Describes the common failure of upfront planning required to study employee and contractor roles to map to appropriate applications. Secondarily, exposes the most recent lack of Active Directory optimization for unstructured data.

1. 1. Failure in Upfront Planning before buying the Software
Organizations have a very difficult time with the very basic task of figuring
out precise job roles and then being able to associate those roles with
appropriate levels of access to resources.
It's can be a challenge to convince executives that it's necessary to invest
properly in identity, not so much in the tools as in the effort it will take to
gain a full understanding of how workers operate and then build the IT
processes to reflect that reality.
Management needs to fund the upfront work required to study employee
and contractor roles and to map that to the appropriate applications.
Often when projects fail, organizations get a few months into these
implementations, and 90 percent of the team's efforts focus on educating
the business leaders, managers and data owners that it's the data owners,
not the group managers that approve access.
You not only need to have executive sponsorship, because your effort is
futile without it, but also eager buy-in across multiple business units. If you
don't have all of that support in place, you are going to have a large
number of potentially insurmountable challenges. The cascade of
problems generated reduces productivity and adds to cost.
Costs can include everything from workers not getting access to the
applications they need; to end users deciding to share credentials so they
can get work done; to increased difficulty responding to valid audit
requests.

2. 2. Failure to Optimize Active Directory for Unstructured Data
Protection
When did Active Directory optimization ever get included as a business
priority? AD is the natural choice for Identity & Access management to
work with since it’s the authentication and authorization source for at
least 80% of organizational data.
If a company has been through mergers and acquisitions,
reorganization, and has layers of IT infrastructure; then they are likely
to have a big cross-wired mess at the heart of Active Directory.
Now, combine the lack of optimization with the push to include
unstructured data in IAM projects. This becomes a recipe for failure.
The fact that unstructured data is so clearly and directly connected to
the inner structure of AD exposes the lack of optimization.
There is no clear way that access is granted to unstructured data
resources. Many groups grant similar types of rights to the same
resources. And since many of those groups have been formed by
redundant and overlapping needs, many of the same sets of users exist
as members of those groups.
Let’s say someone runs a review and wants to take away some right to
access a file share. How should that be done? If you take the user out of
the group granting the access, it’s likely you’ve effectively removed the
access of all the members of that group.
Unlike applications that may have used AD as an authentication source
or perhaps used a few groups they created specially to control
authorization, unstructured data links directly to AD groups for access
and relies completely on AD credentials for identity. That means every

3. deeply or circularly nested group, every redundant group, every person
with multiple accounts or overlapping group membership, are all things
that become immediate issues for controlling the identification of
access and controlling that access.
Provisioning, self-service, and other key IAM pieces will work with an
un-optimized AD, however, managing unstructured data access with
un-optimized AD may lead to failure or the very least increased cost
and complexity.