From Grown Legacy IDM to a future ready IAM Target Architecture

Thank you very much. So as said, my name is Michael Synowczik. I'm working for a chemical company. So the name of the chemical company is LANXESS. The name is divided in two. It's LANXESS and success, so France and English. We are based in Cologne, our headquarters there, with right now about 12,000 employees, with about 5,000 externals. So we're talking about 17,000 identities, or human identities. So just for short that you know what I'm talking about, what company I'm coming from. We are founded about 21 years ago from Bayer, where we're going to carve out.

And so last year we celebrated our 20 years. And within the next slides, I will present you our journey. So my journey at LANXESS and IAM started three years ago. Really exactly three years ago, I went to IAM. I'm head of IAM solutions right now. And what I found there was a sub-IDM legacy system. I think a lot of you know sub-IDM. Sub-IDM is an old system, old application, very highly customized. So all connectors you need to build on your own. So there are no standardized connectors. If you build a connector, it takes a long time. Very few knowledge in the team.

And so due to that, we do not have a lot of connected applications. And always, when it comes to bigger projects, like our S4 project, so the rollout of the SAP ERP system, IAM or IDM at this time, is always a bottleneck. So always we come last. And of course, everything on our side takes time. That's due to the sub-IDM. And that's not a good case. That's what I founded three years ago. But I also think that most of you that are using sub-IDM know what also was three years ago, or four years, something like that.

SAP said, OK, we will discontinue. We will not go ahead with this product. So please look for a replacement. So this was not a shock for us. So we took it as a chance. And my advice to you, if you're using sub-IDM, take it as a chance. Take it as a chance to rethink what you're doing, to concentrate on your processes, to look what is needed, what not, and so on. So build up a target picture and be ready for what comes next. So our sub-IDM application is more than 10 years old. So a sales legacy application. So you can't do a lot. So you are not prepared for the next steps.

But now we have the chance to do the next steps and to be ready for NIST 2, Zero Trust, everything you name it, agents. I think there were a lot of presentations here for agents. So be ready for that. And with sub-IDM, you will not be. So as I said, we started with a target picture. So we said, what do we want for the future? We wanted to have a lean UI. But we also said, we will keep our UI that we have right now. So in my team, I have a front-end developer. And this front-end developer developed a UI that looks similar to the Fiori UI you know when you are using SAP. So the UI stays.

And due to that, we do not have any training changes. We do not have to train the users. There is not a new solution for the end user.

Of course, we in the end want to change the back-end. So sub-IDM will be replaced by another solution. I will come to our solution later on. But for the end user, everything stays the same. And I think that's a really good benefit for us. I think it was a good choice to do it like that. Because we can do whatever we want in the background. And the end user or the business is not involved so many as you will do when you ramp up in a new application fully. And so the next steps, what we've done now about three years ago, we started to scan the market. So as you know, we had sub-IDM.

Always was the same. So now we need to look in what is there, what is on the market. Who are the big players? What solution is there? So all big players are here. You know them downstairs. But we at this time, we didn't use it. So we looked into Google, the web search, OK, IAM, IGA, whatever, give us your solution. We wrote an email to all of them. And then we made a long list. We looked into them. We invited all of the vendors to us.

We said, OK, come on, show us what you offer. And then we narrowed it down to a short list in the end, to three. And what is also very important doing this is write down what you have and what you want. So all your processes that you are doing right now and all processes you want to do later on should be written down. Because if you go to a vendor or if you go to a solution implementation partner, whoever, and they don't know what you want, they can't give you what you want. So be aware of what you really want and what you don't want. And then you can discuss.

You will not find the German, so there will be no solution which fits all. There is no. But of course, you can negotiate with the companies and say, OK, what can we do? How can we do it? What is needed? And so on. And don't underestimate this process. This process takes about one year time. Because you need to talk to a lot of vendors and also you need to define what you want and the vendors need to understand what you want. And in the end, you need a contract. And the contract takes a lot of time. So don't underestimate this.

If you're not started and you still have a SAP IDM application, go and run. That's only my advice to take with you. Do start right now. And here's very important as well. Involve procurement and legal as soon as possible. They do not want to go in every meeting.

Of course, they do not want to. But they want to know what you are doing and that they are prepared for. Because in the end, if you say, I'm now going with this vendor, go to GPL and to legal and say, please do the contract, you can imagine what happens. They don't want to. If you involve them at the beginning and say, we're doing that, that, that, that, everything is much easier. So after we have chosen, so in the end, you see now here, SailPoint and PwC is what we've chosen. So SailPoint is a solution, PwC is our implementation partner.

And here you also see some of our factors, what we looked into. So of course, we looked into the suite itself. The front end was for us not of importance, as said. So we're using our own front end. So we looked into the functions. We also looked into the connectors.

Of course, if you still have a good IAM solution and not SAP, this is maybe not of importance for you, because all IAM solutions offer connectors very easy out of the box. So they all are nearly similar. But if you're using SAP IDM, you know that building up a connector takes time. It's not taking hours, it's taking days and weeks. And that is why it's also written down here. And of course, everything is about numbers. It's about license cost, it's about maintenance cost.

So there, compare all vendors you know, all vendors you're looking into. And don't forget the migration costs, the one-time cost. Also there, it's possible to do time and material, to do a fixed-price project, and so on. And what for us was also very, very important is the knowledge of SAP IDM. So our implementation partner, PwC, Juan is sitting there. He's the project manager for my team. And Juan is an expert in SAP IDM, and he's an expert in SailPoint IC as well. And that makes it very, very easy for us to speak the same language. So you can imagine, I have a team with SAP IDM experts.

And when you talk to some other people for other solutions, it makes it much easier if you talk the same language. You do not need to translate everything, because he knows what's there. So what I want to give you from this project now takes two years right now. So after this meeting here, or this conference, Juan and myself will go to Leverkusen, where our IT is based, so next to Cologne, and we'll do our Go Live. So this weekend is our Go Live weekend. But I'm still here, because everything works, hopefully. So my team is doing a good job.

Maybe if you have seen him here, maybe not, because he's still working in the background for me on my team. So that's great. And that is what I can tell you. The partner is very, very important. I can't say this often enough. So if you're choosing a partner, you're choosing a partner for two, three, or however years. So you're choosing a partner for the future. It's not just choosing someone, and then he's gone afterwards. Our idea is, when the solution is live, after the hypercare, PwC will be more or less gone. So my team will do everything on their own.

But of course, we will always ask PwC for some further advice, because IEM is a journey. It's not just give you an application, and then you're finished. So build up knowledge in your team, if you want to do it on your own. So you can also say, I want software as a service, fine. So we decided to build up knowledge in the team. Don't migrate. So don't take the old shit from SAP and say, okay, give me the same. Now in SailPoint, or in Saviant, or in One Identity, or whatever. Please think over it. Rethink everything, and judge everything.

So some process you still have in your old legacy system, you will not have in future. And you will not need it. But always you do, we've done it last year, we've done it the last 10 years, so why don't we do it the next 10 years? But that doesn't make sense. The future, or the time is changing, and due to that, don't do this. And when you do this project, be flexible at any time. We started and we thought, okay, the project will take about one and a half years. Now it's two years. But it's not a big deal, that's a project.

Everybody knows a project is just a project, it's a plan, and you need to rethink about the plan. If it makes sense to change the goal life, then change the goal life. If it makes sense to do whatever changes, do it. So be flexible and don't control too much, because you will be lost in control.

So we started with a big Excel spreadsheet, there was a lot of tasks written on it, and when we do our daily, every day we're meeting for half an hour, and you have a long Excel spreadsheet, and you're at line 50, and the spreadsheet has 500 lines or something like that, you can't go through all of them. So if it doesn't make sense, concentrate on what you really need, and concentrate on milestones. And when you're nearly to the goal life, or the UAT and so on, what you're doing at the end, don't underestimate the HR involvement.

So you need HR, you need their data, because on our side, the internal and external employees come out of an HR system, success sectors, and so we can't build the identities on our own, we need HR to have a clear project process. And during the time you're doing your project, the time is going away, all other applications are changing as well. So there is not a freeze, right now we have a freeze, and in two years you wake up and everything is fine.

No, no. In this two years, or maybe two and a half years or three, depending on your size and whatever you want to do, think of everything can change, the other application can change, so be aware that you have to connect sometimes applications in sub-IDM, so in your old legacy system, and two months later you have to connect them in the new IC. So that's the way it is, because it's important, because the project or the application need to go live before you go live, so take this in mind, or keep this in mind, that there are also some other things.

And what was for us, not of so much importance, but I guess it's for many of you when you do not have an own front-end, communicate to the stakeholders, tell them what you're doing, tell them when you're doing it, and tell them why. So it's not a big deal, but you should not forget it. So if you don't do this, there always will be questions and they will be negative about your project. So also there, it's, from my point of view, very important to communicate.

So hopefully next week, on Tuesday, we are live, the end user will not recognize it, of course we send out an email and so on, they know that we are changing something, currently our system is down, on Tuesday it's back, or the new application is back, so hopefully on Tuesday next week we are ready for this, so we have a new application, we are ready for everything else, zero trust, for AI, for non-human identities, which we are currently also have in our application, and we are not seen as a blocker anymore, we are seen as an enabler, that is our future, that what we are willing to be, we are ready for what comes next.

To summarize, what I would like to give you as a takeaway, or takeaways, take the SAP discontinuation as an opportunity. Don't think, oh, that's very bad, what should we do right now, take it as a first step to build up something new, which is modern, where you can do what you ever wanted to do, and think of everything, what's coming next, and be prepared for it. The tool itself is not of importance, to be honest, from my point of view, we are using SAPONT. It's a nice application. We could also use some others, I guess.

So it's more important about the processes and the principles, so it's important what you do, what you want to do, and not the solutions. The solutions are comparable. The solutions are one is better in this, one is better in this, one has more connectors, one has whatever, but I think all the big players offer nearly the same, to be honest with you. And what I also would recommend to you, do standardization as much as you can.

It makes it easier for all of you, but of course, you always will have some processes which you can't standardize, because all companies are special, all companies need something else, and you are forced to do some processes which are not part of the original IGA, so it will be always the case, and take this into account. And as I said, procurement and legal involves them early. So if you want to buy a new solution, involve them early, especially the negotiation of a contract.

This contract, I think all of you know contracts, they are very long, there are a lot of pages you need to, the lawyers are talking about every word in this contract, and this takes time, and if you don't talk to your lawyers in the early stage, you will not make it in your timeline. And as said, Schwann, PwC, choose a strong partner which you are willing to work with. So if the partners go to the beauty contest and explain what they are doing, we always said we want to see the project team or the project manager, project leader, which will implement the application for us.

So this is very important for us, because it's people management. I want to decide with whom I will work for the next 2, 3, 4, 5 years. I want to know this upfront. It doesn't make sense for me to talk to a vendor, to talk to an implementation partner, and the implementation partner says, I will send you someone, but I can't tell you who. That is for me not the case. I said I want to know which guy I will work with and which team. And that was also very great from PwC, they presented us the whole team, and the whole team is still there.

So we started 2 years ago with 5 people from PwC, and they are still there, still the same. And that's reliable, and from my point of view, that's very important, because my team was also there as well, so they meet each other upfront before we sign the contract. And I think that's very good, because otherwise, you always change some people in the project team, and I think that's not good. Last but not least, the last point on my slide is, the world keeps turning.

You know, every time there's a change, other applications change, and so on, and be aware of that, so be flexible, changes in the projects are normal, usual, so be prepared. So my last sentence, my last set, replacing IAM is hard, we all know it, or everyone who has done it, but don't miss the opportunity, it's an opportunity for change. And if you miss that, that's much harder. So thank you.

Thanks very much, Michael, we have just one question here, you said avoid the big bang, but in practice, what was the hardest capability or process to run in parallel between the legacy and target IAM systems without creating operational confusion and security gaps?

Yes, it's a go live, it's this weekend, so currently we're running everything in parallel, so the production system currently is a sub-IDM, and so we are running everything in parallel right now, and we have something like a big bang, but not a big bang for the end users, so that is the main deal, and afterwards, so after this project, we have not connected all applications to our IAM application, or to our IC then, we need to replace some, or to do some connections afterwards, so we will now say, okay, we have connected AD, we have connected HR system, our SAP system, but we have not connected all applications, and we will do this afterwards, and therefore we have time, as long as we do not shut down SAP IDM.

Thanks very much. Once again, from Michael, it's enough today.