EmpowerID Cloud SaaS Pricing

The Password Management module is for organizations that want users to reset and synchronize their passwords across all systems on which a user has their password, i.e. Active Directory, LDAP, ServiceNow, and any system that is not enabled for SSO. The Password Management module also includes the workflow where helpdesk users can perform assisted helpdesk password resets and unlocks on behalf of users. They can validate the user’s identity, reset their password, and then have that change synchronized across all external systems.

The Group Management module allows EmpowerID to connect to external systems and inventory them. EmpowerID will inventory the groups or app roles from systems such as AD, Azure AD, SAP, and to monitor for changes in memberships. This also allows dedicated admin users to then manage these groups (create, manage, delete), and for end users to request access in a self-service manner to these groups.

The Dynamic Group Management module uses the EmpowerID Dynamic Group Engine to create policies based on any attribute in the Identity Warehouse. It dynamically creates groups in external systems, such as ServiceNow, Azure, SAP, etc., and then manages their membership through their entire lifecycle. When no-one matches these groups, to retire and deprovision them. One common example for enterprises is to have email distribution groups for, first, each country, and then a nested group for each city in that country. The engine then dynamically generates users who match both country and city. If the user moves location, the engine would then reassign accordingly. If, at a later they leave, the user is automatically deprovisioned based on your organization’s leave policies. However, if the office itself closed, then the engine would also detect that no-one matched/is in that group and act accordingly.

The Lifecycle Management module provides 2 key components. First, is the ability to automate the Joiner-Mover-leaver lifecycle process in Identity Management, and second is Identity Administration (the administration of identities).
EmpowerID inventories out of the box connected systems and pulls in the user account data, as follows:

• Joiner Events—dynamically determines if this account should be a new person identity or not. If so, it then provisions that identity and then determines which other accounts belongs to the same person and links them together for attribute flow, password synchronization, etc.
• Mover Events—EmpowerID monitors the account identities and detects mover events, such as role, manager, department, etc., and adjusts accordingly.
• Leaver Events—when the user’s contract expires and they leave the organization, EmpowerID detects and dynamically (and gracefully) deprovisions that person’s account.

All of this happens automatically. If your organization has customs HR systems, etc., and need more than what the Lifecycle Management offers, then the Advanced Lifecycle Management is what you need.

If your enterprise requires custom connectors for custom HR systems, or if you desire to develop your own connectors for apps, or you want an HR driven identity lifecycle capability, then you will need EmpowerID’s Advanced Lifecycle Management module. This includes all the custom connectors that you will need, including the SCIM connector framework, and the ability to connect to out of the box HR systems.

Single Sign-On (SSO) gives you the ability to perform standards-based, federated SSO to applications supporting OATH, OIDC, SAML, or WSFed or WSTrust. It allows users to log in once and to then seamlessly login to other apps without having to know their username or password. SSO also includes basic MultiFactor Authentication (MFA) using OATH or Google Authenticator and simple One-Time-Passwords (OTP) delivered by SMS.

Multi Factor Authentication is for organizations that are serious about their security. MFA allows organizations to use advanced adaptive authentication rules to determine and validate their user’s identity and their risk score based on their device, IP address, and location. It also allows for advanced multifactor options, such as the EmpowerID Mobile Phone App for push-based approval of multifactor logins, RADIUS server and Passwordless WebAuthN.

The Recertification module allows you to evaluate the data in the Identity Warehouse and see who has access to what in external systems. From this, you can then schedule and generate audits. In these scheduled audits, access data is snapshotted and generated as recertification tasks for managers of the people or for owners of roles/applications to assess. These managers or owners can view who has access and can then either recertify or revoke access. The former will stamp approval and access will continue; whereas the latter will, first, revoke that access and, second, trigger the fulfilment process where this access will either be manually or auto removed from the external systems.

Risk Management (SoD) looks at the access data of who has access to what and allow organizations to define policies of which a combination of access will produce a risk to the organization. Such risks should be detected and prevented. Two ways in which SoD works are:

1. SoD detects existing violations from inventoried data and generates violation tasks for the risk owners to mitigate or accept or revoke this risk. When EmpowerID initially inventories your system, it will detect existing SoD risks, such as purchase/authorize rights being assigned to the same user.
2. SoD prevents violation of risk when users are requesting access in the IT shopping cart, i.e. if a user has purchase rights in your organization, then SoD will prevent them from requesting/being granted the entitlements to authorize such purchases.

In such cases, risks will be flagged, and violation tasks generated. Owners can then either approve and accept/mitigate or deny and revoke these risks.

Advanced Risk Management (ASoD) is for those organizations that use SAP or other systems where they need to go below the group or application role level. It allows you to drill-down into the fine-grained permissions, such as SAP TCodes, and if you need to base policies on these fine-grained, lower, transactional levels rather than course-grained, higher, groups and roles levels.

The Policy-Based Access Control (PBAC) Engine is for apps that require an external authorization source. This is where authorization/permissions are going to be managed in a central system. In such cases, the application asks the centralized system what the person has access to in this particular app and, if they can do what they’re attempting to do. For applications that don’t support this, the API Gateway can enforce this policy-based access control decision on their behalf. It does so by intercepting requests, asking the engine if the user has access to the resource they’re requesting, and then enforcing the decision.

The SharePoint Online Access Management module includes the ability to connect to SharePoint Online tenants and Office 365. It allows the inventorying of site collections, sites, SharePoint groups, and the permissions of who has access to what resources across the Cloud SharePoint infrastructure. Via business policies, it also automates the granting and revoking of any access to this environment, provisioning of new sites based on workflow requests, and recertifying who has access to what. ]

With the File Share Access Management module, you can connect to Windows servers and inventory the shared folders. It does not inventory below the shared folders level. For the shared folders level, this module returns all the shared folders and the permissions of which users and groups have access and the permissions they have for recertification and reporting. It also includes the ability to provision new shared folders—including Home folders—and the ability for users to request access to shared folders and, via your own provisioning policy rules, to automate shared folder access.

The Password Vault module provides the ability to vault/store privileged usernames and passwords and to allow admin users to check them out. This includes setting a start to an end time, to see and have the username and password revealed, and have the system check it in at the appropriate time.
You can also:

• Check-in can scramble it to a new password, so that no-one knows that password.
• Set vaulted credentials to change on a rotation basis on all systems automatically, e.g. at 3 am every morning.

The Privileged Session Management module gives you the ability to vault credentials and then associate them with either Windows or Linux computers. The credentials required to access these computers are never revealed to administrators and when checked out, an RDP session with these credentials is initiated. The admin user is then logged in and the start/end times are logged. In addition, these sessions can be recorded and/or monitored real-time, for training, termination, or other purposes.

The Virtual Directory (LDAP) module exposes all connected systems as a single LDAP directory. All LDAP-supporting applications can point to this virtual directory and use a single username and password—in any system—to authenticate the user. Also, groups from any system can control authorization in the app, so you no longer need to synchronize or provision these systems. Users can log in using any person credential username and password, an AD username and password, or any system connected to EmpowerID.
In addition, EmpowerID can enforce multifactor application, as well as translate LDAP requests, such as user creation or add to group, into workflows and then fulfil these requests.

The Application Gateway is placed in front of all apps and APIs to intercept all requests and evaluate all EmpowerID RBAC, ABAC, or PBAC authorization policies to determine if the user is allowed access to the page or API under the current conditions. This module can also enforce Multi-Factor Authentication for access, additional login, as well as enforcing OIDC Federated SSO for any application, including legacy apps that don’t support this on their own.
The Application Gateway is built on Kong, which is a best of breed, lightweight, microservices API gateway and Reverse Proxy, and provides many additional benefits.