CUSTOMER STORY

Mobile Enterprise Takes Legacy On-Premise Applications to theCloud for Rapid Provisioning and Anytime, Anywhere Access“The tight integration of OneLogin’s cloud directory for SaaS
apps and OneLogin WAM for our on-premise applications
makes accessing the tools our employees need easier… while
securing all of our apps with multi-factor authentication.”
Scott Underhill

INDUSTRY
Mobile Enterprise Management

IT MANAGER, SOTI

SIZEOver 700 users in 12 countries

Rapid business growth was a double-edged sword for mobile
enterprise management vendor SOTI Inc. Between onboarding
many new hires and the proliferation of SaaS business apps,
the strains on IT and employees alike were starting to show.
Obtaining, managing and maintaining access presented
productivity and security challenges.

CHALLENGES
SOTI had doubled the number of employees in just three years, and each
Friday the IT team spent hours preparing new user onboarding for the

CLOUD APPS
Office 365, Workday,Salesforce, Adobe, Citrix,
Basecamp, GoToMeeting

CHALLENGES
Remote access with MFA
to cloud apps and internal
web apps
Offboarding security
Rapid growth raised need for
efficient new hire onboarding

coming Monday. And with turnover in any organization, ensuring former
employees no longer had access to company apps was a continuing

SOLUTION

headache and growing risk.

Concern with maintaining ADFS
on-premise infrastructure“Single sign-on (SSO) gives you the ability to manage all the users,

Ease of integration, using
SAML for multiple apps

including their user names and passwords, through one single pane ofglass. It was also important to provide a single web page for users tologin to their apps. While it started with SSO and identity management,
we also needed to reduce the time to set up new hires. And if somebody

WAM for legacy, on-preminternal web apps
OneLogin partnership based onneeds, growth and support

left or was terminated, we did not know which applications they had, if
they still had access, or the risk associated with that uncertainty. So that’sRESULTS

all part of identity management: gaining efficiencies and managing risk

User access and productivity
vastly improved

for user onboarding as well as offboarding,” says Mustafa Ebadi, Vice
President of IT and Services at SOTI.

On- and off-board in minutes,
instead of hours
App availability, awarenessfrom anywhere“We looked for a solution that was easy to configure, maintain andsupport,” adds Ebadi. OneLogin has thousands of pre-integrated apps,including the main ones SOTI relies on: Office 365, Workday, Salesforce,
Adobe and more.
Internal custom web apps
In addition to SaaS apps, SOTI needed to provide access to internal“With an IAM provider,

web apps—such as inventory and feature request, billing apps,

they are taking care ofand dashboards—to employees, both internal and external to theresponsibility for all the backcorporate network. SOTI had a password policy requiring multi-factor
authentication (MFA), so any solution it chose would need to support

end. If there are any issues

that as well.

or support needed, theytake care of it.”

SOLUTION
SOTI evaluated whether to continue with Active Directory FederationServices (ADFS), supporting it themselves on-premise or to select acloud identity and access management (IAM) vendor.
Cloud over ADFS
“We’re a very forward-thinking company, and as part of our strategy weseek to leverage cloud as much as possible; ADFS would have requiredme to have a server in-house. ADFS requires consistent management,
maintenance and support, and if there are issues or it goes down, we
have to take care of it. Finding system admins to do all this isn’t easy,
since they are in high demand,” says Ebadi“Instead, with an IAM provider, they are taking care of responsibility for
all the back end. If there are any issues or support needed, they take careof it. Compare that to the cost of resources, commitments and support
hours. There’s a day and night difference when you are actually doing itonline versus traditional ADFS,” continues Ebadi.
Partnership“In evaluating IAM providers, the whole experience with OneLogin
was around partnership, rather than them trying to sell me something.
OneLogin was focused on understanding my business needs, and how
they can solve those business needs. I decided to give OneLogin a try,and I’m happy that I did, because it has really helped us a lot and there iscontinuous improvement that I can see,” states Ebadi.
“There are significant indirect cost savings around your IT department
when they’re doing onboarding and offboarding. For a company of ournature where we’re growing so rapidly—we have doubled our users in
the last three years—because every time there’s a new hire, we’re reallysaving on that. And from an IT perspective, it was more around improving
the user experience and security,” states Ebadi

O N E LO G I N . C O M

HR-Driven Identity with Workday
SOTI takes an HR-driven approach to identity management, allowing IT
to leverage the immediacy of HR’s employee knowledge to streamline
application access security. When an employee joins SOTI, HR enterstheir data into Workday and drops their user ID into different OneLoginsecurity groups. Powered by OneLogin, Workday syncs user attributes
between the two systems in real time, which then gives the employee
SSO access to the appropriate applications and permissions.
“The way we’ve built our provisioning is when a new hire is entered in“Our technical people

the Workday system, it triggers different levels of access to applications.

do nothing to create or

It’s very safe, it’s very secure,” explains Ebadi. He adds, “Our technicalpeople do nothing to create or provision accounts. We’ve automated itall. OneLogin is a very central piece to that.”

provision accounts.
We’ve automated it all.
OneLogin is a very

WAM for Custom Web Apps
OneLogin was able to help SOTI install OneLogin Web Access
Management (WAM) with a web agent in Microsoft Internet Information
Server (IIS), configuring it as a reverse proxy, so it could pass requests
through IIS as a gateway to backend servers hosting internal custom
web apps. SOTI was able to wire up and configure WAM, using OneLogincloud as an identity provider, instead of doing local authentication
against an Active Directory or LDAP server.
“Whether you access OneLogin internally or externally, you get the sameuser experience wherever you are in the world. The tight integration of
OneLogin’s cloud directory for SaaS apps and OneLogin WAM for ouron-premise applications makes accessing the tools our employees needeasier, enabling us to have a more efficient and effective workforce while
reducing process overhead for our IT department. And it does so while
securing all of our apps with multi-factor authentication,” says ScottUnderhill, IT Manager with SOTI.

Figure 1: SOTI user access to on-premise, custom apps enabled via OneLogincloud directory, MFA and WAM

O N E LO G I N . C O M

central piece to that.”

RESULTS“OneLogin has been a huge success for SOTI overall. Users now have asingle place to access all their applications, and don’t have to worry about
remembering passwords. IT efficiency has improved significantly—we can
now onboard and offboard a user within minutes instead of hours. With anaverage of 10 to 12 people starting a month, that’s a lot of hours that we aresaving,” says Ebadi.
User Feedback
The newfound ability for employees to access all applications with SSO,

“As head of IT, what I

and not just in the office, but at home or while away on business as well,like about OneLogin is, I

is a great productivity advantage for SOTI. In addition to SSO and remote
access, user education is a real bonus.
“Many of our users did not know what applications were available insideor outside of the firewall. I had one user come in and say, ‘I can’t believethat I haven’t used VPN in such a long time, because I can do all my workby just using OneLogin.’ Our success and expansion with OneLogin is atestament to its convenience, as well as the efficiency and effectiveness,
not only for the IT team, but for our users,” says Ebadi.
WAM Results“We can expose internal apps safely with MFA without having to change
any code in the app. We now have over 15 apps published. Also by using
the proxy we can offload SSL if the app is not setup for SSL. We areusing IIS as our reverse proxy server, as we have PHP, Java and .NETapps, and some are legacy and use different protocols and languages.
With the integration of IIS, we’re able to separate that, and use existingauthentication but still secure it from the outside, so we don’t have torewrite our apps, even if they are legacy apps,” says Underhill.
Perspective“As head of IT, what I like about OneLogin is, I don’t have to think about
identity management anymore. I know if a user was terminated or left,
I don’t have to worry whether we shut down all the accounts. As a user,
I can see all my applications at a glance, it’s secure and I can access it
anytime I want. I don’t have to carry around my laptop any more or worry
about my access or VPN if I need to do something while I’m out or on theweekend. As a user, that’s the beauty of it for me, and I absolutely loveit,” observes Ebadi.

O N E LO G I N . C O M

don’t have to think about
identity management
anymore...As a user, that’s
the beauty of it for me, andI absolutely love it,”

About SOTI Inc.
For almost two decades, SOTI has been the mobile enterprise industry
leader in delivering solutions to manage, secure, and support computing
devices and businesses. Over 17,000 customers around the world, in
retail, manufacturing, healthcare, government, logistics, and many otherindustries rely on SOTI for their mobility management needs.

About OneLogin, Inc
OneLogin brings speed and integrity to the modern enterprise with anaward-winning single sign-on and identity management platform. Our
portfolio of solutions secure connections across all users, all devices
and every application, helping enterprises drive new levels of businessintegrity and operational velocity across their entire app portfolios.

O N E LO G I N . C O M