The Total Economic Impact™ Of Microsoft Entra

VENDOR CONSOLIDATION AND IDENTITY MODERNIZATION

• Evidence and data.

  Interviewees’ organizations looked to reduce the cost and complexity of their IAM infrastructures, which (in the prior states) typically included a legacy on-premises presence and SaaS-based point solutions. With Microsoft Entra, interviewees’ organizations could sunset their legacy IAM infrastructures including the physical and proxy servers as well as previous identity-as-a-service (IDaaS) solutions because Azure AD now manages and secures authentication for all applications including non-Microsoft apps. Moving from a point-solution-integration approach to Microsoft Entra lowered license costs for interviewees’ organizations. For those that already had Microsoft 365 E5 licenses, the savings were often significant if considered a sunk cost for the business case. Interviewees shared the following examples of how their organizations reduced license costs:

  • The identity and access team lead at a software company told Forrester that after their organization replaced its legacy on-premises IAM solution, it saved $200,000 to $250,000 annually in human capital costs from managing the associated infrastructure.
  • The principal IT engineer at a semiconductor organization said that before using Microsoft Entra, their company relied on a third-party MFA solution that cost more than $1 million dollars a year. The organization also relied on a separate point solution for onboarding new external accounts, which proved costly as well. Once the organization implemented Azure AD, it sunset both tools. The interviewee said: “Again, just like MFA, Microsoft is offering this [as a part of the Microsoft 365 E5 license] up to a point. So, there’s a strong financial driver for switching.”
  • Similarly, the director of solutions architecture at an insurance company said that prior to using Microsoft Entra, their organization previously bought multiple tools to manage employee identities and authentication. With Azure AD, the organization reevaluated its approach and made a “replace list” of identity tools that it is replacing with Microsoft Entra products. The interviewee said, “We can definitely [save] millions of dollars per year [as] we get rid of prior tools and leverage Azure AD.” At the time of the interview, the organization was also going through the process of closing down its legacy on-premises environment, which decision-makers expected to deliver significant savings in infrastructure and operational costs.

• Modeling and assumptions.

  For the composite organization, Forrester assumes:

  • Microsoft Entra license costs are at parity with the license cost of its prior point solution.
  • The legacy IAM solution leveraged seven physical servers, five of which were due for replacement in Year 1 and two of which were due for replacement in Year 2. Moving to Azure AD eliminates the need to replace these servers.
  • The composite organization reassigns one full-time employee (FTE) responsible for managing IAM-related, on-premises infrastructure.

• Risks.

  The following factors may affect the magnitude of this benefit and are reflected in the risk-adjustment percentage:

  • The number of servers associated with the legacy on-premises infrastructure.
  • Annual costs related to legacy IAM software and solutions.
  • The speed at which the organization is able to sunset legacy infrastructure.
  • Whether or not the company already has Microsoft 365 E5 licenses and considers that to be a sunk cost, which would affect the savings associated with prior-license spend.

• Results.

  To account for these risks, Forrester adjusted this benefit downward by 10%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $2.1 million

IDENTITY TEAM EFFICIENCY GAINS

• Evidence and data.

  Interviewees said their organizations spent a significant amount of resources on management and maintenance of their previous IAM solutions, and that this left little time for projects that could further strengthen security postures or improve user experiences. In addition to managing IAM solutions, the organizations also struggled to manage permissions for their multicloud environments. The head of enterprise security architecture at an insurance company said, “Previously it was a dump of who was using what permissions, and it was up to the manager to decide whether it was good or bad.”

  By migrating to Azure AD, the organizations were able to leverage the benefits of a modern and comprehensive cloud solution, which freed time for their dedicated IAM teams to focus on adding value to the businesses, and even reallocating some workers to other teams that needed additional resources.

  • Interviewees’ organizations reduced the number of FTEs required to manage their respective environments. Because the organizations eliminated on-premises infrastructures and reduced the number of point solutions, they no longer needed to dedicate as much talent to IAM solutions management and could dedicate these FTEs to more strategic IAM initiatives and to improving employee experiences.
  • A senior security engineer in the software industry said their organization revamped its provisioning model with Azure AD. They said: “During the [COVID-19] pandemic, it became vitally important that we implement self-provisioning. We sent people laptops and they could sign into them, and that was a great win.” This change allowed the organization to free three FTEs per region from provisioning devices on behalf of the users. It also meant end users could get their devices sooner and did not lose productive time waiting for their devices to be provisioned.
  • The identity and access team lead at another software company said their organization had several compliance regimens that required gathering evidence for audits at least four times per year. This collection was a cumbersome process both for the tech-compliance team and for the people who collected that evidence. With Azure AD, all of the identities and access management approval workflows became accessible in one system. The team lead said: “There were five operational teams spread across the company that were responsible for various identity workflows. Now, we have been able to centralize almost all of it to a single ops team.”
  • The head of enterprise security architecture in the insurance industry said that before using Microsoft Entra, their company was overwhelmed with managing permissions and had to hire outside consultants to supplement its IAM team. Although the organization spent millions of dollars investing in consultant labor, it still lacked full visibility into permissions, automation, and true multicloud expertise. After adopting Microsoft Entra Permissions Management and over the course of six months to one year, the company terminated all external contracts and hired internal employees. The interviewee said: “Overall, about 70-plus consultants [were] replaced by 11 full-time employees and the tooling we have. Eventually, we saved $6 million to $7 million dollars [in] the process over the course of two and a half years.”

• Modeling and assumptions.

  For the composite organization, Forrester assumes:

  • Before the Azure AD investment, the IAM team consisted of 10 FTEs.
  • Three FTEs who previously focused on onboarding, offboarding, and provisioning are reallocated to other, value-add tasks.
  • One FTE who previously performed general maintenance activities in the legacy IAM environment is reallocated to other, value-add tasks.
  • One FTE who previously performed compliance activities is reassigned
  • The composite organization adopts Permissions Management in Year 1. As a result, in Year 2, the composite organization eliminates 50% of contractor resources and fully terminates them in Year 3.

• Risks.

  The following factors may affect the magnitude of this benefit and are reflected in the risk-adjustment percentage:

  • The size of the organization’s IAM team before investing in Azure AD.
  • The organization’s commitment to reevaluate current systems and workflows and adopt Azure AD.
  • The need for external resources to manage permissions in the multicloud environment.

• Results.

  To account for these risks, Forrester adjusted this benefit downward by 10%, yielding a three-year, risk-adjusted total PV of $3.3 million.

IMPROVED SECURITY POSTURE

• Evidence and data.

  Interviewees told Forrester that improving security posture was among the top drivers for their organizations’ investments in Microsoft Entra. According to Forrester research, 20% of external attacks are carried out with the use of weak or stolen credentials.³ Additionally, Microsoft research says it sees 1,287 password attacks every second (i.e., more than 111 million per day), and that in 2022, it saw 5.8 billion password breach replay attacks per month, 31 million phishing attacks per month, and 5 million password spray attacks per month.⁴

  Interviewees said that by securing all applications with Azure AD, their organizations were able to improve visibility, implement granular risk-based policies to ensure that employees only had access to the applications that they need, and — through MFA — proactively protect against phishing, credential stuffing, and other techniques that exploit compromised user credentials.

  Interviewees shared the following examples of how their organizations’ security postures improved:

  • The director of solutions architecture at an insurance company told Forrester that, with Azure AD, their organization is more secure. Before using Azure AD, security logs from the legacy IAM solutions were either nonexistent or ineffectual regarding any real impact to organizational security. The director said: “Now we have all the guardrails in place [so] that people can’t do what I’ll say [are] silly things. We’re definitely more secure now as far as breaches go. Where it’s helped is the logging and understanding of what’s happening in the tenant. The visibility is way better than anything we’ve ever had with on-prem.”
  • The principal IT engineer at a semiconductor company described how Conditional Access was an important component to protect organizational assets. They said: “Today, we use phishing-resistant credentials, and they are extremely attractive to the security-minded folks like me because they provide a good user experience but also deliver high-level security for us. We also heavily rely on Conditional Access. And I would put that at the top of the list.”
  • Some interviewees said that beyond SSO and MFA, their organizations had started on their journeys to passwordless authentication. More than two-thirds of security decision-makers in a Forrester survey reported that their organizations are currently adopting passwordless authentication for the workforce.⁵ While security professionals try to minimize security risks by encouraging employees to use strong passwords, this approach does not seem sufficient to prevent current cybersecurity threats. According to a 2022 report, more than 80% of web-application breaches are attributed to stolen credentials.⁶ By no longer requiring users to enter passwords, organizations can reduce the risk of a security incident.
  • Microsoft Entra Permissions Management enabled interviewees’ organizations to rightsize permissions and manage identities across multiple clouds, which also contributed to improved security. The multicloud visibility enabled by Permissions Management helped IAM teams see how many permissions employees were granted and whether this access was necessary for their roles across Microsoft Azure, Amazon Web Services (AWS), and Google Cloud. The head of enterprise security architecture at an insurance company said: “Before, developers asked for super user access so that they could do their job and … didn’t have to come back to the security team again, but that introduced a lot of risk. They were doing it with good intent, but it caused security challenges.” With Microsoft Entra Permissions Management, the organization restricted developers’ privileges and automated an on-demand, time-bound permission request that would allow users to get access and troubleshoot an issue if there is an emergency.
    
    The same interviewee also said that using Microsoft Entra Permissions Management in conjunction with Azure AD allowed their organization to become more secure while dedicating fewer resources to the IAM activities due to automations available in the tool. They said: “Without Microsoft Entra Permissions Management, the security was a nightmare for us. Security is never a done deal, but now we can focus on many other areas [such as] enhancing our DNS security, web posture, and all. Previously, all our time was spent on identity, access, [and] provisioning. Now, we [can] get out of it and focus on other weak links where we can invest.”

• Modeling and assumptions.

  For the composite organization, Forrester assumes:

  • Before using Microsoft Entra, the composite organization experienced an annual average of 3.1 material security breaches at an average per-breach cost of $750,000.⁷
  • After completing the Microsoft Entra deployment, the composite organization reduces its likelihood of a breach by 15% in Year 1 and by 20% in Years 2 and 3, compared to the prior state.
  • Breaches negatively impact 33% of the composite’s 10,000 total employees at a time, and the average breach-related downtime is four hours.
  • The average employee’s fully burdened hourly rate (i.e., including salary, benefits, and payroll taxes) is $40.

• Risks.

  The size of the benefit can vary based on:

  • The prior frequency of breaches and the total cost of a breach.
  • The Microsoft Entra products implemented and the organization’s maturity as it relates to threat detection and remediation.
  • The number of employees affected by a breach and their average fully burdened rates.

• Results.

  To account for these risks, Forrester adjusted this benefit downward by 15%, yielding a three-year, risk-adjusted total PV of $1.5 million.

IMPROVED DEVELOPMENT VELOCITY

• Evidence and data.

  Developer experience as well as the balance between security and inefficiencies in the development process were top of mind for interviewees. They said that when their organizations tightened security components and obligated developers to request permissions every time they needed new access, this tended to have a negative impact on product-development speed. A developer’s work on a project could get interrupted by up to several days while the developer was waiting for access, and any project as a whole could get delayed by weeks or even months as those interruptions added up.

  Security teams have a difficult task and are often viewed as a department that sets obstacles for the rest of the business, and changing this perception can be challenging. According to the interviewees, enabling Microsoft Entra Permissions Management was an “aha” moment because it produced a tangible improvement in security team members’ experiences as well.

  • The head of enterprise security architecture at an insurance organization said: “Every three weeks, a developer probably made a request two to three times and had to wait on average 48 hours to get permission. With hundreds of developers, it added up, and product development could get delayed by even a quarter or so.”
  • The company relied on Microsoft Entra Permissions Management with its permission on-demand feature, which allows users to request just-in-time and just-enough access for cloud resources without accumulating standing privileges to automate the on-demand permissions requests. The interviewee said, “What previously took two to three days is right now handled in a couple of hours at most.”
  • Interviewees said another aspect that benefits developers is that Azure AD is built around well-defined standards, and that allowed developers to integrate with Azure AD without having to worry about proprietary APIs or protocols. The principal IT engineer at a semiconductor company said: “With our legacy on-premises IAM solution, we had all sorts of proprietary protocols that were less documented and were hard to work with, whereas Azure AD is very much documented. So, if you want to build something that integrates with Azure AD, it’s not hard to find documentation out there to help you through that.”

• Modeling and assumptions.

  For the composite organization, Forrester assumes:

  • The composite organization has 1,000 developers, and 70% of them build for the cloud.
  • A developer makes one access request per two-week sprint, and before Microsoft Entra Permissions Management set up automations, it took two business days to receive permissions.
  • With Microsoft Entra Permissions Management, wait time is reduced by 90% for permissions on demand requests.
  • The composite organization takes advantage of Permissions Management capabilities in Year 2 and continues to use the product in Year 3.
  • While developers wait for necessary access, they pivot to work on other tasks and projects, but they lose 10% of productivity because their workflows are disrupted.
  • Developers do not take advantage of all the time that is saved via faster permissions, so Forrester applied a 50% productivity recapture. This means employees leverage 50% of the total time saved for productive work.

• Risks.

  The size of the benefit can vary based on:

  • The organization’s previous approach to granting permissions to developers.
  • The organization’s commitment to building automations to simplify the process for granting access.
  • The average fully burdened rate of developers.

• Results.

  To account for these risks and because developer productivity may be viewed as a softer benefit, Forrester adjusted this benefit downward by 20%, yielding a three-year, risk-adjusted total PV of $922,400.

IMPROVED HELP DESK EFFICIENCY FROM REDUCED PASSWORD RESETS

• Evidence and data.

  Interviewees said their organizations’ previous IAM solutions were not set up to support self-service password resets. Because of this, the organizations received thousands of requests per month to assist with password resets, and each of them was routed through the help desk. Each ticket represented a set amount of time for the help desk worker to resolve the issue, but it also meant that an end user was locked out of certain applications while the ticket was being resolved.

  After deploying Azure AD, interviewees’ organizations could take advantage of the self-service capabilities for password resets and significantly reduced the number of password reset requests that made it to the help desk. This self-service capability also aligned better with end users’ expectations because self-service password resets are so prevalent in consumer-facing websites and applications.

  • The director of solutions architecture at an insurance company said: “Generally, if your passwords [were] locked out, you could not do anything. Now, you just go to the portal and reset it yourself and [the] job [is] done. With Azure AD, the number of requests the help desk gets has [been] significantly reduced."
  • Several interviewees’ organizations started to work on transitioning to passwordless authentication and, in time, they expect to eliminate the majority of password-reset requests.

• Modeling and assumptions.

  For the composite organization, Forrester assumes:

  • The help desk receives an average of 500 password reset requests per month before investing in Azure AD.
  • In Year 1, the number of requests decreases by 75%, and this remains stable for the subsequent years.
  • The average cost for a password reset request is $25.

• Risks.

  The size of the benefit can vary based on:

  • The number of password reset requests the organization received with its previous IAM solution.
  • The average cost per password reset request
  • The adoption and use of the self-service tool.

• Results.

  To account for these risks, Forrester adjusted this benefit downward by 10%, yielding a three-year, risk-adjusted total PV of $251,800.

END-USER PRODUCTIVITY IMPROVEMENT

• Evidence and data.

  In addition to enhancing security, all of the interviewees’ organizations were looking to improve their employee experiences. According to Forrester research from 2022, 60% of business and technology professionals indicated that improving the experience of employees was a key IT objective during the next 12 months.⁸ Relatedly, interviewees said that a primary goal for their organizations was to improve user experience (UX) by enabling SSO for all applications and from any device or location. Interviewees recognized that users who did not have to enter their credentials at every step were more productive and that a poor sign-on experience is not only frustrating for end users but also negatively impacts how the organizations perceive their IT and identity teams.

  • The principal IT engineer at a semiconductor company said their organization used SSO to improve UX. They said: “Anytime I access anything through single sign-on, I don’t have to put in a password again. Now, if it’s with Windows Hello for Business and I have a camera, I can use facial recognition to log me in, which means I don’t have to really do anything.”
  • The director of solutions architecture at an insurance company said: “We want to reduce the complexity of people needing to know passwords. So, the goal is to lessen their cognitive loads so that people do not have to worry about what their passwords are anymore.”
  • The principal IT engineer at a semiconductor company said: “To give [employees] the ability to log into things without a password would impact everybody across the company. That is huge, especially when you look at how often people need to type in a password throughout the day.”

• Modeling and assumptions.

  For the composite organization, Forrester assumes:

  • SSO and MFA are enabled for all 10,000 employees in the organization.
  • Each employee saves an average of 10 minutes per week in Year 1 from having a single password and single login to access all critical applications. As more applications are added to SSO over time, employees experience greater weekly time savings of 12 minutes and 15 minutes in Years 2 and 3, respectively.
  • The average, fully burdened hourly rate for an employee across the organization is $40.
  • End users do not take advantage of all the time saved by this solution, so Forrester applied a 50% productivity recapture. This means employees leverage 50% of the total time saved for productive work.

• Risks.

  The size of the benefit can vary based on:

  • The time that employees save with Microsoft Entra relative to their previous authentication and access experiences.
  • The type of employees and the nature of their work.
  • The average fully burdened cost of employees.

• Results.

  To account for these risks, Forrester adjusted this benefit downward by 20%, yielding a three-year, risk-adjusted total PV of $4.0 million.

UNQUANTIFIED BENEFITS

Interviewees mentioned but were not able to quantify the following additional benefits that their organizations experienced:

• Working with Microsoft as a trusted IAM partner.

  All interviewees said that working with fewer vendors was easier and that Microsoft provided very good customer service and support. This included co-engineering and support on new security-related initiatives.

• Ensuring compliance with regulatory standards.

  Several interviewees’ organizations operate in highly regulated markets, and moving to the cloud with Microsoft Entra helped them adhere to their industries’ requirements. The director of solutions architecture at an insurance company said: “First, being compliant protects us from incurring penalties. Second, with Microsoft Entra, we no longer have to do it the old-school way of using other point solutions.”

• Using External Identities in Microsoft Entra to streamline secure access for partners.

  Several of the interviewees’ organizations started using the External Identities capabilities in combination with other Microsoft Entra products such as Azure AD to help secure and manage customers and partners.

  The identity and access team lead at a software company said that during the pandemic, their organization was able to quickly and securely onboard various partners. They said: “[Without Microsoft Entra,] we would have had to create nearly 2,000 identities and then figure out a way of relaying the credentials to them. But we did not have to do that because we could simply take their existing work [identities] powered by Azure AD and give them access to stuff that they needed access to.”

  The principal IT engineer at a semiconductor company said that beyond the cost of resources and the ease of integrating third-party resources, using External Identities contributed to improved security. They said: “The nice thing about guest access or external identity management is that when the account gets terminated on their side, it just stops working on our side. Putting on my security hat for a minute, this represents a way to close a security gap. That’s a huge advantage from a security perspective.”

FLEXIBILITY AND INNOVATION: SAVINGS FROM REDUCTION IN BACKGROUND CHECKS

• Evidence and data.

  Forrester research says the use of verified digital identity is one of the top trends shaping identity and access management in 2022.⁹ Interviewees said their organizations have started to see the potential in relying on trusted digital identity for onboarding new employees, managing certifications, licenses, and password replacement or recovery for existing personnel, and even for managing software licenses for customers.

  A co-founder and chief technology officer at a security organization told Forrester that recruiters carry a lot of liability. First, during hiring processes, employers incur the risk of trusting that new hires are indeed who they say they are. Then, there is a risk of storing their data in a way that is or is not compliant. And, finally, employers must ensure that an employee’s personal data is no longer stored at the end of their employment.

  Microsoft Entra Verified ID partners with background check providers to verify a user’s identity once so they can use it anywhere. This reduces the need for employers to store user data. The co-founder and chief technology officer at the security organization elaborated on this benefit: “If you leave my organization, you get to keep your wallet, and the employer or the recruiter does not have to worry about any of the liability.”

  A senior solutions architect in the identity and access management space at a software organization said their company tested Microsoft Entra Verified ID for onboarding new hires. They said: “We spend a lot of time and money working with different third parties for background checks. Once that process is done, we manually onboard new hires. The way [new hires] are providing their passports, their visas, and their work authorizations happens outside of Azure AD because [they’re] not onboarded yet, and that is not as robust and secure as [we] would want it to be.”

  The same interviewee elaborated that relying on Microsoft Entra Verified ID in the future would allow their organization to significantly reduce the costs of working with third parties for background checks, and also reassign several FTEs dedicated to managing background checks and vendors.

  Moreover, their organization projected shortening the hiring and onboarding processes and making employees available and ready for work sooner and at scale, if needed. The senior manager for productivity services and networking automations at the company said: “Adding more people manually is inefficient, may leave room for errors, and [may] cause some unwanted security incidents. Verified ID is helping us do this right and at scale.”

• Modeling and assumptions.

  For the composite organization, Forrester assumes:

  • Two FTEs are dedicated to managing background checks and supporting vendors.
  • As the change management efforts and general comfort with digital identity progress, the composite organization sees a 15% to 90% reduction in the effort needed to manage background checks.
  • The fully burdened annual salary of a human resource specialist is $78,000.
  • The composite organization sees a 30% churn rate and therefore needs to hire 3,000 new employees each year.
  • A background check costs $50 per hire on average.
  • The composite organization expects to replace 10% to 20% of traditional background checks with digital identity verification in Year 1, 50% to 70% in Year 2, and 90% to 95% in Year 3.

• Results.

  This yields a three-year projected PV ranging from $321,500 (low) to $369,300 (high).