1. Introduction 
2. New with Realms  
3. Improve Your Approach to Org Management
4. Before and After
   1. Multiple orgs
   2. Hub and Spoke Model
5. How Do I Get Started? 

Introduction 

Okta’s vision with Universal Directory is to provide a centralized approach to identity management, where customers can integrate any technology stack into a comprehensive, central cloud directory for unified management. In today’s world, unified identity management is becoming increasingly challenging. Organizations rely on a workforce composed of employees, contractors, seasonal workers, and business partners, and adopt complex business structures, with mergers and acquisitions, subsidiaries, regions, divisions, and/or business units. 

IT teams are finding it increasingly challenging to manage these global and heterogeneous users which are sourced in a number of different ways. This complexity can lead to fragmented technology environments, difficulty implementing least privileged access, and slowed workforce productivity that ultimately hinders business growth..

To address these challenges, organizations currently turn to architectures like hub and spoke to segment and delegate management of mutually exclusive user populations. While a hub and spoke architecture offers an effective way to carve out user populations, especially for sufficing regional compliance needs, this can also introduce significant overhead for administrators who are merely looking to segment and delegate management of distinct user populations. Organizations and IT teams need a centralized way to manage all identities and gain visibility into who has access to what applications, in a holistic manner. 

To provide customers with flexibility in modeling identities, Okta is introducing Realms to enable anyone to leverage Universal Directory as a central management plane for unique use cases.  Realms are a new directory construct that introduces flexibility for customers in how they can segment user populations in a single org based on their unique needs. Along with deployment models like hub-and-spoke, Realms will offer customers more choice in how they architect their organizations. 

Realms introduces strict segmentation of populations within an org, providing a streamlined and secure experience for admins who: 

• Manage dynamic organizations with distinct user populations (Ex. Business Units, Acquisitions, Subsidiaries, Divisions)
• Want to delegate administration of distinct user populations to local help desk admins
• Want to increase IT efficiency and reduce the number of user management related tickets coming to central IT teams. 

New with Realms  

Model unique distinct populations within a single org: Using Realms, users can be segmented into mutually exclusive populations within a single org. This provides strict boundaries between segments of users to safeguard user data and to securely delegate management of subsets of the workforce, without duplicating users or policies in distinct orgs. 

Automate realm designation for simplified user onboarding: With new Realm Assignments, users can automatically be added to the correct realm without any admin intervention during user creation. This increases user onboarding agility by automating the onboarding process, which is especially important for large organizations where users originate from HR sources, IDPs, and other directories. 

Delegate user management: By leveraging the Custom Admin Role Framework, flexible “Realm Admins” roles can be created to handle tasks like  password resets, user creation, and application/group assignment within the scope of a realm’s user population.  This allows IT teams to effectively scale and reduces administrative burden on central IT admin teams.  Central IT teams are empowered to delegate daily help desk tasks to local admins for a specific subset of the user population, while minimizing what the admin has access to and preventing over-privileged admins. 

Automate realm management: Workflows allow admins to create, read, update and delete realms automatically, alongside automating user creation and movement between realms.  Workflows provide a way to automate and facilitate repetitive actions, freeing up IT teams and eliminating manual tasks. 

Centralize governance for the entire workforce:  Using Expression Language, Access Certification campaigns and entitlement policies can be scoped to users in a single or in multiple realms. This allows governance to be applied across multiple user populations within a single org, whereas customers leveraging multiple orgs to achieve delegated administration are not able to holistically run campaigns across their entire organization, leading to a piecemeal approach to governance.  

Improve Your Approach to Org Management

Leverage Realms to accelerate your growth and business outcomes by implementing efficient identity management and robust security within a single org. 

Flexible deployment models: You now have the flexibility to choose how you want to architect your org, by leveraging Realms, multiple orgs, or both together. Companies with logical user segmentations and siloed or outsourced IT teams need to give admins access to the Admin Console to take key actions.  However, even with the flexibility of Custom Admin Roles, the scope of access is often too high for these admins. This can push IT teams to turn  to multi-org deployments to segment out user populations.  Realms introduces architectural flexibility in modeling these segments, allowing organizations to delegate out user management related tasks, while the central IT team maintains a single location to manage policies, applications, and governance of the entire user population. 

Centralize Governance: Governance is applied at an org level, resulting in a fragmented governance structure for customers with multiple orgs. By leveraging Realms, a top-level organization admin can pull all users into a hub org with distinct segments.  They can then run campaigns across the entire user population (or a segment of the population), while delegating out remediation actions to designated “Realm Admins”. Global IT admins can view the full results of a campaign across the entire org, without having to manually reconcile results across fragmented orgs or campaigns. 

Accelerate M&A Agility: By leveraging Realms, a top-level organization can efficiently onboard users to provide access to critical applications, while the IT integration strategy and organizational structure are being established. Users can be segmented into their own realm, and administration can be delegated to the acquired company admins, without giving them access to the entire org and Admin Console. The IT admins for the top-level org benefit from an easy and secure way to onboard users and maintain visibility across all application assignments, while still delegating management. 

Optimize IT operations: Businesses can streamline global IT admin tasks by empowering global IT admins to focus on strategy and infrastructure, while delegating daily user management related actions to local help desk admins. This allows organizations to confidently delegate management without compromising visibility or creating siloes. Complex organizations can eliminate user identity fragmentation and consolidate distinct user populations into a single unified view, without creating a burden on global IT teams. 

Before and After

Complex organizations have been structured in a few different ways:

1. Multiple distinct orgs that are not connected
2. Multiple orgs that are connected via Org2Org, often in a hub and spoke model
3. A single org where populations are organized in non-distinct groups

Multiple orgs

Right now, an organization may be set up with employees from different business units or divisions existing in separate orgs. Okta admins have to manage users and app assignments separately for each org. Additionally, users are governed at the org level, and governance cannot span separate orgs. 

With Realms, distinct user populations can exist in mutually exclusive segments within a single org. Realm Admins can then manage users within their realm, without being over privileged. Governance campaigns can be scope to a single realm or extend over multiple realms. 

Hub and Spoke Model

Alternatively, an organization may be set up in a hub and spoke model where partners, subsidiaries or acquisitions exist in spoke orgs. Many or all users may be duplicated into the spoke org for shared application access.  

With Realms, the distinct user populations in the hub org can first be split into realms to segment out the mutually exclusive populations from each spoke org. That way the users can still share application access and policies, but from an administrative perspective, user populations can remain separated. 

That ultimately can enable the long term strategy by making it easy for spoke orgs to be collapsed into the hub org, to minimize duplication of users and overhead across orgs. 

How Do I Get Started? 

Realms will be available as a part of Okta Identity Governance. Check out the product documentation and enable Realms in your org to get started.

Additionally, Realms ties into and leverages many parts of the Okta product offerings. Check out documentation for the following: 

• Universal Directory
• Custom Admin Roles
• Workflows
• Access Certifications
• Entitlement Management