Magic Quadrant For Identity Governance and Administration

Magic Quadrant for Identity Governance and Administration
1 von 18
http://www.gartner.com/technology/reprints.do?id=1-27G6OBL&ct=1...
Magic Quadrant for Identity Governance and

Administration
12 January 2015 ID:G00261633
Analyst(s): Felix Gaehtgens, Brian Iverson, Steve Krapes
VIEW SUMMARY
The IGA market is transforming legacy, on-premises IAM products. IGA vendors are investing heavily to
meet client needs in ease of use, mobility, business agility, and lower total cost of ownership. User
provisioning and access governance functions continue to consolidate.
ADDITIONAL PERSPECTIVES
Company Size: Small & Midsize (<1000
Employees)
Industry: Healthcare Providers
STRATEGIC PLANNING ASSUMPTIONS
Market Definition/Description
Identity governance and administration (IGA) solutions manage identity and access life cycles across
multiple systems. Core functionality includes automated provisioning of accounts among heterogeneous
systems, fulfillment of access requests (including self-service), password management, governance
over user access to target systems via workflows and automated policies, and access certification
processes. Additional capabilities often included in IGA systems are risk scoring of a user's combined
entitlements, segregation of duties (SOD) enforcement, role management, role mining, audit case
incident management, and analytics (historical change, performance, recommendations for
entitlements or certifications, and so on).
Vendors in this Magic Quadrant are rated based on their on-premises solutions, but many also have
solutions that are delivered as identity and access management as a service (IDaaS) cloud solutions or
leverage third parties to host cloud solutions. Clients looking for SaaS-centric or cloud-only solutions
should consult Gartner's "Magic Quadrant for Identity and Access Management as a Service."
A key aspect of understanding the future of the IGA market is knowing how digital business will
influence IGA systems and practices over the near and long term. Gartner believes digital business will
lead to adoption of bimodal IT and bimodal IAM. Bimodal identity and access management (IAM)
means running systems in two modes: one that is "built to last," and one that is "built to adapt" to a
constantly disruptive technology environment. The adaptive mode will require IGA technology that is
more agile and flexible, and facilitates innovation more rapidly.
By 2018, 30% of organizations will have replaced more

than 50% of manual access certification and request
approvals by automated intelligent policies driven by
analytics.
By 2018, 40% of IGA vendors will provide preconfigured
business process frameworks to ease deployment for
small to midsize organizations, up from less than 10%
today.
EVIDENCE
The following sources were used in the creation of this
research:
Gartner client interactions
Phone interviews and online surveys for vendorprovided references and vendor channel partners
A comprehensive vendor survey that aligned with
the evaluation criteria
Secondary research services to support the overall
viability evaluation criteria
Product demos from all participating vendors
EVALUATION CRITERIA DEFINITIONS
Magic Quadrant
Figure 1. Magic Quadrant for Identity Governance and Administration
Ability to Execute
Product/Service: Core goods and services offered by
the vendor for the defined market. This includes current
product/service capabilities, quality, feature sets, skills
and so on, whether offered natively or through OEM
agreements/partnerships as defined in the market
definition and detailed in the subcriteria.
Overall Viability: Viability includes an assessment of
the overall organization's financial health, the financial
and practical success of the business unit, and the
likelihood that the individual business unit will continue
investing in the product, will continue offering the
product and will advance the state of the art within the
organization's portfolio of products.
Sales Execution/Pricing: The vendor's capabilities in all
presales activities and the structure that supports them.
This includes deal management, pricing and negotiation,
presales support, and the overall effectiveness of the
sales channel.
Market Responsiveness/Record: Ability to respond,
change direction, be flexible and achieve competitive
success as opportunities develop, competitors act,
customer needs evolve and market dynamics change.
This criterion also considers the vendor's history of
responsiveness.
Marketing Execution: The clarity, quality, creativity
and efficacy of programs designed to deliver the
organization's message to influence the market,
promote the brand and business, increase awareness of
the products, and establish a positive identification with
the product/brand and organization in the minds of
buyers. This "mind share" can be driven by a
combination of publicity, promotional initiatives, thought
leadership, word of mouth and sales activities.
Customer Experience: Relationships, products and
services/programs that enable clients to be successful
with the products evaluated. Specifically, this includes
the ways customers receive technical support or
account support. This can also include ancillary tools,
customer support programs (and the quality thereof),
availability of user groups, service-level agreements and
so on.
Vendor Strengths and Cautions
Operations: The ability of the organization to meet its

goals and commitments. Factors include the quality of
the organizational structure, including skills, experiences,
programs, systems and other vehicles that enable the
organization to operate effectively and efficiently on an
ongoing basis.
AlertEnterprise
Completeness of Vision
Market Understanding: Ability of the vendor to
Source: Gartner (January 2015)
20.05.2015 17:50
2 von 18
California-based AlertEnterprise offers its flagship Enterprise Guardian suite of products that has the
ability to extend beyond traditional IAM for logical assets toward areas of physical security and
operational technology (OT), including visitor management, badging, and real-time interfaces to
supervisory control and data acquisition (SCADA) industrial control systems. The platform also includes
threat and risk behavioral analytics by combining identity information with user activity feeds, such as
access to internal computer systems outside of an employee's work hours.
The AlertEnterprise platform has a range of vertical offerings aimed at oil and gas, utilities, chemicals,
pharmaceuticals, and other regulated industries that make up a large percentage of its customer base
followed by airports and governments. The majority of its customers manage between 5,000 and
25,000 users (the average is 7,000).
Strengths
Its product excels at managing an entitlement catalog with value-added metadata and provides
full support for the key product scenarios from the evaluation criteria listed below.
A clear focus on the integration of IAM and OT gives AlertEnterprise a unique standing among all
vendors in the IGA market.
Fifty-five percent of its staff work in R&D, enabling the company to innovate quickly, as evidenced
by the recent release of compliance content packs for NERC CIP V5 and TSA Telos credentialing
systems.
Cautions
AlertEnterprise needs to grow its limited partner network in order to increase delivery capacity and
sales that have been growing but lately have tapered off to a rate well below the industry average
of 15% annual growth.
Customer satisfaction with support and maintenance is below the average for vendors in this
Magic Quadrant, but positive overall.
Buyers should be vigilant in verifying that their future IGA plans align with AlertEnterprise's road
map, because it is focused on IT/OT integration rather than more general IGA trends.
Atos
understand buyers' wants and needs and to translate

those into products and services. Vendors that show
the highest degree of vision listen to and understand
buyers' wants and needs, and can shape or enhance
those with their added vision.
Marketing Strategy: A clear, differentiated set of
messages consistently communicated throughout the
organization and externalized through the website,
advertising, customer programs and positioning
statements.
Sales Strategy: The strategy for selling products that
uses the appropriate network of direct and indirect
sales, marketing, service, and communication affiliates
that extend the scope and depth of market reach, skills,
expertise, technologies, services and the customer
base.
Offering (Product) Strategy: The vendor's approach
to product development and delivery that emphasizes
differentiation, functionality, methodology and feature
sets as they map to current and future requirements.
Business Model: The soundness and logic of the
vendor's underlying business proposition.
Vertical/Industry Strategy: The vendor's strategy to
direct resources, skills and offerings to meet the specific
needs of individual market segments, including vertical
markets.
Innovation: Direct, related, complementary and
synergistic layouts of resources, expertise or capital for
investment, consolidation, defensive or pre-emptive
purposes.
Geographic Strategy: The vendor's strategy to direct
resources, skills and offerings to meet the specific needs
of geographies outside the "home" or native geography,
either directly or through partners, channels and
subsidiaries as appropriate for that geography and
market.
Atos, headquartered in France, has an IGA division in Germany producing DirX Identity and Access
Management. The DirX products appeal to organizations with complex IT environments or unique
vertical requirements that are looking for a turnkey solution or for Atos to provide a managed service.
Its customer base is made up of many verticals, with the largest being government at over 25%,
manufacturing and natural resources at 20%, and healthcare at 15%. The majority of its customers
manage between 25,000 and 1 million users (the average is 375,000) and automated provisioning to
between six and 50 targets.
Strengths
Atos is highly focused on providing IGA solutions that are specialized for the needs of different
vertical industries.
A majority of reference customers ranked DirX as strong in flexibility, scalability, connector
support and stability.
It is one of a few vendors to feature physical and logical security integration, as well as IT and OT
integration, in its product strategy.
Cautions
Atos recently acquired Bull, which owns Evidian, so Atos is now in possession of two IGA products
with significant overlap. Clients are strongly advised to seek clarity from Atos on product road
maps.
It does not have distinctive marketing for its IGA products and has low visibility in the general
market.
Its user interface and workflow processes use a mix of different technologies: Tcl, Java and
JavaScript, making the product more difficult to maintain.
Avatier
Avatier, based in California, offers the Avatier Identity Management Suite (AIMS) with multiple,
separately licensed modules. AIMS is a good fit for organizations with limited resources that emphasize
simplicity and automation through self-service. The product extends the IAM self-service interface,
workflow and governance capabilities to a more general service catalog to let users request, govern and
administer other assets beyond accounts and permissions, such as computers, office supplies, and so
on.
Avatier's customers are diversified across industry verticals. Manufacturing and natural resources,
followed by healthcare and education are the strongest sectors. The majority of its customers manage
between 3,000 and 50,000 users (the average is 15,000) and provision between one and five target
systems.
Strengths
Avatier remains a nimble IAM player that is broadening its suite without losing focus on usability,
fast time to value and ease of maintenance.
Its administrative and end-user interface supports 30 languages, including many double-byte
Asian languages and nearly every European language, and it has recently opened sales offices in
Australia and Singapore, though 80% of its sales are in North America.
It responded rapidly to mobile market and compliance requirements by offering apps for access
request and password management on all major mobile platforms.
Cautions
20.05.2015 17:50
3 von 18
It lags behind the average vendor in this Magic Quadrant in bringing IGA features to market,
which may be a result of having fewer R&D resources than expected for a company of its size.
Its IGA channel network is still limited, as most partners resell only Avatier's password reset and
single sign-on (SSO) offerings.
Its product lags behind in capabilities such as the lack of a role-based approach for managing and
certifying access entitlements, and scores in the lowest quartile of the "product or service"
evaluation criterion.
Beta Systems
Germany-based Beta Systems offers its Security Access Manager Enterprise Identity Manager (SAM
EIM) for governance and provisioning functions, and Garancy Access Intelligence Manager (AIM) for
analytics. Beta Systems is a good fit for enterprises with complex requirements, and those that need
highly customizable environments. Beta Systems' support for managing mainframe security is richer
than that of most competing products because SAM EIM's origins were in the mainframe market
however, more than half of its current customers run on nonmainframe platforms.
About three-quarters of its customers are in Europe; the rest are in North America. Most customers
service the banking, securities and insurance sectors. Transportation and healthcare follow. The
majority of its customers manage between 2,000 and 250,000 users (the average is 27,000) with
automated provisioning of between four and 900 target systems.
Strengths
Beta Systems appeals to clients beyond its traditional financial and insurance sector customer
base through effective targeted marketing paired with good market understanding.
It has invested heavily in IGA over the past year and is progressing well on a technology refresh.
It has a strong internal focus on quality, and receives high customer satisfaction rankings with
product and support and maintenance.
Cautions
Its geographical reach is limited, and efforts to expand international offices in Europe and North
America have yet to yield results.
SAM EIM's end-user interface is designed for the technical user, not the business user, although a
new UI is in the works as part of the technology refresh.
Beta Systems is closing more deals, but deal size is smaller, causing sales growth to be largely
flat.
CA Technologies
New York-based CA Technologies offers the CA Identity Suite that includes the CA Identity Portal as a
common user interface for the two distinct products: CA Identity Manager (provisioning) and CA
Identity Governance (governance). It is a good fit for organizations emphasizing requirements for
access request and role and management.
CA Technologies is a major vendor in the IAM market and offers an extensive suite of enterprise
security products. Its customer base spans all major industries with a particularly deep presence in
banking, securities and insurance, government, and utilities. The majority of its customers manage
between 10,000 and 200,000 identities, with automated provisioning between two and 2,700 target
systems.
Strengths
It has a global presence and large channel network that enables its IGA products to be sold and
deployed worldwide.
It has made significant investments in its IGA products, including System for Cross-Domain
Identity Management (SCIM) connectors for SaaS endpoints, SOAP and REST Web services
interfaces, and the CA Identity Portal that centralizes a user's view of entitlement data and
provides an intuitive access-request shopping cart experience.
It stands out for making creative use of social media in its marketing and in getting mainstream
media attention.
Cautions
Its workflow engine is complex to configure, especially when working with requests for multiple
resources.
Reference customers rated it in the lowest quartile in satisfaction for product and
support/maintenance though it is still rated positive overall.
It has fallen behind in core, on-premises enterprise product capabilities, since its innovation has
been focused mostly on supporting consumer identity management and cloud use cases.
Courion
Courion, based in Massachusetts, offers the Courion Access Assurance Suite (AAS), consisting of
several modules that can be licensed separately. The Access Insight module can be deployed on top of
incumbent IGA solutions from other vendors to provide detailed identity and access intelligence through
analytics. Courion has a strong standing with enterprises of up to 25,000 users, and does well in
regulated industries with requirements in governance, auditing and analytics.
More than a third of Courion's customers are in healthcare, followed by banking, securities and
insurance, and manufacturing and natural resources. The majority of its customers manage between
1,500 and 30,000 users (with an average of 20,000) with automated fulfillment of three to 80 systems.
However, some references had significantly higher identity and system numbers.
Strengths
20.05.2015 17:50
4 von 18
AAS was the only product to consistently perform well across every product scenario within this
Magic Quadrant's evaluation criteria, in contrast with the other vendors' products that each had
poor results in several of the evaluated product scenarios.
Reference customers reported satisfaction with the product, and support is among the highest of
all vendors evaluated. All reference customers indicated that they were highly likely to
recommend the product to others.
Its uniquely differentiated marketing message emphasizes analytics for "intelligent" IAM and
resonates with customers and prospects.
Cautions
Some partner relationships have been problematic and have affected its customers.
Gartner hears frequent complaints about the timeliness and consistency of Courion's delivery of
professional services.
Courion lists more than 350 connectors available for its products, but Gartner clients indicate that
Courion has difficulties with the quality of newly developed connectors and with providing
maintenance updates in a timely manner.
Dell
Texas-based Dell develops its IGA product, Dell One Identity Manager, in Germany. It is sold in
separate editions with different modules. It has a strong following in Europe, where it has been
localized in 13 languages. It is a good fit for companies requiring strong governance and deep SAP
integration.
Customers' verticals are banking, securities, insurance, communications and media services. The
majority of its customers manage between 1,000 and 37,000 identities (the average is 20,000), and
most run automated provisioning from one to 10 target systems.
Strengths
Its product provides very good policy management, contextual information for approvers and
certifiers, and workflow rerouting capabilities.
All reference customers reported that the product was easy to use and had technically proficient
out-of-box functionality.
The Dell Community is a successful forum facilitating interactions between product engineering
staff and customers.
Cautions
Dell has not managed to replicate its European IGA success in other geographies notably in
North America.
Its reference customers' satisfaction rate with support and maintenance, while still positive
overall, is among the lowest of all vendors.
Several reference customers noted that finding experienced talent for Dell's solution is difficult.
Resources from Dell are in limited supply which has been confirmed by Gartner clients.
EMC (RSA)
Massachusetts-based RSA, the Security Division of EMC, acquired one of the pioneers in the IGA space,
Aveksa, last year. RSA Identity Management and Governance (RSA IMG), is offered in modules that are
priced and licensed separately. It is a good fit for organizations with heavy governance requirements.
RSA has worked hard on an automated fulfillment and provisioning module; however, this is new and
not in wide use.
RSA has customers across all major industry verticals, with half of its customers in banking, securities
and insurance. The majority of its customers manage between 5,000 and 250,000 identities (the
average is 35,000). Only a third of customer references used RSA IMG to automatically provision to
target systems with most provisioning between three to eight targets.
Strengths
RSA IMG scored above the average across all product capabilities except for identity life cycle and
password management and scores very high in scalability and performance.
RSA is leveraging its Archer governance, risk and compliance (GRC) and IGA products for upsell
opportunities to organizations with heavy compliance requirements.
RSA is very responsive to market trends and demonstrates one of the highest levels of innovation.
Cautions
Its ambitious global partner strategy is in the early days of execution, which may strain its
professional services delivery capacity in times of high demand.
Reference customer satisfaction scores are in the lowest quartile among all vendors (though still in
positive territory).
RSA IMG is being sold for prices over the market average.
Evidian
France-based Evidian offers Identity and Access Manager (Evidian I&AM), which includes Web access
management (WAM) capabilities and synchronization, policy, provisioning and management modules.
Due to its lower integration and maintenance costs, Evidian is a good fit for a range of small and
midsize business (SMB) and enterprise clients that need self-service interfaces and workflow
automation with modest governance requirements.
Healthcare, banking, securities and insurance account for 50% of Evidian's customers. Government,
communications, media and services, manufacturing, and natural resources are strongest with other
verticals. The majority of its customers manage between 400 and 20,000 identities and automated
provisioning between two and 17 target systems. Some customers have significantly higher identity
counts.
Strengths
Good visibility across media and frequent participation at industry events have grown the brand in
relevant markets and verticals.
It has a strong channel network that is responsible for nearly half of its revenue and surveyed
20.05.2015 17:50
5 von 18
partners give consistent positive feedback.

Its responsiveness to market trends, standards and regulatory needs is above average and
demonstrates a good market understanding, product strategy and innovation.
Cautions
Support for access certification and SOD is basic, and the product lacks role mining analytics; role
mining is available only via professional services.
Atos recently acquired Bull, which owns Evidian, so it is now in possession of two IGA products
with significant overlap. Clients are strongly advised to seek clarity from Atos and Evidian on
product road maps.
Evidian's products are not used outside EMEA, apart from a limited number of Japanese
deployments.
Fischer International
Florida-based Fischer International has a long history with IGA. Most customers are running its Fischer
Identity Suite as a service; however, many run this product on-premises. Its offering allows extensive
configuration and is appealing to organizations with limited governance requirements that need to
manage many external identities.
Fischer International is strong in higher education (nearly 50% in that vertical), followed by
manufacturing and natural resources, banking securities and insurance, and utilities. The majority of its
customers manage between 1,250 and 250,000 identities (the average is 16,000), with automated
provisioning for between five and six target systems.
Strengths
Reference customer satisfaction ratings for the product and for support and maintenance are
among the highest of all vendors evaluated.
Fischer International's clear and differentiated messaging for higher education creates strong
awareness and brand recognition at the expense of being ignored by many customers in most
other verticals.
Its turnkey higher education offering is quickly deployed and integrates with typical on-campus
and cloud-based systems.
Cautions
Fischer International has no presence outside the U.S. and only a very small number of
international partners.
Buyers should be vigilant in verifying that the vast majority of their business needs are aligned
with the product's out-of-the-box capabilities, because Fischer's product strategy emphasizes
configuration, with limited support for customized code to integrate nonconforming business
processes.
Limited governance and analytics capabilities make it difficult to establish a footprint in regulated
industries.
Hitachi ID Systems
Canada-based Hitachi ID offers the Hitachi ID Identity and Access Management Suite, with several
modules that can be licensed separately. It is popular with North American IT buyers who are looking
for a flexible account and password management solution with strong support for policy-based
administration and is offered in 17 languages.
The three largest customer verticals include banking, securities and insurance, which account for
one-third of the business, followed by manufacturing, natural resources and education. The majority of
its customers manage between 5,000 and 25,000 identities, with automated provisioning of between
three and 140 target systems. Only 25% of reference customers are using its access certification
capabilities.
Strengths
All reference customers indicated that they were either likely or highly likely to recommend the
product to others.
The product reduces deployment risk and total cost of ownership by providing out-of-the-box
reference builds that support typical identity life cycle patterns.
Hitachi ID provides all options and all connectors in one product, thus avoiding the multimodule
purchasing dilemma (buy now or later) that customers face with some other vendors.
Cautions
By targeting IT buyers only, it risks being overlooked by business decision makers.
Its end-user interface is a technically efficient display of text and tables that will be acceptable to
IT users but may not be appealing to business users.
It lacks a strong international customer base, as 85% of its customers are in North America.
Identity Automation
Texas-based Identity Automation offers RapidIdentity for self-service and delegation and includes
workflow, access requests, access certification, password management, auditing, reporting, group
management, and folder/file access management. Identity Automation is a good fit for North American
customers who require a solution with automated provisioning, access request and workflow
capabilities.
Identity Automation's customers typically buy an IGA system that is configured and/or customized by
the vendor via an added cost professional services engagement. Most reference customers are in
education and use automated provisioning of up to 10 target systems. The majority of its customers
manage between 7,000 and 250,000 identities (the average is 75,000), although there is one notable
customer with a significantly higher identity count.
Strengths
Identity Automation's pricing strategy appeals to the education market, since it counts only
full-time employees but not students.
Reference customers indicate they like the flexible, highly configurable and easy-to-customize
products.
20.05.2015 17:50
6 von 18
Reference customer satisfaction rates are among the highest of all vendors surveyed. The
customers all commented on the strong level of support, ease of use, and flexibility.
Cautions
The lack of a partner network could impede long-term growth; it is a small, emerging product
company that has transformed from a consultancy.
Its geographical coverage is limited to North America, and its products are only available in
English.
Identity Automation provides reapprovals tied to specific resources but there is no support for
creating ad hoc certification campaigns or for identity analytics.
IBM
New York-based IBM offers IBM Security Identity Governance and Administration, a suite that combines
IBM Security Identity Manager (ISIM) with the recently acquired CrossIdeas platform, now named IBM
Security Identity Governance. IBM is a good choice for large organizations with complex processes that
need automation and governance capabilities and are willing to invest in significant professional
services.
One-fifth of its customers are in banking, securities and insurance, with the rest evenly distributed
across all other industry verticals. Most reference customers are managing between 4,500 and 85,000
identities (the average is 27,000), with automated provisioning of between two and 100 target
systems.
Strengths
The CrossIdeas acquisition has reinvigorated IBM's Global Account (IGA) product line, adding
some of the most advanced governance capabilities.
Its large, global presence allows products to be sold effectively everywhere.
IBM has a very successful, heavily invested channel network. Surveyed value-added resellers
(VARs) indicate high partnership satisfaction.
Cautions
The ISIM business user interface has garnered criticism from Gartner clients, which IBM has
started to address, but there is still a large amount of work ahead.
The integration of CrossIdeas into a harmonious offering will take significant work and time.
Half of IBM's reference customers mentioned that the product is complex and requires a steep
learning curve, which is in line with our interactions with Gartner clients.
NetIQ
Texas-based NetIQ offers its NetIQ Identity Manager with several optional modules, including an Access
Review governance component. Additionally, it offers NetIQ Access Governance Suite (AGS), which is a
white-labeled version of SailPoint's governance product that is sold and supported by NetIQ under an
OEM agreement. Both NetIQ Identity Manager and AGS were evaluated as a combined solution for the
purposes of this Magic Quadrant. NetIQ's products should especially appeal to organizations that are
looking for a flexible solution that provides the ability to scale over time with strong automation and
provisioning capabilities.
Its customers are evenly distributed over multiple verticals, led by government with about one-fifth.
The majority of its customers manage between 100 to 50,000 (the average is 7,000) identities, with
automated provisioning of between three and 250 targets. Some customers have significantly higher
identity counts.
Strengths
NetIQ is rated highly for support and maintenance by reference customers.
It has a well-developed, worldwide channel network that provides local experience and helps to
sell its products globally.
Several reference customers from smaller installations to very large deployments have
commented positively on scalability.
Cautions
NetIQ does not promote its vertical industry capabilities to their full potential, with differentiated
marketing messaging or targeted offerings.
Without AGS, NetIQ's capabilities for access certification and identity analytics are below the
average of other vendors in this Magic Quadrant.
Rather than offering a library of ready-to-use templates or workflows, NetIQ relies heavily on
system integrators to add these in client deployments.
Omada
Denmark-based Omada offers the Omada Identity Suite (OIS). OIS should particularly appeal to
organizations with complex IT environments or those that are heavily invested in Microsoft and/or SAP
systems and that require a flexible solution with strong reporting capabilities.
One-quarter of Omada's customers are within banking, securities and insurance, and one-fifth is in
healthcare. The rest of its customers are evenly split across the remaining verticals. The majority of its
customers manage between 1,600 to 100,000 identities (the average is 35,000) with automated
provisioning of between one and 250 targets.
Strengths
Omada has a highly flexible data model, ranks in the highest quartile for overall product scores,
and scored very high in auditing, reporting and dashboards.
Omada's geographic strategy is paying off, with increased customer numbers in North America
and strong growth in Central Europe.
Pricing for its product is very competitive, especially for user counts of less than 20,000.
Cautions
Although Omada is profitable and grows, revenue growth from software has slowed down over the
past two years, reflecting low investment in sales and marketing.
20.05.2015 17:50
7 von 18
Omada has invested in provisioning capabilities as an alternative option to utilizing Microsoft

Forefront Identity Manager (FIM) synchronization for fulfillment and connectors, but its
replacement capabilities are below average.
Its desire to use its own professional services impedes needed partner expansion and results in
some competitive partner situations.
Oracle
California-based Oracle offers its Oracle Identity Governance (OIG) Suite, which is especially suited for
large organizations with complex processes and that require flexibility in the product.
IGA customers are spread evenly across industry verticals. Its reference customers manage between
about 1,100 and 500,000 identities (the average is 95,000), with automated provisioning between one
and 450 targets.
Strengths
It is the most frequently shortlisted vendor among other vendors' reference customers and the
vendor most often cited as the competitor to beat by the others included in this Magic Quadrant.
Adding Oracle's IGA solution to a portfolio of other Oracle IAM products can leverage synergies
between those products, making it appealing to existing Oracle customers that view the company
as a strategic partner.
Its global presence and global channel partners enable it to be deployed worldwide.
Reference customers highlighted reliability, scalability, performance and flexibility as strong
points.
Cautions
Two-thirds of reference customers cite product complexity as a challenge and weak point. Expect
significant professional services investment.
OIG is by default licensed on a per-processor or, upon request, on a per-user basis. While
CPU-based licensing can be attractive for large user populations, additional processor licenses may
be necessary when overall activity increases, which can complicate long-term budgeting.
Several reference customers have experienced challenges keeping up with Oracle's product
consolidation and refurbishment over the past two years, which is in line with our interactions with
Gartner clients. This is expected to stabilize with OIG version 11gR2 PS3.
SailPoint
Texas-based SailPoint, one of the pioneers of identity and access governance technology, offers
IdentityIQ with several optional modules. Its product should appeal to organizations with stringent
governance requirements that also need a moderate level of provisioning (up to 250 targets).
Almost half of its customers are in banking, securities and insurance. The rest are distributed evenly
among other verticals. The majority of its customers manage between 5,000 and 80,000 identities (the
average is 40,000), with automated provisioning of between two and 94 targets. However, there are a
few customers with significantly higher identity counts.
Strengths
A well-functioning and large partner network gives SailPoint momentum to sell and deploy its
products worldwide, and provides an abundance of professional services skill sets.
Reference customers indicate satisfaction rates for the product, and support and maintenance are
in the highest quartile in this report.
Its product scores among the highest across traditional governance capabilities because of its
excellent access certification and role management features.
Cautions
Its product is one of the most expensive ones for user counts of less than 10,000.
One-third of its reference customers report performance and scalability problems; however, those
reference customers using the latest release report early signs of improvement.
SailPoint has redesigned and upgraded its provisioning and fulfillment capabilities, yet the quality
of some connectors is still lagging behind.
SAP
Germany-based SAP offers an IGA solution consisting of five modules, including SAP Identity
Management and SAP Access Control. Its solution administrates users and provisions accounts within
SAP applications and outside target systems, and provides governance capabilities for heterogeneous
environments and SOD controls management for SAP applications. Its products are an excellent fit for
existing SAP customers who can take advantage of its extensive and unequalled SAP application
integration.
Its customers are found across a broad range of SAP's business and technology software, leveraging
common master data and processes for identity and access. Its customers are distributed evenly across
verticals, with utilities, manufacturing and natural resources each making up one-fifth. Customer
references were in the range of 1,200 to 60,000 identities managed (with an average of 20,000), and
used up to 70 targets for automated provisioning (with an average of 20).
Strengths
SAP Access Control is a strong role performer, includes deep transaction support and is able to
work with multiple application-specific role structures.
SAP has an extensive global presence and a large network of VARs and system integrators that
can deliver global services.
SAP has a strong focus on product quality as parts of its operational processes.
Cautions
SAP's marketing communications target only existing SAP customers and lack differentiation from
typical messages in the industry.
Organizations without a significant commitment to SAP applications and technology should look for
other IGA alternatives.
Reference customers have indicated that the overall administration of the solution, and tracking
20.05.2015 17:50
8 von 18
and monitoring errors in provisioning workflows is difficult.
The Dot Net Factory

Ohio-based The Dot Net Factory offers EmpowerID a rich suite of IAM tools that include IGA
capabilities. Its product should appeal to organizations that are mainly running on a Microsoft
environment and are looking for flexibility and strong automation capabilities.
Gartner estimates that about two-thirds of its customers are divided among healthcare, banking,
securities and insurance, and government. The Dot Net Factory did not respond to requests for
supplemental information, but it did review the draft contents of this document. Gartner's analysis is
based on other credible sources, including information that The Dot Net Factory provided for last year's
research, public information, and conversations with three users of its product. The majority of its
customers manage between 1,000 and 25,000 identities. Some customers have significantly higher
identity counts.
Strengths
All users interviewed were positive about the flexibility of the product and the "can-do attitude" of
the company.
The Dot Net Factory is effective at leveraging social media and online community forums to
provide responsive and detailed product training and support.
Its product has extensive workflow capabilities and comes with hundreds of predefined workflows.
Cautions
A very small channel network and limited technical resources hamper the company's ability to
extend its reach and scale the business.
Customers report that documentation for internal data structures and proprietary functions is
lacking, so customers have to engage The Dot Net Factory for most customizations.
The company's marketing strategy and marketing execution lags the norm of other vendors rated
in this research. By targeting IT buyers only, it risks being overlooked by business decision
makers.
Vendors Added and Dropped

We review and adjust our inclusion criteria for Magic Quadrants and MarketScopes as markets change.
As a result of these adjustments, the mix of vendors in any Magic Quadrant or MarketScope may
change over time. A vendor's appearance in a Magic Quadrant or MarketScope one year and not the
next does not necessarily indicate that we have changed our opinion of that vendor. It may be a
reflection of a change in the market and, therefore, changed evaluation criteria, or of a change of focus
by that vendor.
Added
Identity Automation
The Dot Net Factory
Dropped
The following vendors have credible IGA offerings but did not meet the elevated inclusion criteria for
this Magic Quadrant:
Caradigm, based in the state of Washington, has a singular focus on the healthcare market and
has for that reason been excluded from this Magic Quadrant.
Brazil-based e-trust's Horacius product has been developed with a focus on security and
governance. It emphasizes configuration over customization, and has special capabilities to help
its customers comply with Brazilian federal regulations concerning data privacy and integration
with the eSocial government portal, making it popular in that geography.
Singapore-based Deep Identity offers an IGA solution in form of its Deep Identity Audit &
Compliance Manager (Deep IACM), Deep Identity Manager (Deep IM) and Deep Data Governance
Manager (Deep DGM) products. The products are popular in Asia, and the company is starting to
expand its geographical reach through partnerships.
iSM Secu-Sys is based in Germany and offers IGA functionality through its bi-Cube IAM suite.
The product has a long history and appeals to buyers in the German-speaking DACH region
(Germany, Austria, Switzerland), as it aligns with typical business processes and usage patterns
common to that geography.
Other Notable Vendors

The following vendors have credible IGA offerings, but did not meet the elevated Inclusion Criteria for
this Magic Quadrant:
Brainwave, based in France, offers its Identity GRC solution, with a focus on the management
and monitoring of controls over user access, with a strong emphasis on analytics and reporting.
Its primary customer vertical is banking and finance in France and the Benelux region of Europe.
ForgeRock, based in California, offers an open-source product called OpenIDM with a focus on
REST-based APIs and on scalability, which makes it popular with organizations needing largecustomer or citizen-facing provisioning solutions. It is gaining traction among enterprise
customers worldwide.
Germany-based FSP's product Organization and Resource Guards (ORG) provides IGA
functionality on z/OS, Unix and Windows. It enjoys popularity in the German insurance sector.
Microsoft's Forefront Identity Manager (FIM) product provides access management and data
synchronization features to Microsoft and non-Microsoft applications and infrastructure. Up until
May 2014, Microsoft did not confirm plans to evolve this product with major releases beyond
2015. Since then, Microsoft has announced a long-term road map and has rebranded the product
as Microsoft Identity Manager (a public preview was released 13 November 2014). The public
preview displayed many new capabilities; however, very few of them fall into Gartner's definition
of IGA. Microsoft has announced investment in IGA-specific capabilities for subsequent versions
(after 2015). Gartner will closely monitor Microsoft Identity Manager for potential inclusion in
future IGA Magic Quadrants.
New York-based OpenIAM, provides an open-source product, Identity Manager, that includes IGA
functionality, including user provisioning, password management, auditing and delegated
administration. It is deployed worldwide by customers across multiple verticals.
20.05.2015 17:50
9 von 18
Spanish vendor Soffid provides an open-source product called Identity & Access Management.
The product has comprehensive IGA capabilities and enjoys popularity in Spain, and the company
is extending its geographical reach through partnerships in other regions, notably Europe,
Asia/Pacific and Latin America.
Inclusion and Exclusion Criteria

Inclusion Criteria
While there are IAM products that deliver some of the functionality listed below, this IGA Magic
Quadrant covers vendors that contain all of these features in a product specifically tailored and sold to
manage access request life cycles. These core features consist of:
User interface configuration for multiple user profiles
Capabilities to support the identity and entitlement life cycles
Tools for application entitlement discovery, mining and management
Tools for role discovery and engineering (that is, the identity data model)
Capabilities to create and edit master data related to identity and access
Capabilities to consume data from multiple authoritative sources of truth
Tools to certify data related to identity and access data by specified actors (managers,
resource/application owners, and so on)
Comprehensive workflow capabilities
Tools to reconcile data from target systems with IGA data
Tools to manage and synchronize passwords among different target systems
Tools to support auditing, and segregation of duty administration and compliance
Tools for user or application role and entitlement administration, and management
Tools for defining and enforcing identity and access policies, as well as remediation of violations
Configurable logging for identity and access activities and actions for administrative and end users
Analytics and reporting of identity and access activities and actions for administrative and end
users
Underlying architecture for the above, including connector architecture for data collection and
fulfillment actions
Products must be deployed in customer production environments, and customer references must be
available.
Exclusion Criteria
IGA vendors that are not included in this Magic Quadrant have been excluded for one or more of these
reasons:
These vendors:
Do not meet at least half of the Inclusion Criteria
Supply IGA capabilities for only one specific/targeted technical environment for example,
Windows, IBM i, Unix/Linux, and so on
Supply IGA capabilities only as a service
Had 2013 license revenue for on-premises IGA products that was less than $1 million
Are not the original manufacturer of the IGA products including value-added resellers that
repackage IGA products that would qualify from their original manufacturers
Include other software vendors that sell IAM-related products but don't have an IGA product of
their own
Are external service providers (ESPs) that provide managed services for example, data center
operations outsourcing
Evaluation Criteria
Gartner analysts evaluate providers on the quality and efficacy of the processes, systems, methods or
procedures that enable IT provider performance to be competitive, efficient and effective, and to
positively impact revenue, retention and reputation. Ultimately, providers are judged on their ability
and success in capitalizing on their vision.
Each Magic Quadrant has two evaluation categories: Ability to Execute and Completeness of Vision.
Each is described below, with subcriteria and weightings provided.
Ability to Execute
Product or Service
Core on-premises products offered by the vendor serve the defined market. This includes current
product capabilities, quality, feature sets, skills, and so on, as defined in the market definition and
detailed in the subcriteria (capabilities). The specific subcriteria are:
Identity life cycle
Entitlements management
Access requests
Workflow
Policy management
Access certification
Fulfillment
Password management
Role management
Auditing
Analytics
20.05.2015 17:50
10 von 18
Reporting and dashboards

Ease of deployment
Scalability and performance
Overall Viability
Viability includes an assessment of:
The vendor's overall financial health
The practical and financial success of the business unit
The continued investment by a business unit in its IGA product
The advancement of state-of-the-art functionality within the organization's portfolio of IGA
products
A history of investment in identity and access management product development
The contribution of IGA to revenue growth
Sales Execution/Pricing
The IGA provider's capabilities in all presales activities and the structure that supports them. This
includes deal management, pricing and negotiation, presales support, and the overall effectiveness of
the sales channel. Factors include pricing, market share and additional purchases (for example,
relational database management system [RDBMS], application server, Web server, and so on).
Market Responsiveness/Record
The vendor's demonstrated ability to respond, change direction, be flexible and achieve
competitive success as opportunities develop, competitors act, and market dynamics change
How the vendor can meet customers' evolving IGA needs over a variety of use cases
How the vendor has embraced standards initiatives in the IGA and adjacent market segments and
responded to relevant regulation and legislation
Marketing Execution
The clarity, quality, creativity and efficacy of programs designed to deliver the vendor's message to
influence the market, promote the brand and business, increase awareness of the products, and
establish a positive identification with the product/brand and vendor in the minds of buyers.
This mind share can be driven by a combination of publicity, promotional initiatives, thought leadership,
word-of-mouth and sales activities.
Customer Experience
Relationships, products and services/programs that enable customers to be successful with the IGA
products evaluated. Specifically, this includes the ways customers receive technical support or account
support. This can include ancillary tools, customer support programs (and the quality thereof),
availability of user groups, service-level agreements, and so on. Factors include customer support
programs, service-level agreements, and Gartner client and reference customer feedback.
Operations
The ability of the organization to meet its goals and commitments regarding its IGA product. Factors
include the quality of the organizational structure, including skills, experience, programs, systems and
other vehicles that enable the organization to operate effectively and efficiently on an ongoing basis.
Factors include staffing and recruitment and number of major reorganizations in past 12 months.
Table 1. Ability to Execute Evaluation

Criteria
Evaluation Criteria
Weighting
Product or Service
High
Overall Viability
Medium
Sales Execution/Pricing
Medium
Market Responsiveness/Record
Medium
Marketing Execution
Medium
Customer Experience
High
Operations
Medium
Completeness of Vision
Market Understanding
The ability of the vendor to understand buyers' needs and translate these needs into products and
services. Vendors that show the highest degree of vision listen and understand buyers' wants and
needs, and can shape or enhance those wants with their added vision. Factors include:
Understanding customer needs
Identifying market trends and changes
Marketing Strategy
The clarity, differentiation and performance management of the vendor's marketing messages and
campaigns.
The appropriateness of the vendor's use of social media, other online media and traditional media as
20.05.2015 17:50
11 von 18
part of its marketing efforts.

Sales Strategy
The strategy for selling product that uses the appropriate network of direct and indirect sales,
marketing, service, and communication affiliates that extend the scope and depth of market reach,
skills, expertise, technologies, services and the customer base.
Offering (Product) Strategy
The vendor's approach to developing and delivering its IGA offerings that meet customers' and
prospects' needs with respect to their key selection criteria, the needs created by the Nexus of Forces
and other market dynamics.
Factors include:
How the vendor will increase the competitive differentiation of its products
The vendor's ability to exploit the Nexus of Forces to improve its products
The vendor's participation in IGA and adjacent standards development
Business Model
The soundness and logic of the vendor's underlying business proposition.
Vertical/Industry Strategy
The vendor's strategy to direct resources, skills, and offerings to meet the specific needs of individual
market segments, including SMBs, service providers and verticals.
Innovation
The vendor's culture of innovation, continuing track record in market-leading innovation, and the
provision of distinctive products, functions, capabilities, pricing models, and so on. We focus on
technical and nontechnical innovations introduced since July 2013, as well as the vendor's road map
over the next few years.
Geographic Strategy
The vendor's strategy to direct resources, skills and offerings to meet the specific needs of geographies
outside the "home" or native geography, either directly or through partners, channels and subsidiaries,
as appropriate for that geography and market.
Table 2. Completeness of Vision

Evaluation Criteria
Evaluation Criteria
Weighting
Market Understanding
High
Marketing Strategy
Medium
Sales Strategy
Medium
Offering (Product) Strategy
High
Business Model
Medium
Vertical/Industry Strategy
Low
Innovation
High
Geographic Strategy
Low
Quadrant Descriptions
Leaders
IGA Leaders deliver a comprehensive toolset for governance and administration of identity and access.
These vendors have successfully built a significant installed customer base and revenue stream, and
have high viability ratings and robust revenue growth. Leaders also show evidence of superior vision
and execution for anticipated requirements related to technology, methodology or means of delivery.
Leaders typically demonstrate customer satisfaction with IGA capabilities and/or related service and
support.
Challengers
IGA Challengers deliver a relatively strong set of governance and administration features for identity
and access. Some have major clients using their IGA solution. Challengers also show strong execution,
and most have significant sales and brand presence. However, Challengers have not yet demonstrated
the feature completeness, scale of deployment or vision for IGA that Leaders have. Rather, their vision
and execution for technology, methodology and/or means of delivery tend to be more focused or
restricted to specific platforms, geographies or service. Clients of Challengers are relatively satisfied but
ask for additional IGA features as they mature.
Visionaries
Vendors in the Visionaries quadrant provide products that meet many IGA client requirements, but may
not have the means (such as budget, personnel, geographic presence, visibility and so on) to execute
as Leaders do. Due to smaller size, there may be initial concerns among some potential buyers of
long-term viability. Visionaries are noted for their innovative approach to IGA technology, methodology
and/or means of delivery. They often may have unique features, and may be focused on a specific
industry or specific set of use cases, more so than others. Visionaries are often the technology leaders
in evolving markets such as IGA, and enterprises that seek the latest solutions often look to Visionaries.
Niche Players
Niche Players provide IGA technology that is a good match for specific IGA uses, cases or methodology.
20.05.2015 17:50
12 von 18
They may focus on specific industries and can actually outperform many competitors. They may focus
their IGA features primarily on a specific vendor's applications, data and/or infrastructure. Vendors in
this quadrant often have a small installed base, a limited investment in IGA, a geographically limited
footprint, or other factors that inhibit providing a broader set of capabilities to enterprises now and
during the 12-month planning horizon. Inclusion in this quadrant, however, does not reflect negatively
on the vendor's value in the more narrowly focused service spectrum. Niche solutions can be very
effective in their area of focus.
Context
In 2013, Gartner covered the IGA market for the first time with a brand-new, inclusive Magic Quadrant,
with a comprehensive list of vendors that established the IGA market as the combination of user
administration and provisioning (UAP) and identity and access governance (IAG). In 2014, Gartner
recalibrated to focus on clients who will be make purchasing decisions for IGA products within the next
year. These are significant investments, and clients will need to be assured that their purchasing
decisions align with the trends that impact how organizations will run IGA technology over many years.
Anticipating future needs is a crucial and important component of how Gartner weighs its evaluation
criteria, ratings and scoring of IGA vendors.
Gartner believes digital business is an important overall IT trend that will lead to adoption of bimodal
IT, and with it will come bimodal IAM. Bimodal IAM means running systems in two modes: one that is
"built to last" and one that is "built to adapt" to a constant disruptive environment. The adaptive mode
will require technology that is more agile, flexible and facilitates innovation.
For these reasons stated above, we have adjusted our evaluation criteria weighting to reflect the
following:
The adaptive/agile mode of IT will require organizations to look for a transformational product
strategy that reflects constant innovation and development from vendors. For this reason, Gartner
lowered the weightings for marketing strategy, sales strategy, vertical/industry strategy and
geographic strategy in the Completeness of Vision category in order to give a relatively stronger
focus to market understanding, offering (product) strategy and innovation.
For Ability to Execute, Gartner lowered the weighting for marketing execution and sales
execution/pricing because innovations, excellent products and good customer experiences should
carry more weight than revenue numbers and mind share. Gartner lowered market
responsiveness/record because true innovators will lead future trends before the market has time
to adopt.
Your needs and circumstances should determine how you use the Magic Quadrant, not the other way
around. To evaluate vendors in the Leaders quadrant only and ignore those in other quadrants is risky
and thus discouraged. For example, a vendor in the Niche Players quadrant could offer functions that
are ideally suited to your needs. Similarly, a Leader may not offer functions that meet your
requirements for example, its offerings may cost more than competitors or it may not support your
region or industry. Use a Magic Quadrant to narrow your list of choices, but do not base your decision
only on the model. Talk to the Gartner analysts who created the research for more details and insight.
Vendor positioning in Magic Quadrants illustrates useful information about vendors. For example, if you
want to make a strategic investment in a technology, a vendor's viability will be critical. Therefore,
weight a vendor's Ability to Execute more heavily than its Completeness of Vision, and evaluate
Challengers before Visionaries. Conversely, if you can gain a competitive advantage by investing in an
emerging technology, evaluate Visionaries before Challengers.
Organizations that take on IAM initiatives will require a combination of several technologies. IGA is the
central technology that manages the information about identities, accounts and entitlements. It
interacts, and in some cases even overlaps with:
Authentication: Corroboration of claimed identities and credential management. IGA products
often include password management as part of the offering (see "Market Guide for Password
Management Tools").
Authorization: These include Web access management (WAM), API gateways, management
tools, and externalized authorization management. These functions leverage identity information
managed by IGA products, and work together with authentication technology to control access to
resources (see "Market Guide for Web Access Management Software").
Directory Services: These hold information about users and groups and are provisioned by IGA.
Privileged Account Management (PAM): These tools are used to enforce policies concerning
privileged access, and they complement IGA tools. Where IGA tools manage accounts and
identities, PAM tools control access to privileged accounts and will enforce processes and monitor
the use of administrative privileges (see "Market Guide for Privileged Account Management").
Alternatives to IGA Software

Active Directory focus: Organizations whose use cases are centered around the Microsoft
environment may be able to use Microsoft-centric resource administration tools in lieu of IGA tools
to manage identities, accounts and permissions within this restricted scenario (see "Technology
Overview for Active Directory IAM Tools").
Cloud and SaaS: Organizations may opt to run IGA services in the cloud by subscribing to an
IDaaS vendor. This is a viable alternative for small organizations, those that have simple IGA
requirements or those that run a considerable amount of infrastructure in the cloud. Maturity and
capabilities for pure cloud IGA is still behind on-premises IGA with the exception of service
providers that run a dedicated instance of an on-premises IGA product as a managed service in
the cloud (see "Magic Quadrant for Identity and Access Management as a Service").
Selection Criteria
Organizations should consider IGA products from vendors in every quadrant of this Magic Quadrant
based on their specific functional and operational requirements. Product selection decisions should be
driven by several factors:
What is the total cost related to deploying the tool, including any consulting or professional
services?
What is the estimated length of time needed to deploy the tools?
Does the vendor have an efficient, working partner network that can quickly deliver specialized
services around the deployment and operation of the IGA products?
20.05.2015 17:50
13 von 18
Is support available locally, in the language of my organization and during regular business hours
within my geographies?
How easy is it to integrate this technology into my existing infrastructure? Will my IT organization
be able to support it?
Will my business users find it easy to work with this technology? How will it enable them, and the
business?
Does this vendor help my organization deliver compliance with security policies and regulations
more effectively?
Market Overview
In 2013, Gartner observed an increase in the consolidation of governance and administration functions
as forces in social, mobile, cloud and information continued to take root. This year, major vendors are
expanding capabilities in areas where they were not last year: Provisioning-centric players are investing
in IGA; governance-focused specialists are building out provisioning and fulfillment.
Gartner observes the following trends:
Most vendors have added mobile apps or special mobile Web interfaces to cater to targeted
business requirements such as approval processes, password reset, access requests and
certifications. Demand for integration with enterprise mobility management (EMM) products has
grown.
While some products offer analytics for traditional use cases such as role mining, other vendors
move beyond these use cases to add support for advanced risk analysis, fine-grained SOD
analysis for ERP products, and decision support for approvals and certifications. In the long run,
analytics is expected to enable automation of policies to eventually make manual approvals or
certifications obsolete.
An accelerated consolidation of governance and provisioning functions into a single product,
rather than two distinct products with different interfaces, is taking place. Provisioning-centric
vendors are investing in governance; governance-centric vendors are building out their
provisioning and fulfillment capabilities.
SCIM support for SaaS provisioning is growing, and some vendors are even using SCIM internally
in the backbone of their connector framework.
Emphasis on total cost of ownership as a selection criterion has continued. This drives adoption
of "good enough" solutions from smaller vendors inside and outside the Magic Quadrant. This is
also putting pressure on sales to offer competitive pricing and discounts, rather than value-based
pricing.
There is continued interest in the user experience as a selection criterion across a range of
business use cases. The age of IGA users being strictly IT users is rapidly declining.
An increased focus on threat protection, including insider threats, is driving integration of IGA
products with overall threat detection and analysis tools, specifically with SIEM products.
Integration between IGA products and PAM products is still in its early stages, driven by interest
from clients and competition from vendors that straddle the PAM and IGA markets.
A few vendors are adding business agility capabilities to embrace team-based project use cases
(such as access and approval chains tied to project membership) or people having multiple
personas (such as an employee who performs a different set of tasks under a different supervisor
as a result of a strike or weather-related emergency assignment).
There is a rush to alleviate complex deployment and upgrade processes, with virtual
appliance-based models becoming more popular. Several vendors have also made significant
efforts to make their product easier to deploy, administrate, customize and trace/debug
(especially in terms of workflows and connectors).
Similarly, a few vendors are providing libraries of workflow templates to better fit common
business processes, thereby reducing startup cost/time and simplifying customization.
Some of those vendors are even taking the last step further, providing a set of reference builds
that bring together workflow templates and user experience elements to produce a specific
configuration of their product that is more closely aligned with the needs of the customer.
Organizations that have had IGA platforms for five-plus years are beginning to re-evaluate their
vendor platforms, looking for a better user experience, reduced overhead (fewer people need to
support/configure the product), ease of deployment and increased scalability.
In 2014, the market size for IGA is estimated to be $1.52 billion with an annual growth rate of 13.94%
from 2013 to 2014 ($1.31 billion to $1.52 billion). This year, Gartner has revised the formula for IGA
market size based on a detailed re-evaluation of the market based on the number of vendor revenue
guidance and forecast growth expectations. Variance in IGA pricing is decreasing as several major
vendors are competing more on price with heavier discounts. Total cost of ownership has been under
client scrutiny, so several vendors are simplifying deployments, offering more pricing options or
reducing pricing.
In 2015, Gartner expects the consumerization of IGA which began in 2014 for many vendors to
continue to grow: Business demand for user-friendly interfaces is so strong that many vendors have
cited UI upgrades on product road maps. Four other areas that are emerging include business agility,
data access governance, privileged access and security.
Business agility: This is an emerging driver for IGA products specifically. Some vendors are
adding capabilities to extend data models for team-based project use cases and partnerships
between organizations that drive collaborative efficiencies.
Data access governance: Several vendors have reported a significant uptick in customer
interest for integration of IGA with data access governance (DAG) products. One vendor has an
offering and many are partnering with DAG vendors.
Privileged access: Integration between IGA products and PAM products is still in the early
stages, but is driven by interest from clients and competition from vendors that straddle the PAM
and IGA markets.
Security: An increased focus on threat protection, including insider threats, is driving integration
of IGA products with overall threat detection and analysis tools, specifically with SIEM products.
Small & Midsize (<1000 Employees) Context

10 March 2015
20.05.2015 17:50
14 von 18
Analyst(s): Felix Gaehtgens, Brian Iverson, Steve Krapes
Midsize organizations have similar IAM business requirements to those of larger organizations, but their
smaller size dictates a simpler IGA product that focuses on achieving low-cost IT efficiency. This
research helps midsize organizations with selecting and evaluating IGA vendors.
Market Differentiators
Midsize organizations have not uniformly adopted identity governance and administration (IGA)
technology for several reasons:
Many are not publicly traded or regulated and, therefore, do not face the same level of compliance
pressure.
IGA technology has historically been expensive to buy, difficult to deploy and required expert skills
to be used effectively.
Stakeholders in midsize organizations have fewer resources available and are difficult to convince
to make large investments on improving internal security posture and improving user and access
management.
However, many midsize organizations face many of the same issues as larger organizations:
Repetitive time-consuming administration tasks around granting entitlements leave the IT
department with little or no accountability or proper justification. This is a bigger problem for
midsize organizations because they typically have fewer IT staff.
Long turnaround times for access requests lead to a loss of employee efficiency.
A lack of a full identity and entitlement life cycle leads to access being granted when it should not,
and it not being removed when it is no longer needed thereby increasing risk.
For these reasons, midsize organizations should not hesitate to adopt IGA technology especially since
its overall total cost of ownership (TCO) has come down. The most commonly cited business driver for
midsize organizations is reduced operational cost via IT efficiency (process automation that eliminated
tedious manual tasks). Governance is rarely on the radar of privately held midsize organizations, except
for those that are regulated. However, risk management is a tangible and achievable goal even by
companies that do not have a large dedicated security and risk staff and should, therefore, not be
forgotten. Indeed, an initial focus on governance means an understanding of who has access to what
and since when, who authorized it, and when was this last reviewed? Getting the answers to these
questions will motivate many organizations to "clean up the house," identify risks and gaps, and in the
process, streamline the deployment of automation functions.
Considerations for Technology and Service Selection

Midsize organizations rarely have the option to staff dedicated identity and access management (IAM)
teams, and can only dedicate limited or external resources to the operation of IGA infrastructure. IGA
products will therefore need to be easy to deploy and integrate for most midmarket IT departments.
They also need to be maintainable with few resources. For midsize organizations, this often requires
adopting solutions with out-of-the-box features, and avoiding or minimizing customization as much as
possible. This typically requires the adoption of standard IAM identity and entitlement life cycle
processes that are provided by most products. Midsize organizations may find it easier to adopt
processes, but even in that case, remember that IAM is first and foremost a business change initiative
rather than a technical project. This change will require executive sponsorship to bring stakeholders
from other lines of the business on board.
Managing relationships with large and complex vendors is always challenging for midsize organizations,
especially because they do not have the clout or importance in terms of account to gain special
attention from the larger vendor. Unless an established relationship with a large complex vendor
already exists and is working well, midsize organizations should look for smaller, more agile vendors, or
vendors who have a large and effective channel partner network, to find a vendor or reseller that works
well for them.
Cost of the solution is another important consideration. The overall cost of ownership is affected by
many factors, one of them being the license price. Some vendors have high list prices but discount
heavily for larger user counts. These discounts are unobtainable by midsize organizations, making those
vendors less attractive compared to vendors who start with reasonable pricing for smaller deal sizes.
Similar to the license price, composition of the offer is another important factor. Bundled solutions that
include everything (especially all required connectors) for one set price can be attractive because they
eliminate surprise additional costs. On the other hand, some vendors offer rightsized entry-level
bundles that may well fit the IAM requirements and scale of midsize organizations. When the IAM
leader clearly understands the scope of the IGA requirements for the next three years, bundles have
proven to be a good fit for most midsize organizations. If the requirements are likely to change, the
former option may prove to be more attractive.
"Critical Capabilities for Identity Governance and Administration" has a use case for Small or Midsize
Business. The use case uses weightings optimized for small and midsize businesses to rank several
vendors against each other based on technical capabilities.
Many midsize organizations have system architectures that are centered on Active Directory and
Microsoft technologies. These organizations should also map their requirements against offerings by
vendors offering delegated management tools for Active Directory (see "Technology Overview for Active
Directory IAM Tools"). Those delegated management tools are less functional than fully fledged IGA
tools, but they may be just enough if Active Directory is the only, or predominant, target for identity
and access. They are described in a list toward the end of this document.
Notable Vendors
Vendors included in this Magic Quadrant Perspective have customers that are successfully using their
products and services. Selections are based on analyst opinion and references that validate IT provider
claims; however, this is not an exhaustive list or analysis of vendors in this market. Use this
perspective as a resource for evaluations, but explore the market further to gauge the ability of each
vendor to address your unique business problems and technical concerns. Consider this research as
part of your due diligence and in conjunction with discussions with Gartner analysts and other
resources.
20.05.2015 17:50
15 von 18
Avatier is focused on low TCO for its solutions and stands out in usability, spending considerable effort
on making its products easy to use, which is confirmed by customer references. Self-service on PC and
all major mobile platforms is well-integrated and serves to increase efficiency and reduce administration
time for the IT department. The solution is available in multiple modules, allowing organizations to start
small and expand over time. An optional Advanced Connector Package includes more than 100
additional connectors in addition to the Active Directory connector that is included in the base package.
Beta Systems has traditionally been focused more on large accounts, but is making a concerted effort
to make its product appeal to the midmarket. It offers two starter packages, called Fast Forward IAM,
for midsize businesses. They are priced at 120,000 for up to 2,000 users, or 180,000 for up to 4,000
users. The packages include SAM Enterprise, including three standard connectors, SAM Business
Process Workflow and professional services in a fixed-price package that addresses the core needs of
midsize organizations and is focused on a quick return on investment by those clients. This is a new
offering, however, and Gartner does have feedback from midmarket reference customers, but not from
customers who purchased this particular standard package. Beta Systems is strong in Europe and has
grown its presence and market share in North America over the past few years.
Dell has many midmarket customers that have commented on the ease of administration. Its IGA
product comes with many predefined workflows and is highly configurable. Its user interface is intuitive
both for administrators as well as for end users. Dell achieves the highest score of all vendors for the
Small or Midsize Business use case in "Critical Capabilities for Identity Governance and Administration."
Its base version includes out-of-the-box connectors for major directories, databases and Microsoft
technologies. Pricing is among the lowest from all vendors for typical midsize enterprise requirements.
Connectors for ERP systems such as SAP and Oracle E-Business Suite (EBS) are available as an
additional option.
One-third of Evidian's customers are midsize organizations, reflecting a focus on this market with an
integrated solution that is matched to typical requirements for this constituency. The company offers a
quick-start methodology to deploy a simple IAM solution for midsize organizations that allows them to
certify and manage access for a business application. Midmarket customers have commented positively
on the completeness and modularity of the solution. Pricing for midsize configurations is attractive.
Evidian will mostly appeal to European organizations due to a limited presence elsewhere.
Fischer International has a strong standing in the North American midsize enterprise market. Its
solutions are easy to deploy, maintain and configure, and they come with an intuitive user interface for
users and administrators. Pricing is among the lowest from all vendors for typical midsize enterprise
requirements, including all existing connectors. Connectors for target systems that are not yet available
can be developed by the vendor for a fee. Reference customers have consistently lauded the company
for delivering excellent support.
Hitachi ID Systems' IGA solution is available in several different reference builds (preconfigured and
packaged editions) that minimize time to deploy and, therefore, lower TCO. Hitachi ID is tied for second
place for the Small or Midsize Business use case in "Critical Capabilities for Identity Governance and
Administration." The product has modest hardware requirements, and pricing is among the lowest from
all vendors for typical midsize enterprise requirements, and includes all features and connectors. It also
has many unique password management features such as managing preboot passwords that can save
valuable time for the IT department. Hitachi ID has a worldwide network of partners that can deliver
local support for midsize organizations.
iSM Secu-Sys' bi-Cube is an attractive option for midsize organizations in the German-speaking
region, because the company is primarily focused on that market. The product is built on an
understanding of a business-centric role model that fits common business process within that region. A
powerful policy model can automatically assign access rights based on user attributes or other
contextual information, reflecting a focus on mature processes and data quality. Its solution is highly
modularized and has a low entry point in terms of pricing.
Microsoft customers with enterprise agreements can use existing Windows Server Client Access
Licenses (CALs) for their users in order to deploy Forefront Identity Manager (FIM). The product is
popular with many midsize organizations and has a large pool of experienced professionals and
consultants that can deliver integration services. Potential customers should be aware, however, that
Microsoft has not innovated the product for two years, and Microsoft has announced an investment in
IGA-specific capabilities only for subsequent versions (after 2015). FIM will be rebranded to Microsoft
Identity Manager (MIM), and Microsoft Azure Active Directory Premium clients will receive a CAL for
MIM as part of the package.
NetIQ has a sizable number of midmarket clients, and its midmarket reference customers provided
positive feedback about NetIQ's IGA solution. NetIQ scored in the highest third for the Small or Midsize
Business use case in "Critical Capabilities for Identity Governance and Administration." There is a large
pool of experienced independent consultants as well as a large network of channel partners who can
deploy, configure and support NetIQ's solution worldwide. NetIQ Identity Manager is priced attractively
within the lowest quartile of all products in this Magic Quadrant.
OpenIAM offers its open-source Identity Manager as downloadable software, or alternatively as a
physical appliance. For midsize organizations, a typical IGA usage scenario includes provisioning, access
request and governance starting at $25 per user. The company also offers a "jump-start service" for
midsize organizations to be up and running within 30 days.
Delegated Administration Tools for Active Directory
Midsize organizations can also potentially take advantage of Microsoft-centric delegated admin tools
from other providers (see "Technology Overview for Active Directory IAM Tools"). While these tools are
not a full-blown replacement for IGA products, they simplify the management of users, groups, systems
and policies by offering capabilities beyond those of the native Active Directory Users and Computers
(ADUC) utility provided by Microsoft. Some of the more sophisticated delegated administration tools
feature workflow capabilities, self-service interfaces for users, entitlement-centric administration
(allowing groups to be managed by specific individuals) as well as basic governance capabilities by
offering certifications of existing access. Some vendors for Microsoft-centric delegated administration
tools are:
CionSystems (www.cionsystems.com): Active Directory Manager Pro
Dell Software (software.dell.com): ActiveRoles Server and Active Administrator
Imanami (www.imanami.com): GroupID
ManageEngine (www.manageengine.com): ADManager Plus
Namescape: (www.namescape.com): rDirectory
NetIQ (www.netiq.com): NetIQ Directory and Resource Administrator
20.05.2015 17:50
16 von 18
Softerra (www.softerra.com): Adaxes

STEALTHbits (www.stealthbits.com): Access Information Center
Thycotic (www.thycotic.com): Group Management Server
Varonis (www.varonis.com): DataPrivilege
Visual Click Software (www.visualclick.com): DSRAZOR for Windows
Zohno (www.zohno.com): Zohno Tools
These tools are typically licensed on a per-entry or per-user basis. Pricing and capabilities of products
vary significantly, from $3 per user on the low end to $40 per user on the high end, where they are at
par in terms of pricing with many IGA tools.
Healthcare Providers Context

10 March 2015
Analyst(s): Brian Iverson, Felix Gaehtgens, Steve Krapes
The healthcare industry has unique regulatory, identity life cycle and integration requirements for IGA
products due to the nature of their information systems, data, personnel and workflows. IAM leaders
should evaluate vendors' IGA offerings for how well they fit within these unique environments.
Market Differentiators
The healthcare vertical has been a late adopter of identity governance and administration (IGA)
technologies, especially on the provider side, with good reason: The vast majority of healthcare
providers have been relatively independent hospitals and clinic networks with eclectic IT environments
and fluid workforces, which has made integrating IGA products challenging. In addition, IGA products
are expensive, and healthcare providers usually have had limited IT budgets.
Worldwide, healthcare is highly regulated, and occasionally, the provision of and payment for
healthcare services are under government control. The increasing regulation over sharing and
disclosure of personal health information for patients is a unique requirement for the healthcare
industry, which adds to the regulatory burdens that healthcare may share with other industries in
various countries. Fear of PHI disclosures and theft, as well as the possibility of hefty fines, has driven
much of the recent uptick in interest in IGA products.
Modern trends in medical practice management have driven a transition to electronic health records
(EHRs), which are often managed by complex applications from vendors like Allscripts, Cerner, Epic,
McKesson and Meditech. Healthcare providers also make use of computerized physician order entry
(CPOE) systems, radiology, pharmacy and laboratory systems. Many other clinical applications used by
healthcare providers are legacy systems or self-contained products that were not designed with the
concept of automated account administration in mind, so integration for provisioning is challenging at
best and impractical in many cases. Support for these types of applications in the form of connectors or
integration frameworks is a significant requirement for healthcare providers.
Applications intended for use in clinical situations are often delivered through server-based computing
using remote or virtual desktop technologies. Multiple personnel need to use the same machines
continually, and there is a desire for context (open patient records or images) to follow users like
doctors or nurses as they move from room to room. This has driven broad adoption of enterprise single
sign-on (ESSO) products from vendors like Caradigm, Evidian, HealthCast, IBM, Imprivata and Oracle
that can support Clinical Context Object Workgroup (CCOW) standards for user-interface context
integration among multiple applications in clinical environments. ESSO integration is usually a
requirement for IGA solutions targeting healthcare providers.
The fluid nature of the workforce in many healthcare provider organizations presents complications for
the identity life cycle capabilities provided by many IGA products. Doctors, nurses, technicians and
other specialists are often contracted individually or through specialty vendors. Many healthcare
systems are associated with medical schools, which means that students and faculty need to be
considered. In addition, staff may occasionally float among multiple facilities and responsibilities that
may require access to different information systems, which can present challenges for role and policy
management.
Considerations for Technology and Service Selection

When selecting IGA vendors for deployment in the healthcare industry, look for and analyze these
features from products or services to meet your needs:
1. Adequate identity life cycle capabilities that could adapt to the institution's approach to personnel
management. Some organizations will have multiple HR systems, and most will have multiple
types of relationships with specialty vendors for contract medical personnel.
2. Demonstrable support for the multitude of home country regulatory obligations faced by the
organization.
3. Availability of connectors, either native or third-party, for the EHR and financial management
systems in use or planned for deployment throughout the institution.
4. Integration with ESSO solutions that may be in use by the institution. An IGA product or service
usually will provision directly to an ESSO solution or provision to the directory used by the ESSO
solution.
5. Flexible options (such as integration with service desk ticketing systems or even "screen
scraping") for integrating with clinical systems that do not offer easy support for remote account
management.
6. Scalability. Some products are optimized for use by large organizations where there are many
users and applications with geographically distributed account repositories. Others are targeted
at midsize, community healthcare providers, where the number of users and complexity of
systems may be more modest.
Notable Vendors
Vendors included in this Magic Quadrant Perspective have customers that are successfully using their
products and services. Selections are based on analyst opinion and references that validate IT provider
claims; however, this is not an exhaustive list or analysis of vendors in this market. Use this
perspective as a resource for evaluations, but explore the market further to gauge the ability of each
20.05.2015 17:50
17 von 18
vendor to address your unique business problems and technical concerns. Consider this research as
part of your due diligence and in conjunction with discussions with Gartner analysts and other
resources.
The vendors reviewed here were selected for inclusion in this contextualization because they
demonstrate two or more of the following characteristics:
The healthcare industry is their largest targeted vertical market or accounts for a significant
percentage of their total revenue. All vendors included earned at least 10% of their past-year
revenue from healthcare customers.
They provide packaged connectors and content for EHR systems and other clinical applications.
They have IGA-specific marketing that is focused on the healthcare industry.
Avatier
Healthcare represents the second largest industry segment (after manufacturing) for Avatier, with a
focus on the U.S. market. Avatier's simplified setup and administration for IGA and a consolidated
approach to service desk, account administration, provisioning and password management are
attractive to healthcare providers with lean operations and tight project deadlines.
Caradigm
Caradigm, a U.S. company based in Bellevue, Washington, was formed as a joint venture between GE
Healthcare and Microsoft in 2012. Caradigm's entrant in the IGA market is Caradigm Provisioning,
which is packaged as a complete solution aimed exclusively at healthcare providers to address privacy
and security regulations, like Health Insurance Portability and Accountability Act (HIPAA) in the U.S.
Caradigm Provisioning is a key component of the vendor's identity and access management portfolio of
products, including offerings for SSO and context management. A key distinguishing feature is its ability
to provide detailed and product-specific role-based provisioning for EHR software such as Epic.
Courion
Courion derives more of its revenue from healthcare than from any other industry, with a focus on the
U.S. market. Their strength in the healthcare market has been driven by its focus on delivering
reporting and compliance features specific for HIPAA/Health Information Technology for Economic and
Clinical Health (HITECH) regulations. Courion has also developed numerous connectors for a broad
range of clinical applications as well as multiple connectors for ESSO integration. It is also capable of
integrating with health provider licensing systems to disable accounts (after providing warnings) when a
caregiver's license has expired to ensure that physicians and nurses renew their licenses.
EMC (RSA)
Healthcare is the second-largest industry sector (after financial services) for the RSA Identity
Management and Governance (IMG) product. Increasing regulations worldwide have allowed RSA to
bridge IMG's governance and compliance strengths with its Archer GRC offering to extend rich coverage
over regulations like HIPAA. RSA has also utilized the Health Level 7 (HL7) standard to develop more
connectors for clinical applications, and recently developed its own connector for Epic using HL7 and
Web services.
Evidian
Evidian derives more of its revenue from healthcare than from any other industry, with a focus on the
unique needs of European markets. Evidian's Health package, consisting of the company's Identity &
Access Management (I&AM), Enterprise SSO and Web SSO products, has allowed it to address
confidentiality regulations and requirements for strong authentication that have been significant drivers
for healthcare providers in Europe. Evidian's purchase by Atos is expected to expand its sales presence
beyond the markets where it has already demonstrated success.
NetIQ
NetIQ has an extensive partner network that it leverages when approaching specific industries. In the
healthcare market, NetIQ's partners have assembled offerings composed of multiple NetIQ products
that are intended to satisfy the specific needs of healthcare providers. Identity Manager is offered as
part of IAM solutions that also include NetIQ's Access Manager (Web access management [WAM]) and
SecureLogin (ESSO) products to assist healthcare personnel get access to patient data from different
locations with various devices like desktop machines in examination rooms, laptops, tablets and
smartphones. Identity Manager ties the solution together by providing for identity life cycle needs,
password synchronization, and provisioning and deprovisioning of access in clinical systems.
Oracle
Oracle Identity and Access Management Suite Plus has been positioned as the key security element of
Oracle's approach to the healthcare industry. One advantage that Oracle has had in the healthcare
industry has been the integration of Oracle Identity Governance (OIG), with Oracle Enterprise Single
Sign-On Plus. Combined with Oracle Access Manager for WAM and Oracle's directory products, Oracle
solutions can cover the full range of IAM needs for healthcare providers. Both Oracle Identity Manager
(OIM) and Oracle Identity Analytics (OIA) have been used by healthcare providers, either together or
individually, to provide automation and access governance for management of clinical applications.
SailPoint
Healthcare has seen an increasing presence in SailPoint's industry coverage because healthcare has
seen an escalation in regulatory obligations in recent years. This expansion into healthcare has been
facilitated by superior support of SailPoint's IdentityIQ for governance and compliance needs of
organizations in heavily regulated industries. SailPoint has solidified its position in the healthcare
market through persona support and specialty connectors for clinical applications.
Saviynt
Saviynt, a U.S. company based in California, is one of the rare vendors that approaches IGA and
segregation of duties (SOD) controls monitoring with a common suite of products. Whereas most SOD
controls monitoring vendors tend to focus exclusively on financial applications, Saviynt has expanded its
coverage to include healthcare applications providing content for identifying SOD violations and
sensitive access for leading clinical applications. Saviynt has strong support for Epic, with the ability to
perform role engineering (along with role transport), emergency access (with activity review),
20.05.2015 17:50
18 von 18
compliant provisioning and access certification. It also sells a stand-alone Epic connector that can be
used with other vendors' IGA products.
2015 Gartner, Inc. and/or its affiliates. All rights reserved. Gartner is a registered trademark of Gartner, Inc. or its affiliates. This publication may not be reproduced
or distributed in any form without Gartners prior written permission. If you are authorized to access this publication, your use of it is subject to the Usage Guidelines for
Gartner Services posted on gartner.com. The information contained in this publication has been obtained from sources believed to be reliable. Gartner disclaims all
warranties as to the accuracy, completeness or adequacy of such information and shall have no liability for errors, omissions or inadequacies in such information. This
publication consists of the opinions of Gartners research organization and should not be construed as statements of fact. The opinions expressed herein are subject to
change without notice. Although Gartner research may include a discussion of related legal issues, Gartner does not provide legal advice or services and its research
should not be construed or used as such. Gartner is a public company, and its shareholders may include firms and funds that have financial interests in entities covered
in Gartner research. Gartners Board of Directors may include senior managers of these firms or funds. Gartner research is produced independently by its research
organization without input or influence from these firms, funds or their managers. For further information on the independence and integrity of Gartner research, see
Guiding Principles on Independence and Objectivity.
About Gartner | Careers | Newsroom | Policies | Site Index | IT Glossary | Contact Gartner
20.05.2015 17:50

Magic Quadrant For Identity Governance and Administration

Uploaded by

Copyright:

Available Formats

Magic Quadrant For Identity Governance and Administration

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Magic Quadrant For Identity Governance and Administration

Uploaded by

Copyright:

Available Formats

Magic Quadrant for Identity Governance and Administration