Latest / Identity at the Center / #428 - Modernizing IGA with Thomas Zarnhofer

Transcript

#428 - Modernizing IGA with Thomas Zarnhofer · Identity at the Center

0:04
This is identity at the center. Welcome to the Identity at the
0:11
Center podcast. I'm Jeff, and that's Jim.
0:12
Hey, Jim. Hey, Jeff, how are you?
0:14
Oh, not so bad yourself. Still fantastic, man.
0:16
We're here at EIC 2026. This is the second podcast we're
0:21
recording after Identity Bureau on Monday night.
0:25
Since then, I've gone and had Vietnamese food in Germany.
0:30
I love Vietnamese food, love Germany.
0:33
Obviously I love my home country as well.
0:35
But since I've been in Europe, I've been in France and Germany
0:38
and man, the food is just like. Yeah, food's good.
0:44
I would say I've not had quite the culinary experiences that
0:46
you have, but I only just got to Germany here on Saturday night
0:49
late today is Wednesday. I spent most of Sunday just kind
0:53
of zoned out recovering, sleeping and then walking the
0:55
city. But yeah, we're at EIC, another
0:58
great conference. You mentioned.
0:59
This is the second episode that we're recording here.
1:02
It will go out of order though. So trying to think about like
1:05
how we would release this. But we did do an identity beer
1:08
and so that'll probably come out before this.
1:11
We're going to record a recap tomorrow on Thursday that I will
1:14
probably combine with the identity beer.
1:16
So all I'm thinking is we'll start with a recap of EIC and
1:21
then it'll fade into identibier conversation with Espen.
1:25
And then we'll have an episode here with Thomas and coming out
1:28
after that, and then an episode with Martin after that, and then
1:30
another episode with another Martin after that.
1:33
And then and then we'll get into other things.
1:37
You just got the whole thought process right there.
1:39
Don't hold me to it. This is going to go out of
1:41
order, so we'll see. Yeah.
1:43
Why don't we go ahead and get today's episode?
1:44
So we are EIC. So I want to give a shout out to
1:47
really the whole company of Cold Crew, but especially Marina.
1:50
She's the one who hooked us up with all this stuff matching
1:52
tables. So please comment that the
1:54
tables match in this room. That was a very important point
1:57
that we got to this morning. And yeah, but let me go ahead
2:00
and introduce our guest today. His name is Thomas Czarnofer.
2:03
He is. I am architect at SPAR ICS.
2:05
Welcome to the show. Yeah.
2:07
Thank you. Welcome also Jeff and Jim, nice
2:10
to meet you here today. Yeah.
2:11
Yeah. And so it's great to meet you.
2:13
I'm always happy to meet new people in the identity space.
2:15
I know you've spoken here probably I think a couple times
2:17
and you spoke here as well. We're going to get into that.
2:20
But we have tradition whenever, whenever everyone comes on for
2:24
the first time is we like to find out about their identity
2:26
origin story. So how did you get into
2:28
identity? Is it something that you chose
2:30
or did it choose you? I would say it was a little bit
2:33
of both. So I started my IT career with a
2:36
much broader scope. So dealing with infrastructure
2:39
topics, also dealing with security topics later on.
2:42
But then at some point of time, yeah, I would say when our when
2:45
our company started to talk about Relay identity and access
2:48
management and not about single products like Active Directory
2:51
and and so on. At this point of time, I have
2:56
known then I would like to focus on on this topic and would like
3:00
to make it to my to my profession really, because the
3:05
other identity is at the centre of everything in, in a digital
3:08
world, I would say. So it's, it's secures
3:11
everything, but it enables also, yeah, new ways how we can
3:15
deliver information to our people, how we can create
3:18
processes for our company. So their identity is at the
3:21
centre I would say. Yeah, it's a great name for a
3:23
podcast. Too, if you say something, you
3:25
did not pay them to say that. But we will give you a sticker.
3:30
Let me learn a little bit more about SPAR ICS.
3:32
So people who aren't familiar with that, tell me a little
3:35
about what SPAR ICS is like. What is the company?
3:37
What do you guys do? So SPAR ICS Spy Information and
3:41
Communication Services is the IT unit of the SPAR Austere Group.
3:45
So the Spar Austere Group is operating in in two major
3:48
business areas. So we are operating around 3000
3:53
retail stores, grocery retail stores in Austria and five
3:57
neighboring countries. And we are also operating 32
4:01
yeah, shopping centres in middle Europe here, yeah.
4:05
So a lot of retail going on. I have a former retail
4:08
background as well. So I'm sure we can share some
4:09
more stories. But let's talk a little bit
4:11
about the, the talk that you gave here.
4:13
What was it that drove you to say, hey, I need to share this
4:16
with the world? Like what is the what is the the
4:19
genesis of that conversation? So over the over the last years
4:23
we have talked with many other companies and yeah, we feel that
4:27
a lot of people were struggling with migrating from legacy on
4:30
premise IGA systems to to modern IGA systems.
4:34
We are struggling with modernisation in that area.
4:37
We are struggling with really establishing governance for
4:40
identities and therefore we also said we are now in the middle of
4:44
our migration to a modern cloud based IGA system.
4:48
We want to share our pitfalls, also our tips and also get
4:52
conversations started with other companies where we can also
4:56
maybe get some insights from the other companies back then, yeah.
5:00
So this migration that you did was more than just like a
5:05
technology migration. It was really an opportunity to
5:09
transform the digital identity operating model.
5:14
And so tell us a little bit about that.
5:19
Yes, so you're completely right. It wasn't a one-on-one
5:22
migration. So it was more like a a real
5:25
transformation I would say. So we are facing yeah several
5:30
issues before our legacy on premise I chase system it was
5:34
yeah already 10 years. I think in in production.
5:39
The complexity was rising over all the years.
5:42
We were struggling with some of the processes we were struggling
5:45
with yeah, with updating the legacy on Prem system.
5:51
So we had huge upgrade projects and also the identity model was
5:56
not the right one, I would say. So we were struggling with life
6:00
cycle processes because we were not managing identities based on
6:04
human persons. We were managing them on based
6:07
on work contracts. And I would say all of these
6:13
things, let us yeah then to the to the to starting this
6:19
initiative to modernize in that area.
6:21
Yeah, when I think about identity from 10 years ago, it
6:24
was a different approach. Identity management was more
6:28
about controlling the center than push it out.
6:31
Identity governance is more about, you know, having
6:35
visibility, one place to go to know who has access to what, and
6:39
then automate on top of that. So you have kind of this perfect
6:43
sweet spot. I'm wondering, was there a
6:45
specific tipping point or what was it that kind of drove you
6:49
guys to say out with the old and with the new?
6:54
I would say it, it wasn't one tipping point.
6:56
It was more the the whole sum of of complexity which was rising
7:01
with the with the old system and the entity model we had before.
7:05
We also had master data problems.
7:09
We had the the complexity around upgrades of the of the long
7:12
primer system. So we had to plan huge upgrade
7:15
projects from major version, major version upgrades every two
7:20
or three years at least. So they were the main problem
7:26
was there. Also it was taking, yeah, a lot
7:29
of resources in our team. We couldn't concentrate on how
7:33
we really innovate and really govern identities.
7:38
We were just yeah, doing operations of the system.
7:41
I would say yeah. So one of the themes in your in
7:46
your, your presentation is around this idea of contact
7:48
based versus person based from a modelling perspective.
7:52
So for people who aren't familiar with what does that
7:55
mean? Like what is contact based
7:56
versus person based? Let's start there and then we'll
7:58
go further. And so you mentioned there the
8:01
right thing. The entity model was a major
8:04
topic for us in our transformation.
8:08
Contract based means we created one identity per work contract
8:12
in the in the past. So if a person maybe had two
8:16
parallel work contracts in two stores, or one past work
8:21
contract and then the temporary work contract in parallel.
8:24
Or if a person was starting a second time to work for, for SPA
8:29
in the past, then they got a second identity, then a second
8:34
account was provisioned also on our identity providers.
8:37
That was a security issue, of course.
8:39
Also also we, we got wasn't accounts and, and fragmented
8:44
identities in, in that area. We didn't have, yeah, a removal
8:48
process in place. If somebody, yeah got a new work
8:53
contract, it was a a lever in the, in the China for us.
8:57
So that was a big issue. And therefore we said we
9:00
completely redesigned the identity model.
9:03
Yeah. And when switching to A to a
9:04
modern IGA product, that's that was the ideal point where we
9:07
could do that because in an existing product, it's hard to
9:10
check to change the model how identities are reconciled from
9:14
the source systems there and how you work with them.
9:18
And how do you how do you define that the life cycle events and
9:21
and govern them? It's a real problem when we're
9:24
dealing with IGA implementations is how important that data is
9:27
coming from your identity sources of truth.
9:29
You've got your employees, you've got contractors, you've
9:31
got vendors, business partners, etcetera.
9:34
What that usually leads to, at least what I found, is you might
9:37
have multiple sources of truth. So my employees might be in this
9:40
system or in the case of a retail environment, a store or a
9:44
retail unit might have its own identity source and then another
9:46
store or another retail unit might have its other, might have
9:49
a different source. How do you tackle that idea of
9:51
saying, OK, do we leave them separated and then try to bring
9:56
them all up into the IG platform?
9:57
Do you try to create, you know, a centralised view of all
10:01
identities? What is the approach there that
10:02
you that you think works best? So we took the approach that we
10:07
create a centralised view on them.
10:09
So we said we want to have one source system.
10:12
So we are consolidating now all the master data from different
10:16
HR systems and different sources in one also the source for our
10:22
HA system and say this is the truth for us.
10:25
We clearly defined which attributes are coming from from
10:30
the source system because in the past that was also not clear.
10:33
Some attributes were maintained in the in the old HA system,
10:36
some were maintained in the Active Directory and and our
10:39
systems and some of the attributes were coming from the
10:43
HR source. So that was also a big issue and
10:46
we we have some different HR systems of our countries and
10:51
that was a huge issue for us so. So the idea of your IGA platform
10:57
is, is the IGA platform the centre of truth then for all the
11:00
identities or is there a separate intermediate system
11:03
that is sort of like your master data lake or whatever that looks
11:06
like? The the master data is coming
11:09
from 1:00 central HR system now where we consolidate all the
11:14
different HR sources. But I would say for the
11:17
identities itself, then the the real source of truth is then
11:23
really our new IJ system. And there we clearly define
11:29
which attributes are also the different, which coming from
11:33
which system. And the identity is also
11:35
additive there. And we don't take all the
11:38
sources anymore. Yeah.
11:39
I feel like in your presentation you really emphasize this point
11:42
about like bad data can kill the project, right?
11:47
And so I want to know what are some specific examples if you
11:51
would, of where that that kind of problem surfaces.
11:56
Is the data coming from the old IGA or the old identity system?
12:00
And then, you know, any kind of tips that you can give?
12:04
Because I think a lot of people listen to the podcast and
12:07
practitioners like you've kind of got the war stories of, hey,
12:12
try to avoid this or that. I was already mentioning one
12:17
thing so clearly defined which attributes are authoritative
12:20
where. Because in the past it was the
12:24
case that for example, it was possible that somebody said I
12:28
have a very complex name or multiple first names and I just
12:33
want to have the the first one of my of my names in in all the
12:38
systems where where I chose up blackmail system and so on.
12:42
But in the HR system, the long name with multiple first names
12:47
and so on was was in there. But our service desk was
12:52
maintaining the changes only in Active Directory.
12:55
When we now started to migrate to a new system, we would have,
13:00
yeah, let's say overwritten all the data on our identity
13:02
provider with wrong values. So we had to do a real analysis
13:06
of all the of all the data between identity provider IGA
13:11
system and the source system where, where HR master data is
13:15
coming from. So that we did that for several
13:19
attributes. So all the department names were
13:22
not consistently synchronized. Names were such a topic.
13:27
So we had several topics there where we had to clean ups and
13:32
introduce new concepts. So you're highlighting sort of
13:36
this orchestration and this coordination and this
13:38
partnership that you have to have with HR Because I think
13:42
what I found, and I'm curious if you find this as well, is HR
13:46
teams really want to own their data.
13:48
It's their data and you're just allowed maybe to use it.
13:52
And I think one of the things that I see caught quite a bit is
13:55
the struggle between an IAM team who is trying to do their best
13:59
effort to say, hey, why don't we work on things like automated
14:02
onboarding and offboarding and join your mover Weaver and
14:04
changes, right? All that stuff.
14:06
But sometimes they run into a challenge with an HR team maybe
14:09
that doesn't understand what that integration looks like and
14:13
they think it's maybe more work than it really is and
14:16
connectors, right, and all this other stuff.
14:18
I want to boil down the question to what have you found to be
14:21
successful to partner with data sources out there, whether it's
14:27
HR or maybe a finance team? I would say really describe
14:31
them, what is the purpose, how we use this data and how we
14:36
generate value for the for the whole company with it so that
14:38
they see what they maintain in their systems has an effect on
14:43
on the whole digital ecosystem of our company.
14:46
I would say, because in the past they were saying, yeah, we're
14:50
doing payroll. That is what HR told us some
14:54
years ago. It's a payroll system.
14:58
We need the data for, for doing the payroll and everything else
15:02
is not interesting for us, but we could change that situation.
15:07
It was a yeah, several discussions and longer meetings
15:11
and workshops. But then we can, we can really
15:15
to the conclusion we we showed them, Yeah, look, we want to
15:19
build up automations. We want to create really
15:23
automated life cycle processes for for new joiners in our
15:28
company. We need the correct data there
15:30
and we need several attributes to really define how our
15:34
processes work. And after we showed, we showed
15:37
it to them in detail. They also supported our stand
15:40
now. So just go into the
15:41
conversation. I would say yeah, don't be shy.
15:44
It's great that you also had the folk, your HR partners willing
15:50
to adapt their processes if it made sense for the business as a
15:55
whole. Sometimes I think I ran into
15:59
this earlier in my career where there'd be some resistance, like
16:03
it's the payroll system, period, end of sentence.
16:06
But I think you're, you're describing the ideal situation
16:10
where folks are willing to adapt processes.
16:15
I was actually wondering a little bit.
16:16
You're talking about all this data work that you're doing.
16:19
And here's a question from one practitioner to another is
16:23
where, what tool did you use to do this analysis?
16:26
Because now we have AI, you could plug a bunch of data into
16:31
AI. My concern would be that, you
16:33
know, if it didn't come out perfectly right.
16:36
This is data you really can't make mistakes with or you do the
16:40
old fashioned of Excel. And do you really want to put
16:44
all of your personnel data into an AI?
16:47
That's a good. Point that was also really a
16:49
concern for us. So we took the old fashioned way
16:53
really. So we did a lot of Excel work
16:55
and yeah, doing several exports from the system and comparing
17:02
data, matching the data and analysing an Excel order, the
17:07
differences between the systems there now.
17:09
So, so Jeff and I do consulting work together and we often are
17:13
building Rd. maps and usually in the road map or a lot of times
17:17
in the road map, there's this IGA project.
17:20
And I tend to like to put a project right before called data
17:24
cleanup. Part of my reasoning is like,
17:27
you know for sure your date you're going to have data
17:29
problems if you don't clean them out.
17:32
But also companies usually have to go through the process of
17:35
getting approval to buy the software, procure the software,
17:39
etcetera. So they have time, they can be
17:41
working on data cleanup at the same time the argument can be
17:44
made, and my J system has the tools to clean up the data for
17:48
you. What do you recommend?
17:51
What did you do? I would recommend to start
17:54
before really going into the IJ implementation because they are
17:59
often the IJ tool and US tell you, yeah, we have the tools to
18:02
to clean that up. But I think it's the better.
18:06
It's better to really concentrate on your data before
18:10
then. Yeah, set up your identity model
18:13
how you want it, define which attributes, which data is coming
18:16
or so authority from which systems.
18:18
And then start really with the with the tool, but not the other
18:22
way around, yeah. So let's talk a little bit about
18:25
the way that that transformation process works.
18:28
In your in your conversation, you broke this out into three
18:31
different phases. You had foundation migration and
18:34
what was the third one, adoption.
18:35
Look at my notes. Let's talk about that phasing
18:38
because phasing helps us as humans digest what is we have to
18:43
do right? Say, I can't just say, hey,
18:45
Thomas, go implement IGA, OK? Like there's so many things to
18:49
go to, to go through that. And and to your point, Jim
18:51
Wright, we've got Rd. maps to say, OK, here's the order of
18:54
operation. Let's talk a little bit about
18:56
those phases. Why is that so important?
18:59
Or is it purely just a it's a human thing to help us
19:02
understand it better? On, on the one hand, you're
19:05
right, it's, it's also a human thing to, to help us to
19:08
structure the things a little bit.
19:10
But I would say it helped us also to describe to to the
19:14
management and to other people that we really need a foundation
19:18
phase where we talk about the identity model, where we talk
19:21
about the data consolidation from HR sources and that stuff
19:25
and really do the base set up of the new HA platform itself.
19:28
Then. And then we go into the real
19:30
migration where we then can switch over different governance
19:35
processes and target systems from the old system to the new
19:38
one app and then finalize everything with adoption phase,
19:43
how we called it, where we then really can shut down the old
19:47
system and optimize also the stuff in the in the new system.
19:50
Because we said we don't want to do a one-on-one migration.
19:53
We also wanted to introduce some new governance processes.
19:56
We want to introduce some new things and we want to take the
19:59
value we can get out of the new product, of course.
20:04
And so in that case, we said also there will be an adoption
20:06
phase, of course, we will then really optimise the new system.
20:11
Let. Me follow up on that adoption
20:13
phase because you're in the middle of this process right of
20:16
of migrating from an on Prem to a new solution in the cloud.
20:20
How do you, I guess, how do you incent people to say, oh, I
20:24
should do this work, I should take advantage of that?
20:27
And how do you improve adoption? Because they've got a lot of
20:29
people struggle with, hey, we built this thing, we sure hope
20:33
people use it. Yeah, I would say it's also a
20:38
lot of conversation again and doing lobbying in the
20:41
application teams also telling them, yeah, we have a new system
20:45
where we can also know now, yeah, put a better governance
20:48
over the all the permissions and your applications.
20:51
We need to adopt it. We need to switch over the
20:54
applications. We need your support and do that
20:57
early because normally the application teams deal with
21:00
other stuff. They want to deliver new
21:02
features for the business and their applications and not
21:05
support you in migrating the identity management stuff.
21:10
So one of the challenges of, of, of migration is you've got
21:14
potentially two different systems running almost in
21:16
parallel almost at the same time.
21:18
You've got cut overs between, you know, 1 system doing
21:21
automated deprovisioning and then you flip a button and all
21:23
of a sudden the new one is. What are some of the concerns or
21:27
things that maybe help improve risk from an operational
21:30
standpoint to have both of these things running either in
21:33
parallel or very close to parallel?
21:36
So for us, this, this was a measure of having both systems
21:40
in parallel operation was a clear measure to reduce the risk
21:44
in the in the overall migration. Because doing a Big Bang in the
21:48
identity field, I think is not a good thing, because you can put
21:52
a lot of harm to the organization.
21:54
Also, if you switch over all SAP targets, for example, from an
21:58
old IJ system to the new one on the same day, in the, in the
22:01
same minute, and then maybe nobody has access to all the SAP
22:06
systems out there. That would be a mess of course.
22:09
And therefore we said we, we take that phased migration
22:12
approach also where we take one system target system after the
22:15
other and also take one process after the other.
22:19
Of course, it's important to clearly specify which system is
22:23
responsible at the moment for which target systems and
22:25
processes. That is, I would say the success
22:29
factor for for having that defining a clear responsibility.
22:35
But if you have the clear responsibility definition, have
22:37
a clear plan when you switch over which systems and processes
22:41
to the new IJ tool, then then you will be successful.
22:46
I would say yeah. You know when you talk about
22:49
one-on-one migration, which is what you wanted to avoid, right?
22:53
It reminded me of the what we call lift and shift right in the
22:59
cloud. Like, oh, you could just take
23:01
this server and run it as a virtual server in the cloud, or
23:06
you could do it cloud, right. You know, you could kind of
23:09
prepare for the way to manage cloud, not just be dependent on
23:13
the individual servers at the same time.
23:17
All that is theoretically great, but it takes a long maybe just
23:22
lift and shift some things and do some things right is the
23:27
right balance. So bringing it back to your
23:30
topic, did you find that you had to find some areas where you do
23:34
just lift and shift and other areas where you said, hey,
23:38
there's the opportunity to get the process right?
23:42
We really said challenge everything during the migration
23:45
because we said we don't want to do assumptions.
23:48
We really said we challenge everything starting from, yeah,
23:53
the connector side to target system, but also processes, for
23:57
example, yeah, the mover process, we completely
24:01
restructured the mover process. Now we're switching to the new
24:04
tool because we said maybe it was not the EDL process for our
24:08
organization, which was implemented in the old tool in
24:10
the past. And now we really said how, how
24:15
really looks the the best process which we can also handle
24:18
with the new tool. Because not all tools handle all
24:21
the processes in the same way. And if we would have taken just
24:25
the process definition how it was in the past an organization
24:28
and tried to implement it with the new tool, I think we would
24:32
have failed. Yeah, I've seen some
24:36
implementations where you know when you're working things out
24:40
on how you want them to work or how you've done it in the past.
24:43
Let's just say somebody new joins to get an e-mail address
24:47
provisioned and they have the same name as somebody.
24:50
So now what is your process for naming the new e-mail address?
24:55
If you come up with, hey, we wanted to work the way we've
24:58
always done it, that may require some customization or hard work
25:03
in implementing your new tool, but maybe the new tool has a way
25:07
and you say we'll just do it that way.
25:09
Did you run into any scenarios like that?
25:11
I call that best practices. I don't know that it means it's
25:15
better than any other practice. It just means that's the way the
25:19
tool is built, and if you use that, it's going to be best from
25:23
the least implementation work. Yeah, I think we we were running
25:29
into such things, but I don't have the the one big case I
25:33
would say here. So e-mail addresses maybe it's
25:36
not the case. We set the e-mail system in our
25:38
case as a sort of system to generate the e-mail address and
25:42
we reconcile it back to IJ then. So in that case we are lucky,
25:47
yeah, but for, but for other connectors for example, yeah,
25:52
when connecting some of our, yeah, business applications, we
25:57
said the the old connector was a completely wrong architecture I
26:03
would say and we completely redesigned it then.
26:07
Another example I can think of would be getting somebody their
26:11
their password and their username the first time.
26:14
But maybe some of those things work through your Microsoft
26:18
system, but you had to provision that account anyway.
26:21
You might need to change the process and coming up with
26:24
something totally custom versus working how the product works is
26:29
kind of the example. So, so we are also trying for
26:34
example some things where provision via some PowerShell
26:38
scripts in the past. But now we also tried what we
26:40
can do out-of-the-box with the new IJ tool.
26:43
We don't start PowerShell to scripts anymore.
26:46
We do it directly out of IJ to provision this attributes to add
26:51
this entitlements not do some things over IJ and some things
26:55
we have PowerShell scripts. So all that versus such things
27:00
as you mentioned? What a novel idea You're using
27:03
your IGA platform to do IGA. I'm curious if anything
27:07
surprised you when you were going through this process of,
27:11
you know, transforming from on Prem to cloud.
27:13
Like we've, we've asked a bunch of questions, but like, what's
27:15
something and maybe nothing did, but was there something that
27:18
surprised you as you were going through this process that is
27:20
like, oh, I hadn't thought about that before and we need to
27:22
adjust for that. Let me think.
27:26
I don't know, put you on the spot here, so give you like, you
27:28
know, think about it, but I find that like this is something that
27:31
look, you can have as many plans as you want and then all of a
27:34
sudden it's like, Oh, I hadn't accounted for that.
27:36
And I think a lot of people listening and probably like, you
27:38
know, we had this thing happen, right?
27:40
They're probably like in the comments or in their mind
27:42
thinking about the things. I'm curious like when you were
27:43
going to that process, like did anything separation?
27:47
So I think and you think for us was how to deal with cloud
27:52
products, how the updates work there, for example?
27:55
Yeah. So because don't think that
27:58
there are no testing processes and that you don't have to do
28:02
testing when the cloud provider does an update in the in the IJ
28:05
platform itself, of course you still have to establish testing
28:11
so that you really know that all your processes and all your
28:15
implementations and connectors still work after your cloud,
28:18
after the cloud provider of the J2 does a major upgrade for
28:21
example of the platform in the cloud.
28:23
That was also a new thing for us where we had to learn how to
28:28
deal with that because on at our on premise system, we completely
28:33
had that process in our hands. We could plan when do we do the
28:36
upgrade and when do we, yeah, integrate the patch into the
28:41
system and we could really then coordinate all that with the
28:45
testing. But with the cloud itself, the
28:48
testing gets more important. Yeah.
28:51
But of course you don't have to deal with so much operations
28:55
effort anymore as with the on premise system.
28:57
But don't think that it is completely zero then.
29:01
Yeah. Yeah.
29:02
You mentioned that you took the approaches challenge everything
29:06
and I think that's one of the areas of challenges like hey,
29:10
you have all these environments maybe with on Prem software like
29:14
hey, we have a development environment, an integration
29:17
environment, a test environment, pre production environment and
29:21
production. And now in your new cloud it
29:24
might just be sandbox and production.
29:27
Of course, that is also a situation we we had to deal with
29:30
fair. So before we had more stages,
29:34
but we also had to learn how to deal with that situation on the
29:37
in the clouds and how that works.
29:41
And also, yeah, 1 crucial thing for us was also to we want to
29:45
automate the deployments now between the stages and the
29:47
cloud. That is also an important thing
29:49
for us. Well, we've made it about 30
29:52
minutes and I don't think we mentioned AI really at all, but
29:56
it is the year 2026. So we have to talk AI.
29:59
How do you see AI impacting specifically the IGA space
30:03
itself? I'm curious where you think this
30:05
is headed? Of course there are, there are a
30:08
lot of discussions going on how AI influences IGA on the on the
30:12
one hand you have the AI identities itself we have to
30:16
manage in the future. So that is also a topic on our
30:18
road map. Of course, we're not doing it at
30:21
the moment, but of course, we want to all the governed AI
30:24
identities in the in the future. We need to.
30:27
We had a lot, we had a lot of conversations also during the
30:30
conference already regarding AI. But I think AI can also bring a
30:35
lot of benefits in the existing IGA world, not only dealing with
30:42
the AI identities on only one identities itself.
30:45
It can also bring, Yeah, big improvements for the existing
30:49
processes like role requests, like excess decisions,
30:55
recommendations, all that stuff. So a lot of manual processes at
31:00
the moment there. And of course, I think AI can
31:04
also revolutionize this area. So I would love to see that AI
31:11
makes IGA predictive. I would say so in in my EDL
31:18
worst scenario in the future, the IJA system should know what
31:22
a new employee needs in terms of authorisation, in in terms of of
31:27
roles and maybe just then provide already based on some
31:34
job description a predefined set of roles.
31:38
Just ask the new manager of the person.
31:40
Is that OK for you? If not, tell me otherwise I will
31:45
provision this new roles for your new employee that he has
31:49
everything he needs to start the work on 1st of June, for
31:53
example. Yeah.
31:55
So that that would be the easiest scenario from my
31:58
perspective. We are not there at the moment.
32:00
So we are we are dealing a lot with how yeah, maybe bring
32:06
natural language processing where we can chat with some chat
32:11
bot and the chat bot answers which roles do you need and and
32:16
can request the roles on behalf. But I really want to see in the
32:20
future this prediction already. That is, I think then the the
32:23
big Revolution app let. Me ask you about that chatbot
32:26
idea because when I first started, you know, working on
32:30
this a while back, actually we kind of started the podcast
32:32
about 7 years ago. One of the things that was kind
32:35
of hot at the time was the idea of a chat interface.
32:38
Now, at the time, it wasn't generative AI.
32:40
It was really a multiple choice question, right?
32:43
But hey, let's put this into Slack or Teams or, you know,
32:47
whatever Microsoft Messenger was around.
32:49
It might have been three Teams. Do you think, though, that the
32:54
business would actually use that because they find it, you know,
32:59
somewhat challenging? It's OK.
33:01
Do I really want to ask a manager to go to a chat bot and
33:04
tell it what I need access to? I don't know if I if the if the
33:08
business value really is there for you the adoption.
33:11
I think it depends on the on the business person who is dealing
33:15
with the, with the access. Of course, maybe the, the
33:19
younger generation is already used to chat with Chatcha PD and
33:23
Claude and and all their other AI tools.
33:28
Maybe some older generation people also already starting
33:32
with that. But it it depends.
33:34
And I think we have to provide this possibility at least.
33:37
But at least for the next years, there will be several ways how
33:40
to request roles. For example, I would, I think,
33:44
yeah. I think one thing that has a lot
33:47
of potential with the AI would be just the language prompt
33:52
where you could type in a question like hey, I need access
33:56
to open a purchase order or something like that.
33:59
And it would figure out what role you need and say, hey, you
34:04
know, this is the role you need. Would you like to have me
34:07
automatically set up a request for you to get access and now I
34:12
can kick off the request rather than the old fashioned way of
34:16
trying to figure out how to do it searching in a a web?
34:21
Right. So I think that that is also a
34:23
problem for a lot of business people in our company, how to
34:26
find the right roles they need for their work.
34:29
That is a big issue in our company also we are providing
34:33
more and more roles for our business applications now.
34:37
So setting up proper role models everywhere we are, we have
34:42
critical access and but there's a lot of roles I would say is
34:47
also then a huge challenge for our people in the business
34:51
because they are often not knowing what do I really need
34:55
then to, to do my job. And I think they're, if they see
34:59
the benefit of, of such a chat bot, if you provide them and and
35:03
chat bot, which they can just ask the chat bot, for example,
35:06
sees they are working in the headquarter in Salzburg.
35:09
And therefore for the for the finance roles, they maybe need
35:16
this set of roles because they work in the headquarters,
35:19
somebody else in some other location, maybe it needs a
35:23
different role because of the organizational assignments.
35:26
Essentially uses inference to figure it out.
35:29
Right. But do you trust the thing
35:31
figuring it out? And do you want to?
35:33
Do you want to expose your roles to the business?
35:39
Do you want to make things discoverable?
35:41
To say, oh I didn't even know that access existed, Sure, let
35:44
me ask for it. Not everything I would say.
35:48
You need a real appropriate scope, sort of what a person
35:50
can. We call it business roles.
35:52
Business roles are really the roles which are exposed to our
35:55
business. But of course we also assign
35:58
technical access, which the business maybe doesn't see and
36:02
do automatic access assignment of course.
36:06
Let's end on a lighter note. I want to get you out there so
36:08
you can enjoy the rest of the conference.
36:11
Let's talk a little bit about what you do for fun when you're
36:13
outside of conquering the IGA world.
36:17
So. So I would clearly say nothing
36:19
with computers there so. You completely unplug.
36:22
You were mentioning you like to travel, You like to climb
36:24
mountains, different types of mountains, not IGA mountains.
36:27
Not IGA mountains, so it's a real mountain.
36:30
So I'm living in Salzburg and I sit in the in in Austria.
36:34
So mountains all around our city.
36:37
And yeah, going hiking a little bit, relaxing in the mountains,
36:42
but also, yeah, travelling a lot, doing city trips.
36:47
That is what I really like in my free time map.
36:50
What's your favorite place that you've visited so far in the
36:53
world? Hot Quiz.
36:55
So I would I would say there is not this favorite place in
36:58
summer, for example, I'm I like to be somewhere somewhere where
37:02
this warm like Croatia and in Europe is a nice destination to
37:06
really relax some days at the sea.
37:08
But also doing almost every year I'm doing also a city trip for a
37:13
weekend to London, for example, because I like the city very
37:15
much. So I don't like, I would not
37:18
like to really live in such a big city, but to just visit
37:22
London for a weekend is nice. Every every year.
37:25
Yeah. How?
37:26
About you. I mean, I, I'm going to Italy
37:29
next week. I'm so excited about it.
37:32
And everybody in Germany keeps telling me, oh, Italy, you're
37:36
going to love it. It's the most best food.
37:39
And yeah, you know, everything is great.
37:42
It's a nice destination, of course in Europe.
37:44
Yeah. So Italy after Croatia I would
37:48
say. Also love Italy for doing a trip
37:50
in summer was relaxing at the sea.
37:53
Also they have nice old cities where which you can visit.
37:57
What do you look for on a vacation?
37:58
Is it when you say you unplug, right?
38:00
Do you look for nature? Do you look for history?
38:04
Do you go for culinary? Like, Oh well, you know, I want
38:07
to go enjoy the food and drink of an area.
38:10
I would say a mix of everything, yeah.
38:12
So of course having good food there.
38:14
So both in Italy and Croatia where you can have good food,
38:18
but also like to to visit cities and and see new, new things and
38:23
also but but also see the nature.
38:25
So really a mix of everything, yeah.
38:28
All right. My last question for you, and
38:29
this is really more specific to Austria, so I've never been,
38:33
what is something that I should do or consider before I visit
38:36
Austria for the first time? Some place I should go,
38:40
something I should try? Like what's?
38:42
I don't want to call it a hidden gem because this look a lot to a
38:44
bunch of people and it might no longer be a hidden gem.
38:46
They thought like when something that hey you really need to go
38:49
do this or try this. Of course, I would say you have
38:53
to try to eat Wiener Schnitzel. It's one of the, yeah, classic
38:59
dishes in in Austria, but you also have to so look on all the
39:04
nature and mountains. You have to at least go hiking
39:08
to one of the mountains and also visit one of the of the lakes in
39:12
Austin because we also have very beautiful lakes that are sort.
39:16
Of sign me up for all three. I will definitely enjoy the
39:19
food. I would definitely sit by the
39:20
lake. I I would probably park in some
39:23
of the mountain climbing. I would walk up the hill.
39:26
So what's your ideal vacation job you know?
39:28
It's, it varies quite a bit. So I like to not have plans on
39:34
vacation. My day and my weeks are very
39:37
structured already between the day job and consulting the night
39:41
job with podcast. And so when I go on vacation, I
39:44
kind of like to not have a plan. So just kind of wander, you
39:47
know, I got here early before the IC conference.
39:50
So Sunday I basically just walked all over Berlin downtown,
39:53
you know, from everywhere, from TV Tower, which is kind of where
39:55
we're at, Alexanderplatz, all the way down to really kind of
39:59
Berlin station, sort of, you know, that area.
40:02
That's a that's a good plan. Yeah, it's for me, it's not
40:06
about unplugging. It's just I'm just going to
40:08
wander and roam and just see and.
40:12
When I visit in new city sometimes I also do it in the
40:14
same way, so not make big plans before when I arrive in the
40:18
city. Maybe look, what are some
40:21
important places you have to visit and then really, yeah,
40:24
walk through the city and discover on your own.
40:27
Also a little better. I think it helps the having come
40:30
here now for the second time. So last year we came for EIC for
40:32
the first time. So that's my second trip.
40:34
So I was somewhat familiar with, OK, here's kind of how it works.
40:38
And shout out to my RSM friends from Germany.
40:40
They kind of taught me how the train system works.
40:43
I was, I was very carefully observing them last year, like,
40:45
OK, let me take advantage of it. So I've taken the train a couple
40:47
times here and I've kind of gone back and forth.
40:50
So it helps having, I guess, just an initial familiarity with
40:53
it. But I was kind of bummed because
40:54
there was a bakery that was underneath the Alexander plot
40:57
station that I really liked. And it's under construction
40:59
right now. And so none of those things are
41:01
there. It's like, oh man, now what am I
41:03
going to do? Like try to find something else
41:04
to eat? But I'll live.
41:06
I try not to fall into the American habit of go to five
41:10
guys or something. You can have five guys at home.
41:13
You can. I did have five guys Saturday
41:16
night when I landed. I just wanted something quick
41:18
and simple before I crashed and it was honestly, it was the best
41:22
five guys I've ever had. It was a fantastic I went.
41:24
There last year and it was a fantastic five guys, but.
41:27
You know what, after, I guess at that point, it would have been
41:29
like almost 16 or 20 hours of travel between, like when I left
41:33
the house, the flights. Yeah, the the waiting in
41:37
between, in between and going through customs, all that stuff
41:39
was about 20 hours for me. And I just wanted a bacon
41:42
cheeseburger. Yeah, no.
41:43
Comfort food means it makes you comfortable.
41:45
It's what you're used to. And yeah, I can see why you did.
41:49
That, yeah, but I've been exploring since then.
41:50
I've been getting other types of food.
41:51
I'm sure I'll get other things tonight and tomorrow or
41:53
whatever. But yeah, Thomas, thank you so
41:56
much for joining us. I really appreciate it.
41:57
Yeah, it was a a real pleasure to join you today in the session
42:00
and nice to nice to meet you and nice to talk to you.
42:04
Thank you. Thank you.
42:05
Yeah, we'll go ahead and edit it for this episode.
42:07
Again, shout out to EIC for hosting us and giving us a spot
42:11
to record, which is very cool. Shout out to Marina again.
42:14
You can find us on the web, idacpodcast.com.
42:16
Like subscribe to all that fun stuff.
42:18
That's how we get to do cool things like this and bring it to
42:21
you. We'll leave it there for this
42:23
week. There.
42:24
Thank you everyone for watching and or listening.
42:25
You're very easy for me to say. And we'll talk with you all in
42:28
the next one. You've been listening to
42:33
Identity at the Center. We hope you've enjoyed the show.
42:37
Make sure to like, rate and review, and we'll be back soon.
42:41
But in the meantime, hit the website at
42:43
identity@thecenter.com. See you next time on Identity at
42:50
the Center.