gap between IT and SaaS

July 8, 2009

One of the big challenges the SaaS industry continues to face (which we talked about at our presentation at SaaS University last week in Chicago) is the gap that exists between the APIs/management access that SaaS applications provide today and the expectations of CIOs and IT teams, particularly in the enterprise.  The end-customer CIOs we’re working with are typically surprised at how difficult it is to integrate most SaaS applications into their existing management processes and solutions –  a CIO we recently spoke with just assumed that all major SaaS applications supported direct integrations into Active Directory and LDAP.  On the flip side, most SaaS vendors are being faced with IT requirements and expectations they haven’t yet considered, let alone support in their services (though there are exceptions) particularly in identity-related areas such as user authentication and access control.

Why is this important?

IT is regaining its seat at the table when it comes to SaaS.  In mid-size enterprises, as SaaS adoption has accelerated cross-functionally organizations are beginning to look to IT to centralize management and governance of SaaS applications and users to minimize compliance risks and administrative costs.   In a recent survey we found that IT was involved in management and administration of SaaS applications in 72% of multi-SaaS organizations.   In larger enterprises that are now taking a serious look at SaaS, IT is involved from the start to determine how the applications will be integrated into broader business processes and other on-premise applications, as well as management processes and solutions.  We’re starting to hear from both types of organizations, as well as the SaaS vendors that serve them, that application ‘manageability’ is becoming a consideration in sales cycles – in fact we’re aware of several situations where an incumbent SaaS provider was displaced by an offering with improved API and management access.

Why the disconnect between SaaS vendors and IT?  Based on our experiences and interactions with both sides of the issue, the gap that exists between SaaS applications and IT is driven by two factors:

  • SMB legacy – the majority of leading SaaS vendors (including Salesforce.com) grew from an initial focus on SMB customers.   Applications were architected and optimized to solve a specific functional business problem for this initial class/size of customer, with (understandably) limited focus on how the application would have to integrate into multi-SaaS or enterprise environments.
  • IT as ‘the enemy’ – the ease of deployment and flexibility of SaaS eliminated the need for business users to involve their IT organizations in the selection, configuration and management of SaaS applications.   As IT historically has neither been a decision-maker or influencer in the sales process, most SaaS vendors haven’t been exposed to IT organizations, particularly in the enterprise.  In fact, IT was and is often times (and often unfairly) characterized as the enemy of SaaS adoption, needlessly entangling business users in red tape and bureaucracy.  IT teams have also been part of the problem, often taking little interest in administering or managing SaaS applications.  In either case, most SaaS vendors have had relatively limited interactions with enterprise IT organizations, particularly when compared to on-premise ISVs.

We fundamentally believe that for SaaS adoption to continue to accelerate in both midmarket and large enterprises that the gap between IT requirements and SaaS application capabilities will need to be closed.  SaaS vendors need to improve APIs, management access and visibility in areas such as user and identity management, activity logging and monitoring, service management and back-office/financial management.  More on this to come….

Enterprise-Class SaaS Provisioning

June 3, 2009

As those of us at Conformity engage enterprise IT teams, we continue to explore the gap between existing provisioning options and SaaS deployments.  Enterprise customers are caught between the promise of cloud and SaaS solutions and the impact of this adoption on their already stretched teams and processes.   In the Conformity white paper, Enterprise-Class SaaS Provisioning, we describe the management challenges organizations face in adopting SaaS applications, and explain why IT groups struggle to utilize existing options for federating on-demand environments.

So, what information can we take away from the enterprise SaaS customers?  As pointed out in our other discussion threads, SaaS is not easily tamed by existing solutions.  We find that the cloud deployment model exposes the following shortcomings of existing alternatives:

  • Disconnected Environments: The most obvious challenge is the separation of multiple SaaS applications and the management solutions.  This disconnect fragments the core IT capabilities, creating unique cloud-based silos of user identity, business policy, and administrative rights.
  • Unexpected Deployment Complexity: IT teams can easily underestimate the impact of adopting SaaS as a solution platform.  Detailed SaaS configurations, coordination between applications, and evolving licensing models can exceed IT expectations, especially when the deployments were independently cultivated in the lines of business.
  • Lack of Deployed Standards: Customers are discovering the industry standards for management and provisioning are not aligned with the aggressive SaaS expansion.  Many advertised standards such as SAML or XACML are focused on alternative use cases and designed for either an on-premise or cloud model, limiting their real adoption by SaaS ISVs.

These challenges have curtailed enterprise efforts to utilize current deployed technologies, and in turn have impacted SaaS rollouts.  IT teams continue to evaluate complementary but incomplete options including enterprise software vendors, cloud-based identity solutions, and unique SaaS ISVs themselves.  This discovery process has provided the benefit of allowing the enterprise teams to better understand the market challenges and applicability of existing solutions.

Working with these IT teams, we have defined a common set of issues for provisioning and management and select criteria for a new approach to federating on-demand environments.  Any solution must provision users to a fully functional state across the user life cycle, a distinct challenge with many SaaS and cloud implementations.   This provisioning must align with existing IT and business processes, leverage line of business expertise, and meet the organizations compliance, security, and data visibility needs.  And deployments must be flexible enough to align with and possibly impact developing standards such as SPML or federation options like Microsoft Geneva while supplying value prior to standards adoption.  In short, these attributes define a new breed of management platform that is designed for the SaaS and cloud-based environments.

For more information, read the Conformity white paper that outlines our findings.  And please feel free to reply and continue the discussion.

The SaaS industry, APIs and standards

May 28, 2009

A session titled “Herding Cats: Managing SaaS Sprawl” provoked some very interesting debate and discussion at Interop last week, as covered in this Network World article.  Several important themes emerged which we wanted to highlight and expand upon:

  • Current state of APIs – the state of SaaS vendor APIs is clearly not where it needs to be – here at Conformity we see a broad range of SaaS vendor API maturity, with some vendors offering robust web services APIs to most of their data objects, and others offering literally no access whatsoever.  Unfortunately our experience is that most vendors tend to fall closer to the second camp, particularly when it comes to providing visibility required for effective management and control of user access and usage of SaaS applications.
  • CIO expectations – as mentioned in the session, we also are seeing CIOs becoming more and more aware and involved in SaaS procurement, deployment and ongoing management and support processes. Experience managing on-premise applications has set expectations (rightly or wrongly) for CIOs and their teams, who many times are unpleasantly surprised at the lack of accessibility SaaS vendors provide to data critical to effective management and control, such as event logs.  The current lack of vendor APIs also frustrates IT teams, who are used to integrating on-premise applications into IT management processes and tools such as identity management tools and directory services.  These expectations for management and visibility of SaaS applications, users and activity are unlikely to change, and SaaS vendors will have to meet these expectations, versus attempting to modify them.
  • Standards and adoption – we also agree Narinder Singh of Appirio who’s concerned about the potential impact that standards and compliance efforts could have on SaaS innovation and vendor API development.  Successful standards typically emerge after, not before a particular problem is solved by the industry, which could partially explain the relatively lackluster ISV adoption of SAML, SPML, XACML and other standards around authentication, access control and provisioning.  The challenge is for the industry to develop models and approaches for APIs and interoperability to solve the underlying problem first.  While the standards mentioned above may end up being the right answer (or part of it), the first order problem is for the industry to make sure it has a model for satisfying end-customer requirements around APIs and interoperability.

The key to addressing the challenge the SaaS industry is facing around APIs is for vendors is to get started now, by exposing what they can around their objects and data models.  The SaaS vendors that we believe have made the most progress and who demonstrate the most maturity around APIs and interoperability decided to get started by opening up access to data and objects, not by first determining what API standard(s) to support.  Channel partners, customers and even other SaaS vendors can help solve the industry problem around what needs to be exposed via APIs and how.  Starting with standards first is a bit like putting the cart in front of the horse…