2,500 applications onboarded to SailPoint IdentityIQ

Identity Governance

38 use cases designed for a central IAM in public administration, on two coupled platforms.

IAM Migration

Legacy customer IAM replaced by Keycloak after more than 20 years. 65,000 customer accounts, no production outage.

Application Onboarding

Around 2,500 applications onboarded to SailPoint IdentityIQ, with a fixed process and a security test before every release.

Privileged Access Management

Privileged access secured, documented in a traceable way and governed in line with compliance requirements.

Long onboarding times

Onboarding a single application took weeks to months.

Manual onboarding

20 applications were connected to SailPoint IdentityIQ only manually.

No security testing

Applications went live without any check of access controls and endpoints.

Load on business teams

Application owners were not to be tied up on top of their daily work.

Regulatory pressure

At the time, the BAIT required traceable control of all access.

Large estate

Around 2,500 applications in the CMDB, spread across many business units.

Our solution

Our approach

Inventory and classification

We recorded the applications and classified them by effort into four classes from S to XL. The class depends on the complexity of the connector and is the basis of the project plan.

First wave as proof of concept

In the first wave we moved 20 manually connected applications to automated onboarding and tested the approach on them. We used connectors for AD/LDAP, SCIM 2.0, JDBC, REST, Oracle, RACF, SAP and Salesforce.

A lean process

Every onboarding runs through the WertFels Application Onboarding Engine, our three-phase process: design, deploy and go-live. The steps are fixed per effort class. Application owners only provide what cannot be done without them.

Security test before every release

In addition to the functional test, we introduced a dedicated security test. It checks access controls and how the endpoints are secured. Only then is an application released.

Scaling to the entire estate

Word of the results spread and more business units wanted to be onboarded. This led to the project plan for the entire CMDB estate. By 2023, around 2,500 applications had been onboarded to SailPoint IdentityIQ.

The results

Results 2020 to 2023

100%

Security test

before every onboarding is released

2,500

Applications

onboarded to SailPoint IdentityIQ

Connector types

from AD/LDAP to Salesforce

100%

Automated

all 20 applications of the first wave

100%

Fixed process

per effort class

11 months

M10

M11

First phase

420 applications in eleven months, around 2,500 by 2023

More case studies

Privileged Access Management

3,200 privileged accounts secured in 6 months

Privileged access management for a German financial services group, with 100% PAM coverage of all privileged accounts.

View case study

Identity Governance

38 use cases designed for a central IAM in public administration

Two integrated platforms, Garancy for identities and DirX for accounts and roles, plus 38 use cases and a six-stage release plan.

View case study

IAM Migration

Legacy customer IAM replaced by Keycloak after more than 20 years

65,000 customer accounts and more than 60 applications moved from an in-house system to Keycloak, without a production outage.

View case study

Application Onboarding