Late last year, I wrote a paper on the challenges facing enterprise IT when they consider SaaS/S+S consumption. The full paper has now been published in The Architect Journal and is online at MSDN.

I summarise my points below, go take a look at the full paper to see why I draw these conclusions;

Consuming an external service reduces the operations issues you will face but introduces new challenges such as integration, contractual negotiation and reduced flexibility.

Impact ripples beyond IT: users are often given another set of credntials to access the service resulting in more complex provisioning/de-provisioning processes, the need to update helpdesk procedures. You also have to manage user training

You may be facing an EAI project: does the data to be held in the service need to be used by internal applications? Does the service provide the ETL capabilities your users need?

There may be infrastructure implications: do firewall rules need to be changed, are there certificate implications (e.g. smart-card authentication)

Operations will be impacted: as a minimum, you need to give your helpdesk team the new application escalation details however most organisations will need to perform some troubleshooting on access issues (e.g. is company firewall causing the problem, is it some change they've made to the client/browser etc) before a problem is escalated to the service provider.

There may need to be some deployment: even if the application is accessed through a browser, there are will be a minimum version required. It may be neeccessary to add the application domain to the Trusted Sites list, or deploy a JVM/ActiveX control which your users do not have rights to do.

Evaluate the legal implications: if your business is regulated, you need to work out if any regulations affect the data or service, and if so, how do you prove compliance? If you're not regulated, you still need to consider national laws e.g. data privacy.

In conclusion:

• Consumption of an external service by an Enterprise has implications beyond "selection and subscription". As an absolute minimum the contract and any SLAs need to be evaluated, more likely you're facing some form of integration project.
• SaaS/S+S as a delivery model is not yet mature enough to have a good enterprise integration story. Many SaaS/S+S apps are aimed at consumers or small businesses who have no integration requirements. Vertical soluitons fare much better but most still have a long way to go.
• The more important the application to the business, the more integration and due diligence is needed. The converse is also true.

This is just a summary, I encourage you to read the whole thing. Enjoy the read.

Kevin