One Identity Manager On Demand

Identity & Access Management (IAM) sits at the center of enterprise IT because it governs digital identities—employees, partners, customers, and increasingly devices/things—and protects corporate digital assets. As security perimeters erode through mobility, partner integration, and cloud adoption, organizations face higher exposure while the value of digital assets and intellectual property rises, including in traditional industries moving toward connected things and smart manufacturing. In this context, IAM reduces attack surface by enforcing well-managed identities, credentials, and entitlements, supporting the least-privilege principle, automating provisioning and deprovisioning, and enabling regular entitlement reviews to detect excessive access.

IAM also enables business by streamlining onboarding and access workflows for diverse user populations and by supporting access needs for new digital services, including IoT and device identities. The market has been shifting from on-premises IAM to Identity as a Service (IDaaS), driven by faster time-to-value and cloud-ready integrations that extend IAM controls across expanding SaaS portfolios. However, “IDaaS” covers varied offerings, from Single Sign-On to full provisioning and access governance, with differing support for user types, mobility, and hybrid integration.

The report evaluates One Identity Manager On Demand, the IDaaS version of One Identity Manager. Rather than a simple lift-and-shift or a wholly new product, it builds on years of modernization and modularization in the on-premises platform, achieving near feature parity; the main functional gap is the absence of the Data Governance Edition as SaaS. One Identity addresses IDaaS requirements through an API-first approach, isolation of customizations, continuous provider-managed updates, and scalable deployments (not necessarily multi-tenant). The Angular-based UI consumes backend APIs via an API Server, separating front-end and backend to keep customer extensions resilient through updates. Tenants typically receive both pre-production and production instances, with continuous updates delivered via Microsoft Azure and Kubernetes. Strengths include broad connectors, SAP-certified integration, and strong APIs; challenges include lack of published pay-per-use pricing, Azure-only availability, and Starling Connect as a separate component.

• IAM manages digital identities for employees, partners, customers, devices, and things, and controls their access to systems and applications.
• Mobile access, partner/customer integration, and cloud adoption have reduced the relevance of the traditional network perimeter.
• IAM supports least-privilege by managing user accounts, passwords, and entitlements and by enabling reviews for excessive access.
• IDaaS is characterized by cloud-based delivery of IAM services and has seen significant growth in recent years.
• The IDaaS market initially centered on web-centric use cases and now delivers IAM capabilities across application delivery models.
• One Identity Manager On Demand is the IDaaS version of One Identity Manager and is positioned as the flagship product’s cloud offering.
• The Data Governance Edition is not available as SaaS in One Identity Manager On Demand.
• The web front-end was rewritten in Angular and consumes APIs exposed by an API Server component.
• Tenants typically receive two instances by default: one for pre-production/testing and one for production.
• Starling Connect integrates SaaS services using the SCIM 2.0 standard.

• “IAM done right ensures that identities, their user accounts and passwords, and their access entitlements are well-managed and that authentication works as expected.”
• “IAM thus reduces the attack surface by helping organizations moving towards the ‘least privilege’ principle.”
• “IAM is the tool for implementing the workflows and automated processes for onboarding users and granting them access.”
• “The market, driven largely by web-centric use-cases in its early days, now offers full-fledged delivery of IAM capabilities irrespective of application delivery models.”
• “There is virtually no trade-off in functionality when choosing One Identity Manager On Demand, compared to the traditional One Identity Manager.”
• “Requirements for such IDaaS approach… require an API-first integration and customization approach.”
• “Customizations are consequently isolated, and customer extensions remain untouched during updates.”
• “Thus, front-end and backend are segregated, allowing to manage customizations at the front-end.”
• “The advantage of this approach is that One Identity Manager On Demand provides the same, comprehensive feature set as the on-premises One Identity Manager, with very few exceptions.”
• “We don't expect the solution to be truly multi-tenant.”