Zylo

Deprovisioning gives you the power to enhance security and reduce costs. In this session, you’ll learn best practices to deprovision within the Zylo platform and unlock the power of your Okta environment to optimize licenses with Okta Actions.&nbsp;

Joan Schrenkel

Integrations Director at Zylo

Deprovisioning gives you the power to enhance security and reduce costs. In this session, you’ll learn best practices to deprovision within the Zylo platform and unlock the power of your Okta environment to optimize licenses with Okta Actions. 


Put the "Pro" in Deprovision

Podcast

Why Zylo

Solutions

Demo

SaaS is the future of software, the foundation of the hybrid workplace and the cornerstone of employee effectiveness.If you are an IT, Software Asset Management, or Procurement professional or executive looking to harness the power of your SaaS,&nbsp;optimize your investments, save money, and grow your business, check out these sessions from SaaSMe - the Enterprise SaaS Management Event powered by Zylo.

SaaSMe - The SaaS Management Event

Joan: And hello everyone. Yeah. So, we're here today. The session is" I am here to help you put the pro in deprovision with Zylo". So as Maddie said, I am your host, Joan Schrenkel, Director of Integrations here at Zylo. I'll go through a quick overview of what we're going to talk through today. As Mattie mentioned, we're going to talk about license management, give you some numbers there. Talk about Zylo Workflows, some new functionality we have released with that, as well as some best practices. Then, I'm going to introduce you to Okta Actions, and give you a demo of Okta Action in action. And then, I'm going to touch on what's next with all of this.Joan: Let's jump right in and start with the challenges we face today when it comes to license management. When it comes to license management, do you or someone you know ever feel like Maddie does in this video? Take a look.Maddie: Does this person even work here? They left the company like a year ago.Joan: I can already feel her stress building. She's overwhelmed.Maddie: Our Asana contract renews next month, I don't know if I need 500 licenses or a thousand.Joan: She's working between spreadsheets, swiveling between systems...Maddie: Veronica's provisioned five different project management tools. What is she using all these for?Joan: That Veronica..Maddie: Is she using all these?Joan: That Veronica is suspect.Maddie: Megan never has meetings over 40 minutes, she can downgrade to a basic tier.Joan: Saving money with Megan.Maddie: This is going to take me weeks. I don't know how I can get this done.Joan: Crazy. I don't know if you guys felt it, but I definitely felt Maddie's stress that poor girl needs a glass of wine already. So now, do you ever feel like that? Like you're wasting time on manual license management workflows, swivel chairing between systems? Or as Ben said yesterday in his presentation," contact switching between multiple apps a day"? Feeling overwhelmed by the amount of work that needs to be done. You probably are.Joan: And our data shows that companies can spend upwards of 4, 000 hours handling this process. That's a lot of zeros. Think about what you could do if you got some of that time back.Joan: Next thought. Do you lack visibility into usage data around licenses? Maybe you or your team is working out of spreadsheets or partnering with others within your organization to get data. Digging into this can be so cumbersome. We hear that all the time.Joan: And our data shows that 40%, that's crazy, 40% of licenses go unused. And last one here, do you end up paying for licenses you don't need or use? It's probably happening and we've found that a third of spend is wasted on unused or underutilized licenses. On average, that equates to around 1. 5 million per thousand employees. That's a lot of cheddar.Joan: So the bottom line is, do you wish this could be easier? There's Maddie again, right? She's hitting that easy button. It can be easier with Zylo Workflows that help you maximize your SaaS investments. Workflows allow you to leverage the rich usage and licensed data in Zylo and run complete close loop workflows to deprovision users directly from applications without ever leaving Zylo.Joan: Zylo Workflows make managing licenses a whole lot easier. De-provision and de-stress optimize your spend and gain back some of those 4, 000 hours by leveraging workflows that allow you to take instant automated action to reclaim licenses.Joan: Additionally, take advantage of Zylo Insights to prioritize the highest impact applications to act on and run your workflows with confidence. There's additional functionality that helps you to be confident in the workflow process.Joan: So let's talk about a couple of those. Suppression lists. Don't want to try to remember not to deprovision your CIO, CTO, CFO, or other important team members within your company? No problem. Suppression lists allow you to exclude users that you don't want to take action on.Joan: Education cards. Are you one of those people who don't like to read full instruction manuals or knowledge based articles to understand every detail of what needs to happen? I know I'm not sometimes, no issues here. You can follow the step- by- step instructions all the way through to completion within the workflow directly.Joan: And lastly, new functionality that we just introduced and rolled out: skip email. You now have the option to survey your users before you reclaim their license or bypass the survey and response steps altogether and immediately deprovision the users. Pretty great, right? I don't know about you, but mind blown. But wait, we didn't stop there.Joan: Now let's introduce you to our newest premium feature: Okta Actions that now works with Zylo Workflows. Okta Actions enables you to automatically deprovision licenses from any application that's behind your Okta SSO based on Zylo's real time usage data. We provide you the experience you love with workflows now connected to Okta.Joan: Let's talk about data driven optimization recommendations. Unlock more recommendations than you can act on. Recover more unused licenses based on usage and behavior data. Ensure your security practices are followed and former employees can't access your company tools, and overall improve usage, renewal and licensing tier decisions. What else does Workflow and Okta Actions do? More automated workflows. With Okta Actions, we unlock even more automated workflows for license deprovisioning. With a click of a button automatically harvest, reclaim or deprovision users. Be proactive versus reactive. Shifting away from treating license reharvesting as a project and turn that into a regular practice. Additionally, deprovision opportunities via Okta or through a direct deprovision, the best of both worlds.Joan: And lastly, Workflows plus Okta Actions unlocks more opportunity. Now you can optimize licenses across hundreds of tools. Anything that is behind your Okta instance. The bottom line is, unlocked more actions with more apps using Zylo plus Okta. So, you guys ready to see this in action? I know Mattie is.Joan: So let's demo. So I'm going to click over here and I'm going to start within the Okta Instance itself. I'm just going to talk about two different things within Okta. One is going to be applications, and the other is going to be users. For the purpose of the demo, I'm going to focus on Airtable and Coupa here. As you can see, within an Okta Instance, Airtable and Coupa are actually configured two different ways. I'll start with Coupa. If we go into the Coupa application and we look at the provisioning rules, as you can see there is a direct skim integration setup between Okta and Coupa allowing users via Okta to automatically be deactivated within the Coupa Instance.Joan: This is one scenario that will work with Zylo Workflows. So, if I'm running a workflow within Zylo and I want to deprovision a user, it's not only, via this setup, going to remove the user from Okta, but it's also going to take advantage of this configuration and remove that user from Coupa.Joan: Now let's step back to the other application, and let's take a look at Airtable. Now if I look at Airtable and go into their provisioning roles, you can see they don't have a configuration set up here. In this case, if a workflow was to be run in Zylo via Airtable, we will remove that user via Okta. We will remove that tile from the Okta Instance, but we won't be able to deprovision that user. However, because Zylo, we have a direct integration with Airable, in conjunction with that, we will deprovision that user via that direct integration giving you one seamless closed looped process to deprovision that user. I'll show you that in a minute as we walk through Zylo.Joan: Let's go back to this application. There's one other thing to touch on here, is how users get assigned. Users can be assigned to an application either directly you assign a person to a specific application, or it can be assigned through a group. When I assign users through a group, and there are a number of them here, so I'm going to come up here and take a look at the group. There are two different types of groups. There's a group that has one application assigned to it called a single app group, and there are also groups that have multiple applications assigned to it called multi app groups.Joan: The great thing with Zylo is we are able to deprovision your user regardless of how they were assigned. So, whether it be that they were directly assigned or assigned via a single app or a multi app group, we handle them all. So let's take a look at this. This is my Instance within Okta, and as you can see I have Aha!, Airtable in Coupa. Currently within Airtable, you can see I have workspaces and bases assigned to me. If I look within Coupa, you can see that I do have an active license and we can click on my details as well. There we go. You can see that I am active.Joan: All right, so now I'm going to go into Zylo and I'm going to click over to subscriptions. Two fields we have added here via tags related to Okta, are going be Okta Tile Deactivation and Okta Push User Deactivation. What these two fields tell you is what action can be taken for that particular app via Okta. So if there is a tag that says Okta Tile Deactivation, it means that the configurations we just talked about in Okta, it means that it's only configured to remove that application from the Okta Instance. It will remove that tile on the dashboard. If it also has an Okta Push User Deactivation tag, that means it's going to be a full closed loop all handled via Okta and it will be able to remove that license.Joan: So let's take a look. I have a save filter set up for all of my applications and as you can see, these tags are added. So when we looked at Coupa, remember it was configured to be able to deprovision that license, so you can see it's going to remove the tile as well as push the user deactivation to the application.Joan: Then if we look at Airtable, it's only configured currently to remove that tile. Now if I click on Airtable, I can see that for this particular subscription there is an Airtable Integration set up, so the deprovisioning action will take place there. Here, I'm going to click over to the users tab, and I can see all my users here. Before I run this workflow, I would typically use a filter. I would probably look at, say I want to run a workflow to deprovision anyone who hasn't been active. So, I may filter to" Days Active: zero for the last 90 days", and I may only want to provision those users. This is the page where you would take that, and that would be a common workflow that I would run. I might want to run it before a renewal, or if I'm doing this on a monthly basis or some certain cadence, I'm going to set up those filters here and then I'm going to determine which shoes I want to process in the workflow, and then I'm going to hit" Start Workflow".Joan: For this purpose, I'm just going to hit" Start workflow", and I'm going to name my workflow. Particularly here, we're talking about Airtable and I'm going to select the action I want to do, and then just hit" Yes, build workflow". So, I select" Deprovisioning", oops. I got click happy there, sorry about that. So, that takes me into the screen. As we talked about with workflows, you can see all of these instructions here that walk you step- by- step through. Here's that suppression list, if you wanted to exclude users. For this purpose, I'm not going to include every user that I want to do, I'm just going to focus on a couple.Joan: So, I will look at myself, Tim and Isaac. Those are good examples here to run. And I'm going to remove everyone else from the list. Now you can see I'm just focusing on these three users. Here you see these three users and you can, at this point, send that email if I wanted to ask them or let them know," I'm going to be removing this license, is there any reason you want to keep it?" But for the purpose of this demo, I'm just going to skip those steps. And once I've hit continue, as you can see, it bypassed the email and review response steps and took me right to"Deprovision and notify". When you create, you've got a great impact statement up here that is going to tell you exactly what's going to happen if you continue with deprovision licenses.Joan: As you can see here upon deprovision, Okta will remove Airtable from the Okta user dashboard and a direct deprovision will be performed by Zylo. That'll happen via Airtable. If I go down and hit the deprovision users, you do have the option here to notify the users at this time that you're going to be removing their license. In this case I won't do that, but this would send them an email letting them know if you did want to do that option. So, I hit confirm, and then this kicks off the deprovision action just as that impact statement headset.Joan: Then, as you can see, this has successfully completed. You see the state here as well as the detail of what exactly happened. You can download this list for your records or send it to your security team, or whoever would need to know what action was taken on these users. The great thing about this detail, is it tells you exactly what happened for each user. I know we walked through those three scenarios where I could be directly assigned to an application, or be in a single app group or multi app group, these are those three cases. You can see that in Isaac's case, that application was removed from him so that he was a direct assignment. Then again, his instance would be removed. He would be removed from the Okta dashboard, that application, and a direct deprovision. You can see that I was also completed, and then also Tim. And we will complete that workflow.Joan: All right, if we go back to the subscriptions page, and now we're going to process that Coupa workflow. This is going to be slightly different, but the same processes overall that I'm going to follow. I'm going to click over to my" Users" tab. Again, this is where I would probably want to filter them down. In this case, these users haven't been active, so this would be a great one to utilize. We're going to hit" Start workflow" and then you can see it takes me to the same screen. In this instance we'll just focus on me for the sake of running this one. Remember this was configured that the direct integration and the tile removal will both happen within Okta. Again, I'm going to skip those steps, I'm going to hit" Continue" and that's going to take me right to that deprovision and notify step. I can see that it's me. That impact statement at the top has now changed, and says" Upon deprovisioning, Okta will be removed from Coupa, from the user dashboard as well as push user deactivation." I'm going to hit" Deprovision users" and as you can see, this has successfully completed. And again, tells me exactly what happened. The application was removed for the user and from the user dashboard as well as deactivate from the application. I complete that workflow. I do have, in the completed state, I can go back to that at any time and download those details if I'd like.Joan: That is the completion of both of those workflows. If I go over to my Coupa Instance and refresh, I should see that my state went to inactive. Then if I go over to my dashboard and refresh, I should see that this went away as well, and Airtable is still there. You know what? I do think I picked the wrong Joan Schrenkel. I think I have two accounts. That's why you're still seeing that there. But overall, you can see success has occurred. That is all for the demo.Joan: Let's click back over to here. All right, so that's it. How great was that?Joan: Just to recap everything that we talked about here, automated license management for Okta, now part of Workflows. This is going to save you time and money. It's going to help boost productivity, fuel adoption, securely within your organization. Where are we going next? Stay tuned because we will be adding more direct integrations with deprovisioning support, other SSO platforms like Ping Identity, additional licensing actions like provisioning, and as you learned from Ian yesterday, new ways to automate your workflow experience.Joan: That's all I got. Thank you guys for your time.