Our Budget

As with everyone, Stuff4U's budget is limited this year. The solutions for our scenario ranged from $175,000 to $600,000--expensive even at the low end, and without including professional services costs--so we were forced to consider which vendor would provide the best functionality and highest return on investment. Self-service and automation features carry the most and quickest returns, so our calculations focused on those features.

Employee Provisioning Vendors at a Glance Click here to enlarge

Because of Stuff4U's high turnover rate and the large number of nontechnical employees logging a high volume of password-related helpdesk calls, we calculated a potential 30 percent reduction in expenses in these areas with the automation of the provisioning process and reduction in helpdesk calls.

While Novell's solution was the least expensive to implement ($175,000 for our PeopleSoft, Novell 5, Windows NT 4.0 and Lotus Domino systems), only its automation features would provide us with any return because the product lacks integrated self-service management. Without that component, Stuff4U would need almost two years to get a return on investment. Meanwhile, Access360's enRole can address Stuff4U's helpdesk issues with self-service support, so at five times the cost of Novell's product ($600,000), it would take about 30 months to realize a full ROI. Both Business Layers' eProvision and Waveset's Lighthouse were more affordable initially, with implementations taking 20 and 26 months, respectively, to realize ROI. (For more on our ROI calculations, see our ROI Chart).

Workflow Integration

Being able to provision an employee in less than a day is almost as important as the requirement that an employee be deprovisioned quickly and completely. Each of the products in our review can receive a feed from an HR system (such as PeopleSoft) and act upon the information received. When a new employee's data is entered into the HR system, it is fed into the product and the provisioning process begins. Changes to an employee's status are also picked up and applied throughout that person's career with the company.

Workflow and approvals are part of that process. While basic access across the enterprise may be provisioned automatically, administrators may still want control over some other systems. Or, while you may want the provisioning solution to manage the process, you may still want account creation and modification to remain manual. We desired flexibility in this area; some systems required approval from the system administrator, while others were provisioned without any intervention.

Stuff4U also needed to deal with situations in which the primary approver of a resource may be unavailable. We wanted to be able to escalate an approval that wasn't received in a specified period of time--a capability often found in network-management systems. We were pleased by enRole's ability to define team-based approvals and escalation support. This feature is especially helpful where a team of employees provides approval or authorization of resources. Waveset's Lighthouse also offered compelling support for this procedure but required us to define a specific role or employee for escalation and approval.

The tools available within enRole, Lighthouse and eProvision for defining the workflow process impressed us. All three products are Web-based and offer a robust, graphical method of capturing the business process and provisioning policies. A nontechnical business manager could use any of these solutions to define the process easily. Novell's Identity Provisioning for Employees is more flexible than the others, but nontechnical employees will have difficulty using it. To solve this shortcoming, Novell says it is developing a graphical way to construct rules.

Before meeting with the vendors, we were concerned that Stuff4U would have to change its provisioning practices and policies. All the responses indicated that this would not be necessary; the products can handle both role- and rule-based provisioning policies. In later discussions, Novell said that though Stuff4U wouldn't need to change processes in the first phase of implementation, it may become necessary as custom and legacy applications are integrated with the system. Our instincts told us this might be true across the board, but only Novell admitted this might be the case. If we had a "straight-talking vendor award," Novell would win it hands down.