Martin Kuppinger: Where ITSM is Heading – and the Impact on IAM

Thank you, Annie and let's get started. So the title of my keynote for today is where I TSM is heading and the impact on identity and access management. So I will also on one hand, look a little on, on what is happening within the I TSM space, as I've said, I'm, I'm following this space for long. I think even before things like IEL were invented. And on the other hand, I'm, I'm an identity management guy and we are discussing for 15 years, probably already how identity access management and it service management fit together, how they overlap, how to integrate these.

And this is something we have a very, very long, very intense experience from a large number of advisor projects and discussions with end organizations, cetera. So I'd like to share some of the insight here. And so let's get started and let's get started with this term of it SM. So it SM stands for it, service management. And in some way, this, this term already says what is really about it's about managing it services, making it services available. And when we look at the definition, we, for instance, find in the Wikipedia.

So the Wikipedia then says it's information technology, service management. These are the activities that are performed by an organization to design, blend, deliver operating control information. Technology services offered to customers where customers very frequently are internal users, but at the end, it's every type of it service. And this design plan deliver, operate control and improve is something. When in case you're familiar with it, the it infrastructure library as a set of standard processes around it, service management. And as I said, improve comes to it.

But that basically is what it is covering. And so services can be everything. It can be requesting a PC or notebooks or many had to request notebooks. These days, it can be requesting access. It can be delivering certain types of applications and other services. So it it's really all these types of services and how to manage these and how to also provide access to that. But when we look at how things are evolving and for instance, look at how to service now describes itself.

In some ways, something I picked from their, their website, then it also becomes obvious that this definition of it, service management is changing, that it gets broader than it has been. So when we like adapt, then they are talking about building the now platform, which is their platform. The product portfolio delivers the it employee and customer workflows that matter with and so on to help drive part every part of digital transformation. I've underlined two parts of that. The one part is the platform.

So it's not just a tool anymore in the thinking of service now and other vendors, it's a platform, such a platform thinking we also observe in other areas. So when you look at what sales versus doing in the CRM space, it's far more than the traditional CRM and they are talking about their platform. Other vendors are talking about their platform. So we see more and more of these platform based approaches emerging. And this spans far more areas than trust the it services.

So there's a lot of sort of workflow platform in which is not only for it workflows, but for employee workflow, for customer workflows. So these solutions are expanding and getting it sort of taking increasingly a different role. I'll touch the sort of the strategic relevance within it in a minute. But with this shift from it's trust and it tool for managing it service from an it perspective, we see a shift towards this is a platform where we can build a lot of workflows, a lot of capabilities, our organization on, within this it service management. We have couple of components in the core.

So when we look at the ITSM core, then this is very much about three elements. It is, let's start to the right side. It's a CMTB configuration management database. This is some sort of asset management it's tracking. What do we have, which elements do we have our it, and not only the, the assets, but also the configurations. So it is really a big repository. We have catalogs, which describe the it services that are provided. So there's based on these elements we have in it, which services do we provide and they are in these catalogs and these service catalogs.

And then we have the processes around. So automation, but also workflows, which is the core.

And, and so standard processes, as I've already mentioned, are described in it, in the it infrastructure library as a standard, which still is a good, I believe a good starting point for, for what you do with an it service management, because it's a, a very practice driven, pragmatic, well sought out and mature description.

So as a starting point, it definitely is a good thing to start, but beyond this, this, as I've said, this, this technical perspective and the traditional perspective and it service management, we really see that it service management increasingly shift them into a, into a role of a strategic element within the it, within the it overall, it not only the it infrastructures, really one of these components where companies make strategic decisions and say, okay, we build on when B or C. So there, we all know a couple others than trust service now.

So there are a couple of options in this, it service management field, such as BMC and Cherwell and Ivanti and various others. So I don't want to name everyone here. So we see this, these discussions about becoming strategic, but we also should be careful and thoughtful. Maybe thoughtful is the better term here when it comes to these various types of, or when it comes to these strategic decisions.

So if we go for a platform and say, this is a strategic platform we build on, then this has a consequence or that consequences that we invest in this platform, we put more and more effort in operating that platform and adding services. And we clearly have a risk of vendor lock in, and that is not per se problem. If we understand that there is this lock in that if you understand what it mean to get out of a platform, if you plan also for all these aspects. And I think when they're lock in, in certain, at certain levels is quite common.

So when you look at the E R P space, when you look at mainframes and earlier days, etcetera, the most important thing is that you, that you make an informed well sought decision. So it's about being thoughtful here. One of the discussions I, I heard over the past couple of months more frequently is that with these platforms becoming strategic, there's this intention of making as much capabilities available on the platform. So some sort becomes one of the main user interfaces. And I think one thing should be considered carefully is this really the user's preferred interfaces.

It's really the right way to do it. And there are different perspectives on the other hand and long enough in the industry to, to prefer today's interfaces. And every UI has, has its strengths and its weaknesses. But when I compare it with what I've been using 10 years or 20 or 30 years ago this morning, I just thought about the days of dos and dos based applications. So I think we, we should also be realistic in, in that.

And it's, my perspective is better to have one place where I find everything than to have a lot of super cool interfaces, which are totally disparate from each other, but it's something we need to look at with the platform approach. Another point is we, we have some risk of a feature overload. So we have this risk that at the end, we put more and more things on the platform. And we also might put things. That's something I touched in the context of IGA in a minute, we put things on the platform, which are better than somewhere else.

So while it's really good to have a single interface, we should be careful with doing everything on a platform specifically with building ourselves, everything on the platform. I had this discussion in other areas as well. So if you take platforms for, for, for which are built for, for consumer customer relationship management, does it really make sense to do things like whatever time management and other things, project management on these platforms, be careful. Some things make sense, some things you get out of the box. And we have a lot of talks here today.

For instance, also by the clear sky, which built their IGA as a standard product, as a commercial of the shelf solution on, on a platform, which then could make sense if you do it yourself, be super, super careful. Also something we'll discuss a lot today, very positively, I think, is that with the able version of these platforms, we are shifting closer to saying, okay, we have the central platform for running our workflows or processes, something which is discussed, which has been started in many organizations couple of time, over the course of many, many years.

And we have really potentially here. So there's a strategic potential. And if you are thoughtful, this really might help us in doing what we need to do with our organization to get better in delivering the right it services in the right way, the right time. And this is what we should target it. And then there's this identity and access management thing. So as I've said, I'm, I'm an, I am guy. And some way I have a long history in identity and access management, but I also have been looking at it service management for really many, many years. And so what is the link?

The, the office link is service requests and access requests. So it's about requesting. So if you request an it service, you go to your it service management. Traditionally, if you request access, you go to your IM tool. Maybe you also go for SAP requests, separate tool, etcetera. And I think the complaints are known to many of us of users saying, okay, I don't know where I need to request what having one interface is.

Something, one UI is something which is logical, and this is one of the links we have. But also the catalogs.

When we, for instance, talk about application onboarding and IGA and identity management overall, the catalogs we have to CMDB really might help. And we should also expose services and catalogs. And then there's another area, which is the, I think an absolutely must integration area, which is manual fulfillment. So when we look at IGA, so the identity governance administration, then it is that we have some systems which we have connected for, for automated provisioning.

So if we have a new user, that account is created automatically, maybe in, in our Microsoft active directory, but we always will have systems which are not connected that way, which are just very, just have a manual fulfillment to do. And the best way to do that is relying on the it service management, create a ticket, track the ticket and have a very well coordinated, transparent manual fulfillment here. And this is that attached it in a little earlier, we have to see MTB and application onboarding relationship, but as always, there are also challenges who can do that wrong.

You can do it very, very wrong. So I've, I've seen projects where, where organizations spent many years of, of design work and architecture work to identify the way they intended to integrate. It doesn't make sense. The one thing is, even when we talk interfaces, we need to have the right interface for the right task. So identity management has its specifics when it comes to requesting access to approving access, which is pretty much standard, you say, but when you look at reviewing access, when you look at certain other task tasks, then things might become more complex.

And so the question is, how do you integrate interfaces, integrate your eyes? How do you do it? Right? So that it really works for the task. And what we definitely must achieve is we must achieve some consistency, which can be built in a different way. So there's the AP based integration, deep links, etcetera. A lot of technology I'll live out here for now, but it is, you need to, to really think about you do it. If you integrate workflows, that might make a lot of sense, but you need to ensure that, that you really can track where the workflow stands. Take manual fulfillment.

If you start the workflow, maybe in your ITSM tool, then you reach out to your IGA tool to start a provisioning process, and you have some approvals there or there. And then the manual fulfillment starts maybe to a couple of systems. Then you still need to be able to know where does this request stand? So you need to collect data from ITN, from I T SM to bring it together. You need a status, you need this integration and you need to be aware of that. Certain things are really better than in IGA. So complex entitlements.

If you have a multilayer role concept or multilayer, they entitlement model, this is far more granular than a service. You commonly handle an it service management tool. And if you look at segregation of duties, then there's a lot of logic, a lot of rule engine behind that. It doesn't make sense. This is my wanting to create this yourself on an it ASM platform. You need that integration in that case, or you need something which is package, which is commercial of the shelf running on the platform, but don't start doing yourself.

These things, my colleague Warwick a little later will go far more into detail on these things. Also target system integration for provisioning. So I've seen projects where someone that said, okay, we, we built, oh, we have this workflows. We built the request and approval. And then we start provisioning on one of these ITSM platforms, the challenges that you might have, an active directory connector, and maybe also an Azure active directory connector and a few others.

But you, you really quickly come to the end of the list of you have in an I TSM and the capabilities compared to what you have in IHA. So again, rely on capabilities that are readily available by a vendor, not try to rebuild things yourself. So what is the strategy it's about align and integrate, start talking with each other. If you're not already doing it and go for really deep integration, but well thought out integration. So it's not rebuilding within your organization.

It's about integrating and it's when you integrate also now touches soon, do it based on, on out of the box capabilities, you also should think about where does UI integration make sense and why not? So the EC access might be really why are the I TSM tool? Because you have, I know more and more IGA vendors for instance, provide an app in the store of one of these vendors, which allows to, to access the identity management, to start and request process, et cetera. Don't reinvent identity management yourself on top of the it service management.

And on the other hand, be aware that manual fulfillment to be it, service management is really a must. You must do it also think about new capabilities such as application onboarding. So think beyond there's a need for application onboarding, for instance. So in the remaining one or two minutes, let's summarize that as I said, the, the, the hint number one is align and integrate. So this is really super essential.

If you decided you have a strategic ITSM platform, then you should go for a consistent, you should shoot for UI based or UI level integration, because that really helps you to do things better, to come up with a, with a consistent interaction interface and one single interface, one point to start for your users. That makes a lot of, lot of sense and best done is this with API. So that is really consistent deep links where you trust and link to, to the I who also might do if done, right?

But then the, I UI you expose for the actually link should look a little bit the same, like the I TSM interface. So no, no hard changes here in that space. You have this ticket things I touch to it a couple of times it is a last. So the ticketing for manual fulfillment is absolutely essentially unique to have it. And last at least. And that is really the point. What you do in integration should be best based on what vendors provide.

So don't go for building integrations yourself, if you can avoid it, and don't reinvent IGA yourself, that doesn't make sense because at the end you will have so much maintenance and, and, and development to do it doesn't make sense. So go for out of the box solutions in IGA and in integration, whichever way that different ways as we will learn today to do that, but do it that way with that. I'm at the end of my talk, and we should have a little time also for questions. So if you have already entered the questions, then let's start with the questions aside of that.

And then you will probably say it again. I'm also available in one of the breakout rooms in a few minutes, so that we can go into more detailed discussions.