CASE STUDYKey Facts
Company

Radboud University

Industry

HigherEducation

University cuts enrollment timeby 50 percent
Radboud University boosts agility, cuts costs andpositions itself for the future with effective identity andaccess management

Country

The Netherlands

Employees

40,000Websitewww.ru.nl
Challenges
To improve business agility,
enhance security and control
costs, Radboud University
needed effective identity
management and governance.
Results• Enabled quick response tochanging legal requirements andnew technologies• Delivered both provisioning andgovernance in a single solution• Reduced enrollment time by 50percent, from 2–3 days to justone• Simplified governance bymerging multiple roles into asingle identity

Products
Identity and access management

Radboud University is one of the leading academic communities in theNetherlands, with 19,000 students enrolled in more than 100 study
programmes. In addition, the university is home to several research
institutions and is affiliated with one of the largest academic hospitals in thecountry. For help in managing the number and complexity of user personas,
as well as controlling access to sensitive data, Radboud turned to thesoftware team.

Managing a large, constantly and rapidly changing user
population of over 45,000
Radboud University has a very large user base to manage. In addition
to 3,500 faculty and 20,000 students, the university hosts over 25,000
external users, including alumni, people who work at the academic hospitaland researchers from abroad — a total of 45,000 to 50,000 users that must

“Identity Manager differentiated itself from othersolutions due to its completeness — it allowed asingle product to tackle all of the issues we face, onboth a provisioning level and a governance level."
Jos Groenewegen, Senior Manager, Radboud University

be managed on a day-today basis. Moreover, the user
population changes constantly.
For example, a guest researcher
might require access for justa few days, and some students
might enroll only for one monthlong class. And sometimes, manychanges must be made quickly,
such as when 5,000 graduates
become alumni on one day, or5,000 new students must beenrolled in a week at thebeginning of an academic year.
Unfortunately, the university wasfinding it difficult to manage allthese users with its previous Sun
Microsystems IDM solution. WhenSun was acquired by Oracle andthe solution was scheduled to bediscontinued, Radboud University
began looking for an alternative.

Ensuring appropriate
access avoids a potential
loss of millions“Our biggest driver was ensuring
all of our business processes
run properly,” explains Jos
Groenewegen, senior manager atRadboud University. “For example,

we needed to ensure that student
enrollment runs without any
problems, and that researchers
who come here have swift accessto everything that they need.
Because the university handles agreat deal of sensitive
information, including personal
information, bank accountinformation and researchdata, Radboud was particularly
concerned to ensure that users
have exactly the appropriate
access throughout their timeat the university. “With our oldsolution, when somebody left theuniversity, our systems wouldbe updated,” says Groenewegen.
“But when someone changed roles
within our organization — such as
by moving from one department
to another — they retained
authorization for things that theyshouldn’t have according to their
new role, and slowly gained more
entitlements as well.”This “entitlement creep” meantserious risks to the university’s
reputation, which, in turn,
could lead to financial impacts.
“Students want to be sure that

Quest, and the Quest logo are trademarks of Quest Software Inc. Other trademarks and trade
names may be used in this document to refer to either the entities claiming the marks and namesor their products. Quest disclaims any proprietary interest in the marks and names of others.
Availability and terms of Quest Software, Solutions and Services vary by region. This case study is for
informational purposes only. Quest makes no warranties – express or implied—in this case study.

their data is stored securely andnot accessible to anyone who is
not allowed to see it,” explains
Wopke Veenstra, information
manager at Radboud University.
“If incidents of inappropriate
access happen, that would
severely damage our reputation,and students and their parents
could choose other universities.
If 1,000 students were to makeanother choice, that would cost us
millions. We needed to enhance
the security of file system data.”
Ensuring appropriate access wasparticularly complex for Radboud
because a number of individuals
have multiple roles at theuniversity. “Some of ourstudents go on to become
researchers. At that point,
they may be both alumni andfaculty,” says Groenewegen.
“Similarly, someone who works
in administration may also be astudent. We don’t want to send
those people the same letter
twice, or bother them with detailsof having to manage multiple
accounts or entities. We wantto engage each of them as one
person, regardless of all thedifferent roles they have.”

Completeness of solution
critical to Radboud’s choice
With these requirements inmind, Radboud University beganevaluating the identity andaccess management solutions
available on the market, and also
looking for a partner to help withimplementation.
“Identity Manager stood out for us
because it was able to handle ourbroad infrastructure — not just
Windows-centric, but open-sourceand home-built software could be
integrated into Identity Manager,”recalls Groenewegen. “Plus, theyalso has strong partners here in
the Netherlands, giving us further
confidence that we’d be able toimplement it swiftly and withinbudget.”
The partner Radboud chose was
Intragen, a consultancy
specializing in identity and accessmanagement. “Intragen took thetime to get a good understandingof our institution and how IAM ismodeled within our institution,”notes Groenewegen. “Theywere able to quickly show how ourinstitution’s data model would fit
within Identity Manager, and how
the way we view information andprocesses within the organization
could be managed through thesolution.”
This comprehensive approach wascritical to Radboud’s choice ofIdentity Manager and Intragen.
“Identity Manager differentiateditself from other solutions due
to its completeness — it alloweda single product to tackle allof the issues we face, on botha provisioning level and agovernance level,” Groenewegenexplains. “We can’t just say,‘we’re provisioning an identity andwe hope governance will be set
up in a proper way.’ We needsolid provisioning to be able
to handle more governance.
And with that governance, wecan offer the security that ourbusiness demands.”

them, which reduces securityrisks.”

Gaining governancecontrol without impacting
thousands of users

Radboud can now identify andquickly address any security
concerns that arise. “Radboud
University is more secure because
we know who has access to what,”says Groenewegen. “But nomatter how perfect you makeyour system, something canalways go wrong. With Identity
Manager, we’re able to monitor
any discrepancies between who
has access and who should haveaccess, and to tackle those issues
efficiently and swiftly.”

With Intragen’s help, Radboud
was able to implement Identity
Manager smoothly, minimizing
disruption for users. “Because theaccessibility of Identity Manager,
we were able to handle any
challenge that came up during
or after the migration smoothlyand effectively within a matter ofhours, without greatly interferingwith any user experience,” says
Groenewegen.
“The most important thing wasthat people wouldn’t suddenly
be unable to do things they had
been able to do for years,” adds
Groenewegen. Some of thoserights might have to change
due to governance, but wewanted to change those in acontrolled manner. With Identity
Manager, we have the tools toensure a slow transformation
where we gain the control weneed as an institution without
hampering the daily work of thethousands of users.”
Improved security protects
the university’s reputation
With Identity Manager in place,
Radboud can now prevent
entitlement creep by ensuringthat each user has exactly theappropriate rights at any
given time. “Identity Manager
helps us mitigate risks in several
ways,” Groenewegen explains.
“First, Identity Manager ensurespeople don’t have access tosystems any longer than theyneed to. When a person changes
roles within the organization,
their privileges diminish or growaccordingly. Second, because
Identity Manager enables
processes to run smoothly, ourusers work well with the security
controls and don’t try to avoid

Quest, and the Quest logo are trademarks of Quest Software Inc. Other trademarks and trade
names may be used in this document to refer to either the entities claiming the marks and namesor their products. Quest disclaims any proprietary interest in the marks and names of others.
Availability and terms of Quest Software, Solutions and Services vary by region. This case study is for
informational purposes only. Quest makes no warranties – express or implied—in this case study.

Having proper control over accesshelps protect the university’s
reputation and its financial
bottom line. “Not only has
Radboud addressed some of thecore business challenges they’ve
had around security with Identity
Manager, but they’re being
proactive,” comments Ian Yoxall,director at Intragen. “There havebeen some incidents of data leaks
in Dutch universities, which havecaused considerable reputational
damage to those institutions.
Using Identity Manager forsecurity, Radboud is maintaining
its international reputation as amarket-leading university.”
Unifying identities
improves the user
experience
By modelling entitlements
and unifying user identities
with Identity Manger, Radboud
University has been able toimprove the user experience
for its broad user base as well.
“Radboud has modelled all theentitlements of all users — nomatter whether they’re a student
or a staff member or an external,”
explains Yoxall. “They’ve used
Identity Manager to create amaster identity whereby they cansee each sub-identity and how
everything fits together.”This comprehensive identity andaccess management enables theuniversity to deliver a far better
user experience. “With our oldsolution, a researcher would
get roughly the same emails
as a student. Now we can offer
everyone a far more personalized
experience by providing each
person with the information that’srelevant for them, instead ofthem having to sift through a lotof email to find what they actuallyneed to know,” explains
Groenewegen. “Similarly, wecan give each user one ID cardthat gives them access to every
building allowed by any of theirroles.”Enrollment done in one day
versus three, plus selfservice
With Identity Manager, Radboud
University has been able to cut
the time required to provision anew user in half. “Processes that
previously had to be done on anightly basis can now be done ona near real-time basis, so we’vebeen able to decrease enrollment
time by about 50 percent, fromtwo or three days to a single day,”reports Groenewegen. “Plus, thehelp desk can fix issues for users
immediately.”
Identity Manager’s self-service
capabilities further streamline
processes for users. “Users areable to quickly request the accessthat they need, and to change
their own personal data any place,
any time, without having to be
restricted to office hours or tocampus,” Groenewegen says. For
example, if a student requires anemail alias to do some specificresearch, and if the alias meets
certain naming conventions,
he can create it on the spot andstart using it for his research
instead of having to go through acomplex bureaucratic process.”

In addition to improving user
satisfaction, these featuresof Identity Manager have also
reduced IT workload. “With ourprevious system, we couldn’t
cope with the amount of changethat was needed without
greatly increasing staff,” notes
Groenewegen. “Now, with IdentityManager, we’re able to tackle
change management issues as
quickly as we need to.”

Unifying identities
improves the userexperience
By modelling entitlements
and unifying user identities
with Identity Manger, Radboud
University has been able toimprove the user experience
for its broad user base as well.
“Radboud has modelled all theentitlements of all users — nomatter whether they’re a student
or a staff member or an external,”
explains Yoxall. “They’ve used
Identity Manager to create amaster identity whereby they cansee each sub-identity and howeverything fits together.”

About One Identity
The One Identity family of identityand access management (IAM)
solutions, offers IAM for the realworld including business-centric,
modular and integrated, andfuture-ready solutions for identity
governance, access management,
and privileged management.
Learn more at OneIdentity.com

Quest, and the Quest logo are trademarks of Quest Software Inc. Other trademarks and tradenames
may beused
thisIdentity
documentrefer
to either oftheentities
claiming
the marks
and names
One Identity
andtheinOne
logotoaretrademarks
OneIdentity
LLC. Other
trademarks
orproducts.
Quest
disclaims
any proprietaryin theand names
others. andaretheirpropertyof theirrespectiveowners.
Availabilityinterestand termsof marks
One Identity
LLC, ofSolutions
Availability
andby
terms
of Quest
Software,Solutionsand Services
vary byonly.
region.
case LLC
study
is forServices varyregion.
This casestudy isfor informational
purposes
OneThisIdentity
makes
informational
Quest makes
warranties– 2016
express
orIdentity
implied—in
thiscase Reserved.
study.
no warrantiespurposes– expressonly.
or implied—in
thisnocasestudy. ©
One
LLC. All
Rights