What is identity orchestration?

In the age of digital transformation, organizations are adopting more software-as-a-service (SaaS) solutions, shifting to hybrid multicloud environments and embracing remote work. Today's corporate IT ecosystems contain a multivendor mix of cloud-based and on-premises apps and assets serving various users, from employees and contractors to partners and customers.

According to one report, the average business department uses 87 different SaaS apps.^.1 These apps often have their own identity systems, which might not readily integrate with one another. As a result, many organizations deal with fragmented identity landscapes and awkward user experiences.

For example, an employee might have separate accounts for the company’s ticket management system and customer relationship management (CRM) portal. This can make a simple task, like resolving customer service tickets, difficult. The user must juggle different digital identities to get ticket details from one system and pertinent customer records to another.

Meanwhile, IT and cybersecurity teams struggle to track user activity and enforce consistent access control policies throughout the network. In the previous example, the employee can end up with more privileges than they need in the project management system, while their CRM permissions are too low to access the records of the customers they’re serving.

Identity orchestration software helps streamline identity and access management by organizing distinct identity and authentication services into cohesive, automated workflows.

All of a company's identity tools integrate with the orchestration software, which creates and manages connections between them. This capability enables the organization to build custom IAM architecture, like vendor-agnostic single sign-on (SSO) systems, without replacing or retooling existing systems.

Returning to the prior example, the organization can use an identity orchestration platform to connect the employee’s accounts in the ticket management and CRM systems to an SSO platform and tie it all to a central user directory. This way, users can log in to the SSO once to access both apps, and the central directory automatically verifies their identities and enforces the right access permissions for each service.

In information technology, orchestration is the process of connecting and coordinating disparate tools to automate complex, multistep workflows. For example, in the realm of security orchestration, an organization might string together a secure email gateway, threat intelligence platform and antimalware software to create an automated phishing detection and response workflow.

Identity orchestration connects and coordinates the capabilities of disparate identity tools to create unified, streamlined identity workflows.

Identity tools are the tools that an organization uses to define, manage and secure user identities, such as identity verification systems and customer identity and access management platforms.

Identity workflows are the processes by which users move through identity tools. Example identity workflows include user logins, onboarding and account provisioning.

Identity tools don’t always integrate easily, especially when organizations are dealing with SaaS tools hosted on different clouds or trying to bridge gaps between on-premises and cloud-based systems. Identity orchestration platforms can connect these tools even when they aren’t built to integrate.

Identity orchestration platforms act as central control planes for all the identity systems in a network. Every identity tool integrates with the orchestration platform, creating a comprehensive identity architecture called the identity fabric.

Organizations don’t have to hardcode any of these integrations. Instead, orchestration platforms use a mix of prebuilt connectors, application programming interfaces (APIs) and common standards like SAML and OAuth to manage connections between tools.

Once identity systems are woven into an identity fabric, the organization can use the orchestration platform to coordinate their activities and control how users move between the tools during identity workflows. Crucially, the orchestration platform decouples authentication and authorization from individual apps, which makes complex identity workflows possible.

As mentioned earlier, different identity systems might not talk to each other in the absence of an orchestration solution. If, for example, an organization used a customer relationship management (CRM) tool and a document management system (DMS) from separate vendors, each app might have its own IAM system.

Users must maintain separate accounts in each app. To access either app, users would log directly into that service. Authentication and authorization would happen within each app’s distinct IAM system and would not transfer between apps.

With an orchestration solution, things are different. When a user accesses either app, the request goes through the orchestration solution first. The solution routes the request to the right identity proofing and access control service, which can be a central directory outside either app.

Once the user is authenticated and authorized by the central directory, the orchestration platform triggers the app to let the user in with the correct permissions.

To implement identity orchestration in practice, organizations use identity orchestration platforms to build identity workflows. Also called “user journeys,” identity workflows are processes that dictate how a user moves through identity tools—and how those tools interact—in defined situations, such as when logging into an app.

Workflows can be straightforward or relatively complex, with conditional logic and branching paths. They can involve many different systems, including some that aren’t strictly considered identity tools, like email services and social media sites.

Identity orchestration solutions allow organizations to build user journeys without writing any new code. These solutions have visual, no-code, drag-and-drop interfaces that can define events, connect identity tools and construct user pathways.

To understand what identity workflows are, it might help to look at an example. Here is a hypothetical new hire onboarding and login workflow that an organization can construct through an orchestration platform.

1. First, the new hire creates an account in a self-service HR portal. This triggers the onboarding workflow to begin.
   
   
2. The identity orchestration platform triggers the creation of a unique user identity for the new hire in the organization’s central directory service. The new hire is automatically assigned a set of role-based access privileges as well.
   
   
3. The orchestration platform then provisions accounts for the new hire in all the relevant services, including apps they’ll use on the job and back-office systems like payroll software. These accounts are associated with the new hire’s main user identity in the central directory.
   
   
4. Now that the employee is in the system, they can log in to their corporate email app. Instead of going directly through the email app, the login request goes to the orchestration platform.
   
   
5. The orchestration platform routes the request through a fraud detection system, looking for signs of suspicious behavior. Because this new hire is logging into their email account for the very first time, they are marked as higher risk.
   
   
6. Next, the login request is sent to the organization’s SSO platform. Because the new hire was marked as a higher risk, adaptive authentication kicks in. The new hire must use multifactor authentication (MFA) to get into their account.
   
   
7. The new hire completes the authentication challenges, and they are authenticated and authorized by the central directory. The orchestration platform relays this information to the SSO platform, which lets the new hire into their email account—and all the other apps behind the SSO—with the right privileges.

While there are quite a few steps here, it is worth noting that all of this happens automatically in the background without the user noticing. The orchestration platform oversees the process from start to finish. Furthermore, future logins are even more streamlined. The user signs into the SSO, which now recognizes them and grants them access to everything they need.

Identity orchestration platforms don’t replace existing identity systems. They create connections between these systems, allowing various apps and tools to work together even if they weren’t designed to. This functionality can help organizations address a few common problems.