Microsoft TechNet Ireland Blog : Article

Microsoft’s Identity Life Cycle Management Story - Part 1: Microsoft's philosophy and vision

endaf — Fri, 15 May 2009 16:43:00 GMT

Many of you may be aware that Microsoft has been a player in the Identity Management space for many years. Starting off with Microsoft Metadirectory Services, then moving on to the release of Microsoft Identity Integration Server 2003 and our current offering Identity Lifecycle Manager 2007.

What you may not be aware of is that Microsoft is about to revolutionize Identity Management with the release of Forefront Identity Manager (previously known as ILM “2”) in the first half of 2010. The marketing strap line for ILM “2” is that “Identity Management is about to get a whole lot easier” and having worked with ILM “2” (currently available as a Release Candidate) I’m very excited about this product and what it can do for both IT Pros and businesses.

So, for those of you who may not be familiar with Microsoft’s Identity management story I’m going to start with Microsoft's philosophy on Identity Lifecycle Management (ILM). Future articles will look at where we are today in terms of ILM 2007 and where we will be going to, with the much anticipated release of ILM "2". So let’s look at Microsoft's philosophy for ILM.

Microsoft’s Identity Management Strategy

Basically Microsoft's position on ILM comes down to the concept of a People Ready business. Identity and access is at the centre of the People Ready business:

To enable the people in your organisation to be successful, they need an efficient and intuitive way to collaborate. At the same time, the business needs to ensure that collaboration is taking place within the bounds of internal and external regulations, business policy and process, and security. At the centre of it all, is the identity and access infrastructure and tools that provides information on users, devices, they access, what credentials they need and how they are configured, and the rules or policies governing the behaviour of these objects. In order to realize the vision of a People Ready business, the identity and access infrastructure and tools need to provide people with the right collaboration experience, in a way that complies with business process.

How do we ensure that our identity and access infrastructure and tools are enabling this People Ready vision? By overcoming a number of challenges, such as....

1. Improving Operational Efficiency

On average employees need access to 16 applications and systems
Companies spend €25-30 per user per year for password resets

2. Reducing Security Risks

38% of users recycle old passwords, 18% write them down

3. Meeting Regulation Requirements

Implementing business process and policies to meet internal regulations

4. Enabling Business Objectives

Improving connections with partners and customers
Driving business decisions closer to decision-makers

Today, the management burden is on IT

Today, we know that the burden of addressing these challenges is on IT. When you think about what identity management tasks IT today, they include a number of things that IT should be doing – such as deploying software, administering systems, ensuring systems under their control are secure and compliant. But often IT is also burdened with additional repetitive tasks such as managing end user requests such as password resets, creating and deleting user accounts in all the systems the end users need to do their jobs, and manually implementing, reporting on, and enforcing policies across these systems.

Meanwhile, end users are in a position where they are relying on IT for their requests. Wouldn’t it make more sense for users to have the tools to do some of this work themselves and remove the burden from IT as well as themselves?

Today identity and access management tasks are often being done by the wrong people, who are struggling with the complexity of existing systems and tools. In the end this means higher cost for the business:

Microsoft's Vision

Microsoft has a vision for putting the identity lifecycle back into balance by aligning experiences with the right people.

IT professionals should be focused on what they do best – architecture, deployment, administration, governance, and security

Information workers should have familiar tools to manage their own information, credentials, access, and resources they own. Information workers should have tools within the applications and systems they use every day.

Microsoft’s vision for this space is to provide an identity lifecycle management solution that spans across a breadth of Windows and non-Windows infrastructure, and delivers management of users, access, credentials, and policy from a single, integrated solution that is easy to configure and customize if needed:

Changing the Equation

Research from IDC, Gartner, and Microsoft shows that identity and access management software is only about 10% of the total amount that organisations spend. The rest of the identity and access management budget is spent on IT staff performing manual, repetitive tasks such as password reset and manual user provisioning and deprovisioning. What Microsoft wants to do is decrease the total amount your organisation spends on identity and access and enables IT staff to do work that is more strategic for the business. The result of this decreased spend is:

- Less spending on specialized infrastructure and tools to manage the complexity

- Higher end-user productivity from users who have the right tools at their fingertips

- IT staff focused more on business enablement than end user account, access, and credential related requests

- Lower spending on services since systems integration costs dramatically decrease

IDC recently completed a study comparing enterprise customers cost structures with these solutions in place. IDC found that customers can save

-€30 per PC per year with an automated user provisioning solution

-€70 per PC per year with a directory synchronization, password synchronization, and self-password reset solution

Roadmap for getting there

Today we have a product in market called Microsoft Identity Lifecycle Manager (ILM) 2007, a solution that provides metadirectory and user provisioning capabilities and capabilities for managing strong credentials, providing an integrated approach that pulls together metadirectory, digital certificate and password management, and user provisioning across Windows and other enterprise systems.

In the 1st half of 2010, Microsoft plans to deliver Identity Lifecycle Manager ”2”, a comprehensive solution for managing user accounts, access via groups and roles, password and certificate-based credentials, and policies across Windows and heterogeneous environments. ILM “2” will extend the functionality of ILM 2007 with new capabilities that will (1) empower end users with integrated self-service tools in Office and Windows; (2) put IT in control through a robust delegation model and business process framework, and (3) increase operational efficiency by automating common identity lifecycle management tasks and empowering end users with self-help solutions. In addition, Microsoft is implementing ILM “2” on a common set of services – including workflow, delegation, web services APIs – that customers and independent software vendors can use to customize and extend the functionality in ILM “2”.

So, there you have it. In the next article I'll have a look at ILM 2007, our current product which has been successfully deployed to many customers in Ireland. In the meantime you can find out more about ILM at the following links:

http://technet.microsoft.com/en-gb/ilm/default.aspx

http://www.microsoft.com/windowsserver/ilm2/default.mspx

Stay tuned for the next instalment!

James McAlonan, Senior Infrastructure Consultant, Microsoft Consulting Services

Good Article on Windows 7 and Azure @ PDC

ieitpro — Tue, 18 Nov 2008 11:26:00 GMT

John Collins wrote a good piece on some of the major announcements coming out of the Partner Developer Conference in LA last month, http://www.irishtimes.com/newspaper/innovation/2008/1103/1225321600281.html. The article focuses on Windows 7, Windows Azure, 'Software plus Services', as well as Ray Ozzie - Microsoft's Chief Software Architect.

Collaboration Feature Article: Transitioning from File Shares to SharePoint

ieitpro — Thu, 30 Oct 2008 01:32:00 GMT

While currently most files are designed to be stored on standard file systems, the move to a web based system – SharePoint – is happening because of the added benefits for users. These include check-in/out, workflow, auditing and records management. SharePoint can perform the same functions as a file share: there is item level security, and a recycle bin, and SharePoint Explorer view can be used to perform file share like actions. SharePoint Explorer's interface contains many of the same characteristics and functionality as Windows Explorer. These are still however many types of file not designed for storage in SharePoint. The standard kinds of documents to put into SharePoint are MS Office documents, but also PDFs and ZIP files. For SharePoint to crawl the content of these, additional ifilters must be installed and configured.

Other Considerations

Offline access is also a consideration. Tools like Outlook 2007 and Groove can be used to sync with SharePoint, but this is not as simple as using the local hard drive on a laptop. File Shares are also easier to replicate and backup. SharePoint is a complex mix of IIS, file shares and SQL Server data. SharePoint does not always integrate with some 3rd Party applications either. It is difficult to copy attachments to and from Lotus Notes clients for example. Lots of applications can see UNC paths but not HTTP. SQL Storage is also more expensive than file storage, so must be definite productivity benefit in moving to SharePoint and a clear ROI.

Using SharePoint requires training. Most users know how to upload a file to a share, and use Save As... and Open. But SharePoint is not as simple. There is an additional cost involved here, as well as the time taken to transition and train users with the new system. There is also training users how to move content around within SharePoint and how to navigate the system, as well as use new functionality like versioning and Check-in/out.

Linked Files and Documents
Linked documents and files cannot be run from a SharePoint site, as the dependency on an external sources isn’t captured in SharePoint. For example, the URL references created in a linked Excel file when it is uploaded to a SharePoint site are not translated by Excel, and the links will not work. The creator of an AutoCad file would be responsible for ensuring the file was either not linked to other files or are consistently created in the appropriate file format (*.dwf). In all situations, SharePoint is unable to resolve embedded links in documents/files.

Database, Configuration, and Log Files
In order to properly use database files, configuration files and log files, they need to be open and in a locked (writable) state. For example, in a normal file server scenario, shared MS Access databases need have several instances of the database open and locked to allow for users to update it. Similarly, log files and configuration files must be locked and in a writable state. Outlook *.pst files are designed to be used locally, as they have a one to one relationship with the *.pst file owner. SharePoint is not designed to manage locked files (.llck) and therefore it would not be a best use of the platform to run these types of files from a SharePoint site. They can, however, be stored in SharePoint, but would need to be downloaded to the local machine to work effectively. Common examples include: Access database files, Windows configuration files, application log files, Outlook personal stores and archive stores (.pst) and offline stores (.ost).

Large files

Large Audio/Video and Streaming Media and other large archive read only media such as DVDs, CDs storage (.iso, .wmv, .ram, .vhd) are too big and costly to store and share via SharePoint. Linking to these from SharePoint is the best option.

Application Developer Resources (i.e. Visual Studio)

Visual Studio and similar application development suites are designed so that developers can build applications and deploy them to others. This application work is often broken up into project files during development, with the goal of compiling the project files into a final executable file.

While the project files can be uploaded to SharePoint to be shared with other developers, the best practice is to use a file compression utility (i.e. WinZip) to collect and upload the *.zip file to SharePoint.

Source Control

While SharePoint is an excellent document control/document versioning tool, it is not designed to be replacement for a Source Code Control solution like to Visual Source Safe.

Application Distribution: Batch, Command Scripts, Executables (.exe, .vbs, .cmd, .bat)
SharePoint is not designed to be a host for Product or Application distribution similar to the functionality provided in Microsoft Systems Management Server (SMS), or as a replacement for a network server that is used to distribute application packages. The recommended application here would be to create a SharePoint site and provide hyperlinks to the server location where the application packages are stored.

Conclusion

Simply for storage, file servers are a better option, but for standard user generated content, SharePoint adds additional functionality that will make most users jobs easier. There will continue to be a need for some file storage however in most organizations.

Stephen Cummins, SharePoint MVP, runs the popular SharePoint blog www.spsfaq.com. He is a Microsoft Technologies Consultant who has specialised in SharePoint for the past seven years. He has managed in excess of thirty SharePoint Implementations to clients including: The Disney Corporation, Hewlett-Packard, Deloitte & Touche, Kraft Foods International, McAfee, BP, The International Criminal Court, European Patent Office and Intel.

Stephen is going to be heading up the Irish SharePoint User Group, which is due to launch in the second half of November. See http://www.sugie.org/ for details of the inaugural meeting!