Imagine an employee who changes departments. A different manager. A different job. A fresh set of applications. Somewhere, however, the old permissions survive. Nobody has stolen a password. Nobody has broken a lock. The company has simply forgotten to collect a key. This everyday mismatch is the territory One Identity occupies: the distance between what a person does and what their accounts still allow.
- Govern who gets access, and keep checking who should keep it.
- Automate the account work that slows down hires, transfers and departures.
- Protect administrator credentials alongside ordinary user accounts.
A first day, measured in hours
At Mattress Firm, the problem had a wonderfully unglamorous expression: getting people ready to work. In a published customer story, the retailer says One Identity Manager cut provisioning time by 90%. Its manager of application integrations and identity management, Andy Martinez, described getting even 40 new hires fully provisioned within four hours.
The mechanism matters more than the percentage. Identity Manager detects new or changed staff profiles in Workday and uses that information to drive access. The system connects an employment event to a technical consequence. A person joins; accounts follow. A policy changes; access can change with it. Security becomes part of running the business.
Four questions hiding inside one login
One Identity sells software to organizations managing the permissions of employees, contractors, administrators and machines. Its customers include retailers, universities and financial-services organizations. The company reports more than 11,000 enterprise customers and over 500 million identities managed. Identities are accounts and digital representations; that number is not a count of individual human customers.
Its portfolio divides a familiar action, logging in, into several decisions. Identity Manager handles governance: who should receive access, who approves it and how it gets reviewed. OneLogin handles access management, including single sign-on and multi-factor authentication. Active Roles administers Microsoft environments, including Active Directory, Entra ID and Microsoft 365. Safeguard protects privileged credentials and records or monitors privileged sessions.
The appeal is the connection between those decisions. A valid login says little about whether somebody still needs an old permission. A secure password vault does not, by itself, explain why an administrator has access. One Identity’s proposition is to bring these jobs together while supporting on-premises, hybrid and cloud environments.
The spreadsheet had reached its limit
Consider Raiffeisen Informatik, or R-IT, an Austrian IT-services provider. Its published case study describes an environment serving close to 80,000 technology users, with more than 500 applications attached to Active Directory and nine HR systems supplying identity information. At that scale, keeping an access list current becomes a substantial operational job.
R-IT worked with application owners to add permission objects to Identity Manager’s service catalog. These defined access rules, accountable people and approval workflows. Automation then had something precise to execute. R-IT reports that application rollout increased from two per week to 40. Provisioning that once occupied a full day fell to roughly 30 minutes.
The copyable lesson is the sequence: name the owner, define the permission, specify the approval, then automate. Software can execute a rule repeatedly. Deciding whether that rule makes sense remains organizational work. R-IT’s account is useful precisely because the application owners appear in it.
The awkward applications get a vote
The first practical limit is coverage. A governance system cannot reliably remove access from an application it cannot reach. Old terminal software and specialized systems make the neat architecture diagram messy. In July 2026, One Identity announced an available integration with READI, whose Smart Connector technology operates applications through their interfaces to extend governance beyond standard connectors.
Machines complicate the picture further. Service accounts, tokens and automated workloads do not behave like employees. One Identity’s July alliance with Silverfort addresses discovery and monitoring of non-human identities and connects OneLogin Protect to authentication flows. Broader integrations across governance and privileged access were described as future work. Buyers should keep that distinction in the conversation.
These are revealing choices. The product boundary keeps moving toward accounts that are difficult to see or connect. A deployment still needs sound identity data, usable approval rules and tested integrations. If those are missing, automation risks reproducing the confusion faster.
A company follows its engineers
One Identity emerged from the Quest software family, with public company profiles dating it to 2016. Its 2021 acquisition of OneLogin added cloud access management. Clearlake Capital completed its acquisition of Quest in February 2022. This is a corporate software lineage, with products assembled around related access problems.
In June 2026, One Identity announced plans to operate independently and designated Cork, Ireland, as its global headquarters. More than 80% of its engineering organization was already based in Europe. The headquarters decision followed that footprint. CEO Praerit Garg put the strategic argument plainly:
“Identity is now the control plane for enterprise security.”Praerit Garg · June 2026
Price the door. Then price the building.
OneLogin publishes Workforce prices of $3, $6 and $10 per user per month for Basic, Essentials and Business. Those figures buy particular access-management packages. Identity Manager and Safeguard direct buyers to request pricing. A complete deployment also involves integration, policy design and ongoing administration; the subscription is one part of the decision.
The alternatives depend on the job: SailPoint or Saviynt for governance, CyberArk or BeyondTrust for privileged access, Okta or Microsoft Entra for access management. One Identity’s case rests on portfolio breadth, Microsoft administration and deployment choice. Its expertise is especially relevant where new cloud applications coexist with directories and older systems.
That breadth has a practical trade-off. A small organization looking only for a common login may have little reason to start a wider governance project. A business with several HR systems, delegated directory administration and recurring access reviews has more moving parts to coordinate. The useful comparison begins with those conditions, rather than the length of a feature list.
A useful evaluation follows one person through hiring, a transfer and departure. Watch what happens to every permission at each step. The telling moment may be the transfer: new access arrives, and somebody checks the old keys.