I recently returned from working at Microsoft to life as a research analyst at Gartner. Working in Redmond gave me a healthier respect for both the complexity that goes into delivering solutions for customers and the type of problems customers ask vendors to solve. When I arrived back at Gartner, one of the first tasks I was given was to work with a colleague to coordinate an update to the Magic Quadrant for user provisioning in identity management. Now here is a problem type that has driven many customers to distraction, either by its complexity, its cost to achieve, or its lack of good tools or process. The Magic Quadrant was completed this week. Did we really learn anything new from last year's first study on the subject?

Yes, we did. There is both good news and bad, actually. The good news is that the products for user provisioning are better now. The features for provisioning, de-provisioning, workflow and audit have greater functionality across more platforms and applications, perform better, and integrate and interoperate better than they did 18 months ago - as they should. System integrators are more numerous and more available geographically, and deployment successes exceed deployment failures - these are good things. So, what's the bad news?

Well, for large projects, user provisioning is still very hard. It often takes far too long, years even, and in many instances the program objectives are ill-defined or improperly defined, resulting in poor implementations that ultimately lead to failure or projects that simply stop in midphase, sometimes to be restarted later under different leadership. The purpose of user roles is ill-understood, whether they are business-specific or technology-specific, and without clear definition of such roles, many times user provisioning projects can go awry. Tinkering in midphase with the goals, a temptation if the project is taking a long time, makes the project take even longer as the parameters change. These disappointments have even caused Gartner to move user provisioning in the "Hype Cycle for Identity and Access Management Technologies, 2007" back to reflect basic customer views of the current state of the overall user provisioning experience.

All in all, things are moving forward in identity management. Yes, it's complex. Yes, it's expensive. Yes, it takes a long time. But for some things, it actually is getting a little easier.