One Identity Manager has the reputation of being "the German one" — heavy, stable, deeply configurable, slightly intimidating. After spending months building a 6-phase learning path on it (now public on GitHub), I think that reputation is half right. It is heavy. But once you understand the model, the rest of IGA looks like a thin layer on top of a database.
1. The Object Layer is the whole product
Every other IGA platform tries to hide the data model. One Identity hands you the keys. Tables, columns, foreign keys, triggers — the Object Layer is just a typed wrapper over a SQL database, and once that clicks, every confusing thing about the platform stops being confusing.
Want to know why an entitlement was assigned? Read UNSAccountBInUNSGroupB. Want to know who triggered it? Trace it back through the XOrigin columns. There is nothing hidden. That is rare in enterprise software, and it is the single biggest reason senior engineers like working with it.
2. Designer is unfashionable and excellent
Designer feels like a mid-2000s thick client because it is one. It also lets you edit table definitions, scripts, processes, jobs, and customizations in one place with full version control. I will take that over a "modern" web admin that hides half the model behind a wizard, every single time.
- Schema extensions — add a column, recompile, ship.
- Process scripts — VB.NET, but the surface area is small and very predictable.
- Customizer compile — your custom layer is isolated from base, so upgrades stop being scary.
3. ITShop is the user-facing magic
The Web Designer ITShop is where most users actually meet One Identity. Approval workflows, shopping cart, request history — built right, an ITShop replaces three separate ticketing tools. Built wrong, it becomes the place tickets go to die. The difference is almost always in how you model the service items: granular enough to be meaningful, coarse enough that humans can choose without a glossary.
4. The certification you are working toward matters
IM-IC (configuration) and IM-WD (web designer) are the two that actually move the career needle. IM-IC proves you can implement and extend the platform. IM-WD proves you can ship the user-facing portal. Most engineers stop at IM-IC. The ones who do both end up leading IAM tracks at large enterprises.
One Identity rewards depth. The platform is wide enough that you can stay shallow forever — but every shop I have seen is desperate for engineers who actually understand the Object Layer.
5. When I would pick One Identity over SailPoint
- You already run on SQL Server and want everything in one stack.
- Your governance requirements are heavily on-prem or hybrid, not cloud-native.
- You need deep, custom data modeling — not just RBAC + certifications.
- You have engineers who like reading the schema and dislike SaaS abstractions.
If you are starting today
Spin up a lab VM, install IM, and follow the official AD connector tutorial end-to-end. Then open Designer and read the Person table. Read every column. That single exercise teaches more than two days of training videos. Once you can predict what each column does, you are 60% of the way to IM-IC.
One Identity is not a flashy product. It is a serious one. If your career is heading toward enterprise IGA, going deep on it is one of the best investments you can make right now.