Can Identity Services be Provided Via SaaS?

There has been a tremendous amount of chatter and yes even some hype regarding the need and potential for providing identity and access management (IAM) related services to organizations via SaaS delivery.

There has been a tremendous amount of chatter and yes even some hype regarding the need and potential for providing identity and access management (IAM) related services to organizations via SaaS delivery.  To me the hype here is getting quite out of control and is in great need of more realism, which I aim to provide here. 

I have a lot more to say on this topic then I can possibly fit into a single blog.  But, I am hardly the only person out there saying “hold on there a moment” regarding this topic.  I recently read a great presentation given by Robert DeSisto of Gartner entitled “Software as a Service:  Uncertainties Revealed” which had a lot of salient points.  Also Ian Yip has some good blogs on the topic as well.

 The summary of my position is that there is no magic when it comes to identity services.  If you hear an argument that goes something like this – “Organizations have complex and expensive identity and access management processes that are expensive and difficult to resolve with on-premises IAM software.  If they placed these processes into the hands of an identity SaaS provider, costs go way down, security is improved, and compliance is made easier” – be wary.  This massively understates the issue.

Why is reality more complicated?

  • There is a huge difference between IT applications and IT infrastructure. Narrowly focused applications that are delivered via Web front-ends are great candidates for SaaS delivery as integration back into the enterprise tends to be more manageable. But IT infrastructure or middleware services, such as IAM, are a very different story. Infrastructure by its very definition must be appropriately integrated into the enterprise premises and processes. Moving that infrastructure off-premise makes the integration problem harder, not easier.

  • IT organizations will be hybrid, using a mix of on-and off-premise applications, for as far as the “eye can see”. I blogged on the hybrid issue previously. This hybrid issue greatly affects the potential for identity services, as on-premise applications cannot have their IAM activities ignored in favor of identities in the cloud. Enterprises must be able to handle both effectively. In my opinion managing identities in SaaS-based applications via on-premise identity software is much easier than the converse.

  • You can outsource services, but you cannot outsource compliance responsibilities. You think it is painful complying with audits with on-premise software, imagine doing the same thing with off-premise software.

  • IAM deployments are complex because IT systems and processes in essentially all organizations are complex. Organizations cannot outsource their “spaghetti” and expect better results. In fact, I argue that IT services can’t effectively be outsourced until they have been internally outsourced (abstracted) first. Identity services and IAM systems are a great example of this.

  • Vendor viability is an even bigger issue with SaaS-provided services than it is with on-premise software. If a traditional software vendor goes belly-up, at least the software keeps running and the customer can make transition plans. When a SaaS provider goes under things could move much faster – as in here today -gone tomorrow.

  • Trust – Security is largely about creating and enforcing trust. It you outsource your security systems and practices you must trust your SaaS provider as much or more than you trust your own organization.

I could continue with this list, but I will stop to clarify one thing:   I am not saying that there is no aspect of identity management that can be outsourced or “Saas-ified.”  There is definitely an opportunity for certain aspects of IAM to be provided by third-parties such as identity proofing, identity provider for hire, real-time risk assessments, and others.  And perhaps even broader IAM services can be provided to small organizations of maybe 500 to 1000 employees or less that already have a high percentage of applications provided via SaaS delivery.  But a move to SaaS-based Identity Services certainly won’t happen quickly with all the hurdles and issues that need resolved by a company offering to provide them.

Written by

Matthew Gardiner

Published in

View this topic
  • James Holland

    This is great. Hooray for Disney’s imagineers!


    become a new brand in the share market research with its accurate research. Proven
    itself always right whether market is bull or bear. Last week all paid clients
    booked handsome profit in NIFTY, BANKINIFTY & STOCKS. Now for the coming
    week we expect more correction can come in NIFTY as the IRAQ issue is getting
    more tense, If it happens more then you will see a sharp fall in all world marketNSE BSE, STOCK TIPSbecause as we know all world run on
    crude & most of the crude comes from IRAQ. So be ready for a sharp fall so
    sell will be the best strategy for next week also. Traders can make a sell
    position in NIFTY around 7600-7650 with stoploss 7750 for the target of
    7300-7200.One can also make a sell call NIFTY 50 stocks as per NIFTY levels. You
    can also take our two days free trial to check our accuracy. For further updates
    you can visit our website.



  • king lear

    testing comment functionality, please do not publish this

  • Rachel Macik

    Love the personal pic :)

    • CAHighlight

      Thank you!

  • Plutora Inc

    This is a good case study. 2.3 sec’s off a login transaction is big.

  • Michele Hudnall

    While the analysts were hyping DevOps, I posted the oversight of not including security as part of that discussion as you are highlighting here. Instead of just talking DevOps, it should be DOS (what’s old is new again :-) – DevOpsSec. As a previous AppDev person, it’s the app, who’s using it, why and where rather than the device and having the service available.

    As you rightly point, out Security should be baked into the solution.

    Nice Post and Timely!


    • CAHighlight

      Thank you for your feedback Michele. Agreed – security cannot be overlooked. Appreciate your input!

  • Mitesh

    I would love a printed copy

  • Lars Johansson

    I love the idea of BYOID! This makes me choose if I am almost anonymous (with my Hotmail Nicname) or official with identity from an official organisation. My Identity Provider will attach identity with right level of LoA according to the need of the Service provider.

    • CAHighlight

      Thank you for your comment. BYOID has tangible benefits for end users and relying parties but it also has to be weighed in the balance with potential risks and liability concerns. It will be interesting to see how BYOID plays out in the enterprise.