®

UK parliament optimises ActiveDirectory (AD) management
With Active Roles, PDS simplifies Active Directory
management while increasing security and freeing
up time for hybrid cloud migration
Customer:Frees up time to workon strategic migration
projects

Parliamentary Digital Service (PDS)
Industry:
Public Sector – Government
Country:

Automate JML and PAM
to increase protection,efficiency and security

United Kingdom
Website:www.parliament.uk

Handles licensing
challenges for Zoom
conferences during
pandemic

Challenge•

Inefficient management of joiners, movers
and leavers (JML) resulting in hours lostevery month•

Increasing risk by manually controlling
privileged access management (PAM)•Lack of support for hybrid cloud

Drives move to Active
Directory and Azure
Active DirectoryintegrationSolution•

One Identity Active Roles

1CASE

STU DY-PARLIAMENTARYD IGITALS ERV I C E

ONEThe Parliamentary Digital Service (PDS) supports
the UK’s House of Commons and the House ofLords as well as parliamentary staff. Serving
many purposes, PDS supports IT, manages theparliamentary network, develops applications andplans for future technological needs. It also runs theUK Parliament website and social media.
Whilst the crowd of tourists outside the UK
Parliament’s House of Commons or House ofLords may be large, the crowd of cybercriminals
outside the parliamentary network is even larger.
“The security threats are non-stop,” says Cherry
O’Donnell, head of identity and access managementat PDS. “We are a major target, making network
security a top focus.”

I D ENT I T Y“With One Identity Active
Roles we have a clear viewof who has permissions at
any one time as well as inthe past. There is no roomfor error.”Cherry O’Donnell, Head of Identityand Access Management, PDSManaging multiple changes
Keeping a network secure by carefully managing
access is no easy task. For PDS, it’s challenging
because of the number and variety of accounts in
Active Directory (AD).
There are those accounts for the members ofparliament (MPs) and their personnel as well as
the Lords and their employees. Then there are
more than 2,000 permanent parliamentary staff,
and accounts will have to be created or deleted
for the 100 to 200 people who either join or leave
the network each month. In addition, AD groups
will need updating for the many existing network
users who take up new parliamentary positions.
Finally, among the AD groups, there are also theprivileged accounts, which PDS has to control
in order for administrators to gain access tohardware, including servers for tasks like patching.

2Time-consuming tasks
Whether it was managing joiners, movers andleavers (JML) or controlling privileged accessmanagement (PAM), the work in AD was largely
manual. It consumed many hours a month that
the PDS team could have used on strategic
projects. The lack of automation meant a greaterrisk of human error, creating an increased chanceof someone gaining access to something theyshouldn’t. Moreover, the legacy solution for accessmanagement wasn’t optimised for Azure AD and ahybrid solution, featuring on-premises and cloud AD.

ONE

I D ENT I T Y

Saving hours a month on accessmanagement“The hours we save allow
us to press ahead withinitiatives such as replatforming for Active
Roles 7.4.”
Cherry O’Donnell, Head of Identityand Access Management, PDS

PDS engaged One Identity to help enhance
the management and security for a hybrid AD
infrastructure. The organisation had an earlier
version of One Identity Active Roles and wanted
to optimise their solution to take advantage ofthe latest innovations in the product. With thesupport of the One Identity team, PDS began theimprovement process, replacing thousands of lines
of command-line shell and scripting language with
Active Roles leveraging powershell modules andActive Roles workflows. “We had a One Identity
consultant working with us,” comments O’Donnell.
“We all worked really hard on the project anddelivered what we set out to do.”

3JML management in AD is now fully automated,allowing the identity and access management
team to recoup precious time. O’Donnell states,“The hours we save allow us to press ahead withinitiatives such as re-platforming for Active Roles
7.4. Saving hours of time means we can now doimportant work like threat analysis. I’m surprised wefound time to get things done in the past.” There
are no longer emails flying around with requests
for account access when someone new begins
or account termination when someone leaves.
Integrations with human resources (HR) means thatJML data is shared with Active Roles and accounts
are activated or terminated automatically. “Accessto the basic services such as email and OneDrive
are in place when they start. They call us to set
their password and they’re ready to go,” comments
O’Donnell.

Making privileged accessseamless and secure
PDS has also automated PAM, with time limits now
enforced on access to servers for tasks such as
patching. “Once the allocated time for a task is up,
Active Roles automatically removes the permission,”says O’Donnell. “There is no risk of anyone forgetting
to do it.” PDS is moving towards a Zero Trust model
where every administrative action is authenticateduniquely. But for the time being, PAM is easy withadmins requesting permission via a web portal
with dropdown menus. Active Roles generates thepermission unless the work is so sensitive it needs
to be authorised by O’Donnell or another senior
member of PDS.

ONE

Once permission is granted, emails are fired off to thePDS cybersecurity team and the identity and accessmanagement team to ensure there is visibility of anyelevations. Plus, records of access are generated in
Active Roles for auditors to see if required. “With One
Identity Active Roles we have a clear view of who has
permissions at any one time as well as in the past,”
says O’Donnell. “There is no room for error.”

Enabling a powerful response tothe pandemic
With Active Roles, PDS has also enabled the UK
Parliament to respond in an effective way to thepandemic. MPs and government ministers have beenusing Zoom video communications for discussions
and debates. However, with the UK Parliament
holding a finite number of Zoom licenses, PDS needs
to carefully manage access. “We are building a web
form powered by Active Roles,” states O’Donnell.
“The form will give the name and the date of thediscussion or debate and Active Roles then adds theMP or minister to the AD Zoom group. Access is thenrevoked automatically at the end of the day.”I D ENT I T Y

Going complete cloud on accessmanagement
The PDS team is now looking forward to adopting
Active Roles 7.4. “It’s pure cloud aware,” says
O’Donnell. “We’ll be able to create a user in thecloud and give them access to SharePoint and OneDrive all through a single workflow. It’s a true onestop solution.” For O’Donnell, the improvements in
7.4 reflect the customer-centricity of One Identity.
“Technology gives us new opportunities whilst
creating new risks at the same time,” she says. “OneIdentity provides the tools to make the most of thegood while protecting us from the bad. It’s peace ofmind out of the box.”

About One Identity
One Identity, a Quest Software business, letsorganisations implement an identity-centric security
strategy, whether on-prem, in the cloud or in a hybridenvironment. Our uniquely broad and integrated
portfolio of identity management offerings includes
account management, identity governance andadministration and privileged access management.
Learn more at OneIdentity.com.

The One Identity logo is a trademark of One Identity LLC and/or its affiliates. Other trademarks are property of their respective owners. Availabilityand terms of our solutions and services vary by region. This case study is for informational purposes only. One Identity LLC and/or its affiliates makeno warranties—express or implied—in this case study. 2021 Quest Software Inc. All Rights Reserved.

4