One Identity Active Roles

What is One Identity Active Roles?

One Identity Active Roles is a platform for managing Active Directory and Azure AD - one place to administer users, groups, computers. Replaces native Microsoft tools (ADUC, Azure Portal) with better delegation and automation.

Main functions:

• Unified Console - AD on-prem and Azure AD in one interface
• Delegation - delegate permissions without giving Domain Admin
• Automation - automatic provisioning and lifecycle management
• Audit - who, what, when changed in AD

What problem does it solve?

flowchart LR
    subgraph Native AD
        A[Helpdesk needs] --> B[Domain Admin?]
        B --> C[Risk]
        C --> D[No control]
    end

    subgraph With Active Roles
        E[Helpdesk] --> F[Delegated permissions]
        F --> G[Only password reset]
        G --> H[Full audit]
    end

    style A fill:#dc2626,stroke:#b91c1c,color:#fff
    style B fill:#dc2626,stroke:#b91c1c,color:#fff
    style C fill:#dc2626,stroke:#b91c1c,color:#fff
    style D fill:#dc2626,stroke:#b91c1c,color:#fff
    style E fill:#22c55e,stroke:#16a34a,color:#fff
    style F fill:#22c55e,stroke:#16a34a,color:#fff
    style G fill:#22c55e,stroke:#16a34a,color:#fff
    style H fill:#22c55e,stroke:#16a34a,color:#fff

Typical problems:

• Helpdesk has Domain Admin because “otherwise can’t reset passwords”
• Multi-forest / multi-tenant - logging into multiple consoles
• No automation - manual account, group creation
• Native AD delegation is complicated and easy to break
• No audit of who changed what in AD

How does Active Roles work?

flowchart TD
    A[Administrator/Helpdesk] --> B[Active Roles Console]
    B --> C[Active Roles Service]
    C --> D{Check permissions}
    D -->|OK| E[Execute in AD]
    D -->|No| F[Deny]
    E --> G[Active Directory]
    E --> H[Azure AD]
    C --> I[Audit Log]

    style A fill:#6366f1,stroke:#4f46e5,color:#fff
    style B fill:#8b5cf6,stroke:#7c3aed,color:#fff
    style C fill:#f59e0b,stroke:#d97706,color:#fff
    style D fill:#f59e0b,stroke:#d97706,color:#fff
    style E fill:#22c55e,stroke:#16a34a,color:#fff
    style F fill:#dc2626,stroke:#b91c1c,color:#fff
    style G fill:#22c55e,stroke:#16a34a,color:#fff
    style H fill:#22c55e,stroke:#16a34a,color:#fff
    style I fill:#8b5cf6,stroke:#7c3aed,color:#fff

Key difference: Users don’t connect directly to AD. Active Roles mediates and controls what they can do.

Main features

Delegation Model

Active Roles uses “virtual permissions” - doesn’t modify AD permissions:

flowchart LR
    A[Access Template] --> B[Managed Unit]
    B --> C[Trustee]

    A --> D["Reset Password"]
    A --> E["Create User"]
    A --> F["Modify Groups"]

    B --> G["OU=Sales"]
    B --> H["OU=IT"]

    C --> I["Helpdesk Group"]
    C --> J["HR Admins"]

    style A fill:#6366f1,stroke:#4f46e5,color:#fff
    style B fill:#22c55e,stroke:#16a34a,color:#fff
    style C fill:#f59e0b,stroke:#d97706,color:#fff

Example: “Helpdesk can reset passwords only in OU=Sales” - without any changes to native Active Directory ACLs.

Hybrid AD Management

Managing hybrid environment:

Object	AD on-prem	Azure AD	Active Roles
Users	ADUC	Azure Portal	Unified
Groups	ADUC	Azure Portal	Unified
Computers	ADUC	Intune	Unified
Exchange	EMC	Exchange Admin	Unified

One interface for all operations - creating user in AD automatically provisions to Azure AD.

For whom?

Active Roles vs native tools

Aspect	ADUC / Azure Portal	Active Roles
Multi-forest	Separate console per forest	Unified
Multi-tenant	Separate portal per tenant	Unified
Delegation	Complicated, ACL-based	Role-based, virtual
Automation	PowerShell scripting	Built-in workflows
Audit	Event logs, distributed	Central audit log
Self-service	No native	Portal for users

Specifications

Parameter	Value
Deployment	On-premises (Windows Server)
Supported	AD 2016-2025, Azure AD, M365
Console	MMC snap-in, Web interface
API	PowerShell, REST
HA	Clustering
Integration	SIEM, ServiceNow, Identity Manager

FAQ

Does this replace ADUC? Yes for daily administration. ADUC still works, but Active Roles gives better control and audit.

Does it modify AD permissions? No. Active Roles uses “virtual permissions” - controls access without changing AD ACLs.

How does it integrate with Azure AD? Through connector. Operations performed in Active Roles are replicated to Azure AD.

Does helpdesk need to learn new console? Console is simple. Helpdesk sees only what they have permissions for - less complicated than ADUC.

How does it work with Identity Manager? Active Roles can be “execution layer” for Identity Manager. IM defines policies, AR executes in AD.

How long does deployment take? Basic: 2-4 weeks. With full automation and integrations: 1-2 months.

Does nFlo deploy Active Roles? Yes. Deployment, delegation configuration, lifecycle automation, Azure AD integration.