dean-scontras

Dean Scontras has spent the last two decades in public sector sales roles at high-growth cybersecurity and technology companies, including Duo Security, MobileIron, and Hewlett-Packard. Currently, Dean sits on the advisory board of Advanced Technology Academic Research Center (ATARC) and DiversifyIT. Prior to joining Auth0, he served as the vice president of U.S. Public Sector at Duo Security (acquired by Cisco), leading federal, state, local, and education sales initiatives, alongside securing the company’s successful FedRAMP certification.

VP, State and Local Government and Education, Okta and Auth0

Dean Scontras

Consumers expect seamless, high-value digital experiences, including with the public sector.

What does it mean to build digital services that citizens both use and trust? From the local to the national, generating effective digital transformation and [getting citizens onboard with digital public services](https://www.sciencedirect.com/science/article/pii/S0740624X18304131) has been a challenge. The promise of digital government has often been muddled by institutional inertia and perceptions of government as slow-moving and bureaucratic. At the same time, positive initiatives, such as the [Tallinn Declaration on eGovernment](https://ec.europa.eu/newsroom/document.cfm?doc_id=47559), which embrace objectives as wide-ranging as improved service delivery, greater efficiency, increased transparency, interoperability, and citizen satisfaction, have begun to remove entrenched ambivalence about e-government. Modern GovTech is where these barriers collide, creating the opportunity to address newly accelerated consumer demand in the face of private-sector conveniences and the [consequences of the Covid-19 pandemic](https://www2.deloitte.com/us/en/insights/industry/public-sector/government-digital-transformation-strategy.html). 

GovTech, according to public sector entities such as [the World Bank](https://www.worldbank.org/en/programs/govtech), is a technology-based “government approach to public sector modernization.” The same definition emphasizes three core areas for modernization: universal accessibility, citizen-centric services, the delivery of efficient and transparent government systems, and finally, digital transformation, all of which rely on overcoming long-cited barriers to adoption and success, such as [citizens’ willingness to use and trust services](https://doi.org/10.1145/2096140.2096142).

GovTechs, an umbrella term for technology-based solutions (and the companies behind them) that power the technical aspects of digital transformation, can be a bridge between use and trust and learning to [see citizens as customers](https://www.mckinsey.com/industries/public-and-social-sector/our-insights/building-the-tech-enabled-government-of-the-future-a-day-1-list-of-common-pitfalls).


## Changing User Expectations 

In a pure consumer context, choice and convenience rule: you can easily go online and search, comparison shop, and buy a desired product in a few clicks without thinking about any of the complexity of the transaction. Consumers naturally transfer their positive consumer expectations to all of their digital experiences,[ according to McKinsey, raising the bar for government entities](https://www.mckinsey.com/industries/public-and-social-sector/our-insights/digital-public-services-how-to-achieve-fast-transformation-at-scale). 

But how many consumers have enjoyed the convenience of one-click (or similarly easy) citizen services, such as reviewing and paying utility bills, filing income taxes, or having a streamlined, one-stop car-and-driver licensing experience? Or, for example, registering for unemployment benefits digitally, making the physical queue at the unemployment office shorter and more efficient for those going through the process in person? 

Rapid change has led to the expectation that public sector services offer private-sector-rivaling availability, choice, and convenience, which overrides previous consumer doubts about public sector readiness. 

Driving GovTech strategy in complex public sector environments demands a delicate balance between overarching strategic questions and the nitty-gritty of implementation. For example, this balance could be examining the[ underpinnings of transformation](https://www.accenture.com/_acnmedia/pdf-90/accenture-govtech-pov.pdf) strategically, such as public expectations, financial considerations, accessibility, demographics, and sustainability, against the competing operational demands of introducing new technology into hierarchical, political, and often change-resistant environments. Practically, such implementations involve extensive political and stakeholder management and support, consideration of legacy investments and programs, and a well-defined plan for rolling out proposed changes and the downstream effects these may have, whether positive or negative. 

Ultimately, the strategy for selecting and implementing GovTech solutions and providers rests with public sector employees who are responsible for the strategic and tactical approaches described and for meeting consumers’ increasingly private-sector-style expectations. This is redefining how governments interact with citizens. 

Three core considerations highlight how uniquely demanding delivering on these expectations can be for government agencies:

### 1. Deliver on citizens’ demands and expectations. 
Government digital transformation is different from its private-sector counterpart. Historically,[how consumers perceive and use public and private sector services has differed](http://dx.doi.org/10.4018/IJIDE.2019010102). However, societal changes stemming from the Covid-19 pandemic and the attendant shift to living life almost 100% online have resulted in heightened citizen expectations for public services to be available digitally in the same way as online shopping and food delivery. As a result, old barriers against citizens' willingness and ability to use e-gov services have declined significantly. 

### 2. Balance privacy and user experience. 
More fundamentally, the private sector is driven by consumer demand and choice, incentivized by increasing profit and reducing cost. While the public sector shares these concerns, because citizens often do not have a choice in deciding whether to interact with the government, the government’s primary aim is to provide services to citizens efficiently while building trust, safeguarding citizens’ data privacy, and ensuring compliance with regulations, mandates, and standards to which government agencies are tied. Trust remains an important issue for consumer-citizens, who[ perceive a level of risk in exposing their private data to public entities in ways they don’t when dealing with private entities](https://www.ey.com/en_no/government-public-sector/how-can-digital-government-connect-citizens-without-leaving-the-disconnected-behind). For public sector agencies, privacy concerns have historically taken precedence over user experience, but they need to prioritize privacy and security over user experience and convenience is beginning to change as GovTechs offer secure solutions leveraging modern infrastructure and economies of scale that facilitate both outcomes at a lower overall cost.

### 3. Make public services accessible to all citizens. 
The rapid digitization of society champions convenience above all, but digital-only approaches can create [accessibility blindspots](https://www.openaccessgovernment.org/accessibility-making-government-work-better/55530/) and [exacerbate the digital divide](https://www.ey.com/en_au/government-public-sector/how-can-clever-governments-choose-to-close-the-digital-divide). Government agencies must serve _all_ citizens, which means designing for everyone or else disenfranchise citizens who do not have access to digital services, devices, or connectivity. 

## How Can GovTech Enable These Citizen Experiences? 

Government agencies want to deliver on these citizen expectations because the agency benefits by achieving its mission, improving efficiency, and reaching all of its citizens — ultimately benefiting citizens. 

“A valuable function of government is providing all constituents with equal opportunity to access different services. By enhancing government with modern technologies, citizens are presented with multiple paths to the same services. These paths can now be both digital and in-person avenues, allowing the government to be more efficient in providing the right access to the right group of people,” Auth0’s Jeet Shah, Identity Architect, and Senior Solutions Engineer explains. “GovTechs introduce options for how citizens are served, allowing governments to dedicate resources more effectively. Citizens who prefer interacting with their governments online allow in-person services to be more accessible and can ultimately improve the quality. GovTech vendors and what they provide to governments ultimately leads to better services for all constituents.” 

GovTech grows from two branches: the first is the services governments offer to their citizens, the second is the vendors that enable those services. Governments furnish services in line with citizen expectations, which brings together these two branches.

### Government services to citizens: Focus on usability and trust

At the heart of delivering efficient public services is the ability to unify disparate, siloed departments and functions under a single sign-in. Forcing citizens to keep track of and maintain access to multiple portals and sites creates friction and disincentivizes use while also introducing the greater potential for security vulnerabilities and data privacy breaches. 

At the same time, maintaining this fractured setup is less efficient, potentially open to fraud, and forfeits opportunities for fostering citizen trust and personalizing user experiences. For example, imagine being able to offer all citizen services through a centralized digital portal or app with a single sign-on experience. From license renewal to viewing existing permits to paying bills, governments can leverage GovTech that enable these features and gather user analytics simultaneously to feedback into personalization efforts and a deeper understanding of citizen needs and wants.

## Identity Jumpstarts GovTech Services

[Various barriers have slowed technology-driven public sector transformation](https://doi.org/10.1007/978-3-030-57599-1_4) over the past two decades. Many of these barriers, such as embedded organizational and cultural issues, existing processes, and legacy structures and infrastructure, persist regardless of technology. The impetus to accelerate the pace of change, however, has positioned GovTech to play a key role in helping to overcome some of these barriers. 

Identity enables all levels of government to bring their services to more citizens via the channels they prefer and already have access to. If the barrier faced is the difficulty of use, unified identity simplifies usability for both the government agency and the citizen user. If the barrier is trust, secure and transparent identity technologies can breakthrough. 

### Vendor service enablers: Auth0 for unifying identity

Auth0 is a GovTech vendor that, in this case, acts as an umbrella, freeing government agencies from service and platform fragmentation by bringing them together under a single, flexible sign-on solution. By reducing infrastructural complexity and providing options government agencies can use to offer services across multiple vectors, Auth0 helps public sector entities to expand the base of citizens who can access their services. 

By doing the heavy lifting of the platform and digital identity consolidation, Auth0 enables governments to reorganize and reprioritize resource allocation for more efficient processes – dedicating resources to digitizing what is possible and improving those that cannot be digitized.

If you’d like to learn more about how identity can accelerate digital change and invite citizens along for the journey, please get in touch with the [team at Auth0](https://auth0.com/contact-us).

What is GovTech?

pamela-oldfield

Pamela Oldfield

Waiting means better quality, which is always better than quantity ...right?



Some say quality requires time — time to gather the best ideas and time to plan and execute. And quality is always better than quantity. You want to bring a strong product to market that will best your competition… right?

The thought process behind all this planning and execution can be extremely useful — unless your competition is snapping up market share while you’re still in build-mode.

But what if you didn’t have to plan and plan to execute before you started the build process? Partnering with strong experts allows you to move more rapidly through your road map and reach market before the [competition](https://auth0.com/auth0-vs).

![Some Say, Good Things Come to Those Who Wait.](https://images.ctfassets.net/23aumh6u8s0i/3uT14eWjFZXZFBsWPHXsfg/62ebd462ca423153c596481bd9e4ce1c/some-say-good-things-come-to-those-who-wait)

Moving rapidly doesn’t mean you have to sacrifice customization or personalization. Auth0’s API-driven approach to identity means that we can give you a leg up on creating the identity you need. 

Forrester and others have dubbed identity as “mission critical” for any tech project. Partnering with a modern identity provider like Auth0 allows you to benefit from years of experience [planning and executing effective projects](https://auth0.com/blog/how-to-have-a-successful-idm-project/). This allows you to plan and execute effectively and rapidly, while potentially discovering (and solving) challenges in other areas of your project. [And you’ll get to market faster](https://auth0.com/overview/#time-to-market): 94% of Auth0 customers implement in one month; 33% see a reduction in time to federate enterprise partners.

<include src="asides/AboutAuth0" />


Some Say, Good Things Come to Those Who Wait


Some say, asking numerous questions, upfront (usually at point of sale or registration), is a great way to get the information you need from the customer, in order to best serve, well, the customer. Of course it isn’t. If anything, all you will achieve is a huge cost in conversion rates.

How often do people stop and think about how much information the customer actually wants to share straight away, or even over time? Would you answer 20 questions, upfront? In the case of a new employee, that might be acceptable, and even expected. Afterall, whether a customer, business partner, or employee, relevant and accurate data is essential to safely manage the user’s digital identity, and their experience of your organization.

And coming back to the customer angle, those organizations who are data-driven, are 23x more likely to acquire customers says [Advance2000](http://www.advance2000.com/digital-transformation-statistics-for-business/), as well as improve their retention rates and ROI. However, do you really know who, and where all your customers are - when it comes to their digital identities across your applications and services?

![Some Say - 20 Questions are a great way to start](https://images.ctfassets.net/23aumh6u8s0i/7vOh7fY9tjqs4Y2nNiiGbe/1d859f7b259045b8679835deb8195c99/some-say-20-questions)

_Imagine what you could do with relevant, intelligent and centralized data about your customers, simply by using a little innovation in identity._

Using an extensible identity platform across your applications and services paves the way, not only to a single view of customer, but also to a personalized, differentiated experience while facilitating rapid development on new innovations. 

_To find out how you can modernize Identity in your department or organization, we’re offering a personalized identity assessment — [get yours here.](mailto:sales@auth0.com)._


Some say, 20 Questions are a great way to start!

Maturity and predictability is obviously the safest choice ...right?


Products, projects, profitability and people — an objective for every organization is for their people to deliver products, apps, and services that are competitive, achieve high uptake, that are delivered in a timely and efficient manner, and which bring the most profitability to the organization. **Would anyone ever disagree with that?**

_The short answer is obviously, no._

However, objectives and outcomes can often be two, very different things. Especially since technology is a cornerstone for any aspect of business today. Looking a bit deeper, a fundamental element within business technology is identity. And being the 21st century, Identity can belong to a person, a device or a machine.

_What is the point of mentioning all that?_

The point is: when it comes to technology — considering the basic organizational objective above — it has to be agile enough (read: fast) to adapt to change, to help you be innovative and to help you scale. 

![Some Say - Age Beats Beauty](https://images.ctfassets.net/23aumh6u8s0i/67GrGPelAENt7pkQpkxnZ1/00efe17fac2f1bc093058239298554d2/some-say-series-age-beats-beauty)

As such, initiatives like Digital Transformation, Application Modernisation, or whatever variant of those you may have come across, are long-standing hot topics in many areas. However, let’s look at a few numbers: **45%** of executives say Digital Transformation will increase their ROI. The flipside though — is that only **19%** of North American companies and 7% of European companies consider their technology level as advanced, found a recent [Advance2000 survey](http://www.advance2000.com/digital-transformation-statistics-for-business/). 

**A Big Question**: how can more organizations modernize their technologies, in order to achieve the desired, higher ROI?

The short answer, in our view, is that there are many ways, each depending on an individual organization’s needs. 

_So let’s focus on one, universal element and try something that’s newer, faster (and better looking)?_

Earlier we mentioned that technology is a cornerstone for any organization, and within that, a fundamental element — which can be a quick win when it comes to modernization — is **identity**. How many of your legacy applications each have their own database or process to manage the identities of people and/or devices? Consolidating and streamlining the identity piece of your applications, will strengthen not only your IT security, but also your business intelligence. 

_To find out how you can modernise Identity in your department or organization, we’re offering a personalised identity assessment — [get yours here.](mailto:sales@auth0.com)._


Some Say, Age Beats Beauty

Systems may be complex, but they work ...right?



When it comes to identity, or digital identity if you prefer, complex is most definitely a word that a lot of organizations would use to describe it. Think about your organization as you read through this...

For starters, there are many use cases for, and definitions of, identity — from traditional Identity and Access Management (IAM), to Access Management (AM), to Identity as a Service (IDaaS), to Consumer Identity and Access Management (CIAM), and then there is also Identity Governance and Administration. *Are you keeping up so far?*

Also, have we mentioned yet, the different types of Identity? Human, devices, machines… Then there’s the question of: are they internally facing or external? *Are you still keeping up??*

And last but absolutely not least, where in an organization’s technology stack does, or should, this all sit? And who on earth owns it? *Is IT keeping up???*

Many feel that complexity in identity is simply the inevitable outcome of time and growth. No one intended for it to rise to the current level, but it so often does. For others the complex structure makes them feel safe in the knowledge that every possible base, when it comes to securely managing and authenticating identities for today and tomorrow, is covered. If you are one of those who believe complexity equals safety, there is no need to read further.  

![Some Say - Complexity is your friend](https://images.ctfassets.net/23aumh6u8s0i/2UTtnyVfpbnwaGpyRULWsL/a9717265524ff02ed1d0cbb78ac8371c/some-say-series-complexity)

## For the rest of us, how about making a case for simplicity?

For example, here’s a simple list of items that could be ...simplified, easily:

* Effective execution of business processes
* Improved automation
* Stronger security now (and as you grow)
* Added business value
* Enhanced user experiences
* Faster time to market

To find out how you can simplify identity in your department or organization, we’re offering a personalized Identity assessment — [contact us to get yours](mailto:sales@auth0.com).


Some Say — Complexity Is Your Friend

bruno-krebs

I am passionate about developing highly scalable, resilient applications. I love everything from the database, to microservices (Kubernetes, Docker, etc), to the frontend. I find amazing to think about how all pieces work together to provide a fast and pleasurable experience to end users, mainly because they have no clue how complex that "simple" app is.

R&D Content Architect

Bruno Krebs

Learn how a B2C Company implemented Single Sign-On to provide seamless integration between different e-commerce portals.

Implementing Single Sign-On in B2C Applications

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

In advertising, Data is king, but that doesn't always mean it's put to good use. Until now.



Companies today are generating and collecting more data on their customers than ever before. This information is a cornerstone of contemporary advertising because it offers companies a way to better tailor every aspect of their content to prospective customers. This means smarter ad spending and more cost-effective campaigns.

But understanding what types of data your company can collect is not easy. And how you can use that wealth of information only complicates matters.

Looking at today's consumer information landscape, the easiest place to start crafting better ads through consumer information is by utilizing first-party data. Not only is first-party data readily available to companies, it can be easy to collect. And using it to boost ad revenue doesn't have to be complicated. It's about being savvy with your data and building on what you already have.

## What is first-party data?

First-party data is data that you collect yourself. It could be data about how your customers use your product or website, demographic data, information you collect from surveys, social data, pretty much anything that you collect firsthand yourself.

![First-party, Second-party, Third-party data](https://images.ctfassets.net/23aumh6u8s0i/7EZnv3zqZsGN2OvCpGNeqi/a2577697e133cce911ccbffd987ddb79/partydata)

This is different from second or third party data because there's no intermediary between you and the information. Second party data is first-party data that is not your own. You might acquire it in a business partnership, for example.

Third party data is data that you have no affiliation with but is available to you, usually for purchase. For example, an organization could buy first party data from different companies, repackage it together, and then sell it. Usually, you have little idea where, exactly, this data is coming from.

If you set yourself up well, first-party data is your highest-quality, cheapest option for data collection.

### First-Party data in advertising today

As software becomes more and more embedded in advertising, first-party data's role will increase. Programmatic advertising, wherein software is responsible for automating key parts of running an ad, like choosing target demographics, is already on the rise. This isn't as complicated as it sounds, tools like [AdEspresso](https://adespresso.com/), which automates Facebook ads, have been on the market for years. “More than [50%](http://west.gannettuscp.com/images/uploads/attachments/eMarketer_US_Digital_Display_Advertising_Trends-Eight_Developments_to_Watch_for_in_2016.pdf) of all US digital video ad spending will flow via automation in 2016,” and advertisers will be reliant on data to help these programs make better decisions.


As much of the leg work of advertising is automated in this way, knowing more details about your consumers will allow you to maximize the power of automation. A unified view of subscriber demographic and behavior will be critical to make this strategy relevant. Consumers are already shifting to expect relevant, timely advertising across channels, and a mix of information and programming will be key to delivering this in the future.

So, now that we know what first-party data is and how it's important, let's look at how you can use it to make better, more cost-effective ads.

### 1. Leverage social login

Social logins are great for both consumers and companies. With a good identity management system, they're easy to add and can be a great way to start getting serious about your first-party data.

An important way that social login helps you better collect information yourself is by adding a layer of transparency. Consumers generally feel uncomfortable if they find out a company is gathering all their information to do what they will with. A prime example of this? Unroll.me [selling](https://theintercept.com/2017/04/24/stop-using-unroll-me-right-now-it-sold-your-data-to-uber/) their first-party data to other companies, like Uber, causing widespread outrage.

Social logins give your consumers choice, because they can opt-in to what information they want to share. When a user signs in for the first time, you can notify them what data you'd like to receive (e.g. location, friends list) and have them check or uncheck what they feel comfortable sharing.

<include src="TweetQuote" quoteText="Social logins give your consumers choice, because they can opt-in to what information they want to share."/>

This builds trust with your consumer, while still allowing you to get the data you need.

Take, for example, the Washington Post. You can sign in via email, but also with your Amazon and Facebook accounts.

![Login Options](https://images.ctfassets.net/23aumh6u8s0i/4Iwoow7H7rWUyqtZLotIt8/20234d1b2a9c9e710886051f679c5f07/loginoptions)

This helps their ad strategy, because it allows them to look at what customers are interested in. What they're [liking on Facebook](https://www.sellbrite.com/blog/generating-facebook-ad-content/) and buying or [looking at on Amazon](https://www.sellbrite.com/blog/amazon-ppc-7-secrets-for-maximizing-return/) directly informs the ads that subscribers get on the Washington Post.

This kind of data could even help broader efforts, not just hyper-personal ads. As a hypothetical example, if frequent readers of the “economy” section check in to restaurants on Facebook more than any other section, then restaurants who want to advertise with the Washington Post can ask for and receive prime ad space because the Washington Post has the data to inform that choice.

### 2. Link accounts to nail personalization

For accurate first-party data, you want every user to be associated with one profile in your system. This is where you can store information about them to draw from when making any number of decisions, so you want to make sure that it's a good representation of your customers.

If someone logs in via Facebook one day and email the next, they could end up with two profiles in your system. This will skew your data and make it harder for you to make accurate insights, you need to [link those accounts](https://auth0.com/docs/link-accounts) together into one central profile.

It can also negatively impact the way you remarket to customers. If you don't have accurate information of a customer's use or purchase history, you may end up annoying them by blasting their social account with ads for things they've already purchased while logged into an account via email.

![Central Profile](https://images.ctfassets.net/23aumh6u8s0i/4mqgavgS2k1YYLvDCf0tQx/70e9b65e5b60b3d446e88f909a23ac56/centralprofile)

Relevance and personalization are key when it comes to ads today. Nobody wants to see irrelevant ads, and people will mark ads on social as annoying or unnecessary when they get flooded by them. Some will even go so far as to use an ad blocker, which proves how impersonal and spammy ads can seem.

<include src="TweetQuote" quoteText="Relevance and personalization are key when it comes to ads today."/>

You can cut down on irrelevant ads by linking accounts because you have a full picture in your first-party data on any given customer. This helps you serve each individual user better, but also helps you [better identify trends and behaviors](https://www.interana.com/blog/10-stories-companies-changed-users-behavior/) that you would otherwise botch because it looks like several people are doing the actions of one.

### Provide an omnichannel experience

Social login also allows your users to have the same [customer experience](https://www.zendesk.com/resources/why-companies-should-invest-in-the-customer-experience/) when logging in across any device. This keeps your brand consistent and helps make you more customer-friendly. While retailers are still figuring out how to provide a truly seamless experience, [omnichannel](https://auth0.com/blog/the-three-best-ways-to-create-the-single-vision-of-a-customer/) is the future of how you interact with your customers.

You can keep tabs on users easily across channels. If they're using social login on their phone one day and their computer the next, you can keep all that information stored in their profile. All their consumer data, that first-party data you want, is consistently paired with their profile with no effort on your end.

This means it's easier to serve the right ads to the right people and it's also easier to see how each individual is reacting to the ads. This feeds directly back into the personalization that's so important in digital advertising.

## Better segmentation, higher rate cards

When you're a media publisher, first-party data can help not only with how you understand your own customers, but also with how third-party advertisers access them as well.

When you've collected first-party data on your customers, you can better segment your audience. Demography, common interests, device usage, likes and dislikes, among other things, can help you understand exactly what your audience wants and what they're looking for, which helps you make third-party ad placements more effective.

Rate cards for publications can be segmented in any way the publication chooses. Some choose to specify primarily on placement, like the Food Network Magazine:

![Rate base](https://images.ctfassets.net/23aumh6u8s0i/6FyYat4AK7oJrWY8f8E2vN/86dd25d2238b188d77426719d2db295c/ratebase)
_Source: [foodnetworkmediakit.com](http://www.foodnetworkmediakit.com/digital-edition)_

Others, like Adweek have a variety of options for placement and targeting:

![Ratecard](https://images.ctfassets.net/23aumh6u8s0i/1iYZXqejhWgKliCBwyrIf8/4946d739c2614d4ef2e967eed3fa5295/ratecard)
_Source: [adweek.com](http://www.adweek.com/files/2014-Digital-Rate-Card-101414.pdf)_

When you have the information on your users to be able to offer more effective ads on your publication or site, that can enable you to increase your ad rate cards, which is great for your business. You can use your data to segment the ads you run by age, demographic or behavior and charge more for people that buy more, or are more suited to a particular advertiser's product.

Advertisers will be more confident that their placement with you is a good fit and will provide a return on investment. And your consumers will be more intrigued by ads instead of feeling annoyed by them. It's a win-win-win.

## Knowledge is power

Now more than ever before, information is free-flowing and available. For advertising, it's all about harnessing the power of the consumer to give them better, more relevant content. With programmatic advertising on the rise and [more user data available](https://www.interana.com/blog/understanding-value-data/), working existing systems to their fullest potential with first-party data is the easiest way to get started bettering your advertising.


3 Key Strategies for Leveraging First-Party Data to Improve Your Ads

Because paying “per user” doesn't factor in activity levels, you could be drastically overpaying



Depending on your industry, the traditional identity and access management (IAM) provider's pricing structure could be costing you millions of dollars every year.

It comes down to how they define a “user.” Most IAMs charge on a direct per-user rate: $2 a user per month, $4 per user per month, and up from there.

What they don't do is distinguish between registered user and **active user**, someone who actually uses your product once a month(or more).

The VC Fred Wilson has observed that for virtually all web and mobile companies, only 30% of those who register/download the product are active on a [monthly basis](http://avc.com/2011/07/301010/).

For companies in some specialized industries, that percentage can dip even lower. In fields like insurance or healthcare, most “users” active once or twice a year, if that.

Despite this, the majority of IAMs still charge them every single month for _every single user_ they have on the books:

![Charges](https://images.ctfassets.net/23aumh6u8s0i/2gat7Vqlu8f4IO19MNOkW1/2b58b3ee103d1b471485cb3c06a4d998/charges)

![Another pricing](https://images.ctfassets.net/23aumh6u8s0i/6M9oumKecPGjdWwrE9oUDo/7e3f0bdc3178ff903c1c53f10576e007/another-charges)

![Centrify App Services](https://images.ctfassets.net/23aumh6u8s0i/5TKis1bZyerxCzl6hJbYGC/3b6b0f5f6d9591a06b383ff77e3032ea/centrifyappservices)

This pricing system can cost businesses millions of dollars a year because while they may have a total of 5 million users signed up with their service, only a given 100,000 use the service with any regularity.

Or, because while hundreds of thousands may need to have accounts in order to protect sensitive information (like healthcare information or financial records), few need to sign in on a monthly basis. Or, some do, but they're mostly other healthcare providers using enterprise connections, not consumers.

For many types of businesses, paying “per user” as if all of these kinds of usage were the same simply doesn't make sense.

### What Gyms and IAMs Have In Common

For many types of businesses, the “per user” identity management pricing model is the worst of the classic seat-based pricing model combined with the psychology of the gym membership.

The business model of many gyms today relies on people [not showing up.](http://www.npr.org/sections/money/2014/12/30/373996649/why-we-sign-up-for-gym-memberships-but-don-t-go-to-the-gym) People sign up for yearly gym memberships, ambitiously. Then, they neglect to actually go. The fact that a majority of gym members do not regularly visit the gym drives prices down for everyone, and so the slackers subsidize everyone else.

While not exactly the same type of business, Americans only visit their doctors [4 times a year](https://www.forbes.com/sites/niallmccarthy/2014/09/04/americans-visit-their-doctor-4-times-a-year-people-in-japan-visit-13-times-a-year-infographic/#56a1f24ee347). Even if you assume that people will interact with their healthcare provider's online dashboard upon each occasion of them visiting, that's still only 4 logins per year. If you're paying your IAM a flat fee per “user” every month, but only a handful of those users use your product every year, you're paying for a lot of services you don't really need.

Avoiding the topic of consumption when talking about pricing is a [common problem](https://hbr.org/2002/09/pricing-and-the-psychology-of-consumption). Companies try to get you to pay upfront for services, knowing you probably won't use them to the fullest extent possible.

![Payments](https://images.ctfassets.net/23aumh6u8s0i/1F5bb4wuN0iU8mKSZUs4J9/3b97b96d4f0c857573fa1d8a59048cd6/payments)

(Source: [HBR](https://hbr.org/2002/09/pricing-and-the-psychology-of-consumption)) _When you pay annually for a service, your usage drops off steadily throughout the year as the financial impact of payment becomes a distant memory._

However, businesses that mask how much you've spent on a service (vs. how much value you've gotten out of it) often wind up “trading off long-term customer retention for short-term increases in sales.”

Sooner or later, in other words, we realize that we've been paying $50 a month for a gym membership we never use, we do the mental math, and we cancel.

### The Low-Active-User Enterprise

There are many industries out there affected by the kind of inefficient pricing model described above, with insurance and healthcare as two of the most prominent.

Americans file auto collision insurance claims about [once every 17.9 years](http://www.foxbusiness.com/features/2011/06/17/heres-how-many-car-accidents-youll-have.html). They file homeowners insurance claims every [9 to 10 years](http://finance.zacks.com/average-homeowner-file-insurance-claims-8387.html). During the 4 visits Americans make to the doctor annually, they don't log in to their [healthcare provider's online dashboard](https://auth0.com/blog/how-identity-can-empower-healthcare/)—they just hand their identifying information over. And yet in these industries, healthcare and insurance, having continuous, [HIPAA—certified](https://auth0.com/learn/why-hipaa-compliance-is-vital-your-business/), secure identity management is a must.

Let's say you're an insurance company and only about 5% of your overall users actually sign into your online portal each month.

We give away Auth0 support for up to 7,000 active users for [free](https://auth0.com/pricing). However, you could support 140,000 _registered _users on that plan if only 5% of your users log in every month.

When you're ready for multifactor authentication, compliance-ready reporting and enterprise connections, you can upgrade to a fuller plan and _still _pay per active user, just $1,025/mo with 7,000 active users and 100 enterprise customers.

![Auth0 Pricing](https://images.ctfassets.net/23aumh6u8s0i/4v7lWiuk5bHsPTFJatFJc8/e6ec5783cdf3a43e9a5d4556fc863f16/pricing)

If you have 140,000 overall users, but only 5% log in every month, you're still going to pay $4 per _every _user every month. That's $560,000 every month.

That's a price point that just doesn't make sense if you're a business with a low overall active user count. When usage of a product varies so greatly across different industries, per seat pricing models should take that into account.

It's not just insurance and healthcare that face these kinds of problems. Government agencies experience them too, as we can see from a FEMA Request for Information drafted while the agency was in search of a new IAM solution:


**Note:** It is a desire of the Agency to obtain a pricing approach that supports the **variable nature of the size of the FEMA user community**. During periods after large disasters and other events, the Agency user-base may substantially increase in size for a period of time. The vendors should provide creative pricing structures, where possible **such that FEMA does not have to pay / pay less for accounts that are infrequently used**, but still active (e.g., FEMA’s Disaster Reserve Workforce needs quick access when they are activated, but may not be active for long periods of time).

(Source: [FCW](https://fcw.com/articles/2009/01/27/fema-seeks-it.aspx))

FEMA doesn't want their IAM to charge them for hundreds of thousands of users when the total number in the Agency's userbase will be far lower the majority of the time. Nor do insurance providers, healthcare companies, or any business with these kinds of variable levels of activity. When they do, they're effectively subsidizing the price paid by B2C and B2B products with much higher activity-to-user ratios.

### Transparency In Pricing

[Value-based pricing](https://en.wikipedia.org/wiki/Value-based_pricing), as opposed to competitor or cost-based pricing, aims to track the price of a product or service to the perceived value that it delivers to its customers.

We believe transparency and [pay-for-what-you-use pricing](https://auth0.com/pricing) help us get our pricing in line with our value.

If you need [secure login](https://auth0.com/lock), [enterprise connections](https://auth0.com/docs/identityproviders#enterprise), and [multifactor authentication](https://auth0.com/multifactor-authentication), but the level of activity among your user base is unevenly distributed or highly variable, we believe you should pay a different amount than a product where 50% of all users are active on a monthly basis.

Not just because it can be a cost savings for you, but because it means that you're paying for the services you're receiving, and no more, not subsidizing all of the social apps and networks of the world. 


Why Your IAM's Definition Of “User” Could Be Costing You Millions

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing.<br/><br/> Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

Don't be daunted by how much of your system needs replacing. We'll show you how to get started.



<div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>Forrester Consulting analysis determines that using Auth0 can yield a 548% ROI and $3.7M in identity-related savings. Read the full report: <a href="https://resources.auth0.com/forrester-tei-research-case-study/">Total Economic Impact of Auth0</a>.</strong>
</div>

---

If you're dealing with a legacy system, you might need a complete overhaul. It's likely that many services have become outdated over the last 10 years you've had it, and patches don't really work long-term.

Legacy systems aren't good for business or your engineers' well-being, they keep you from introducing modern features while forcing the team to run around fixing bugs. However, a lot of companies stick with their legacy systems even when they know how badly they [need to modernize](https://auth0.com/blog/the-role-of-identity-in-application-modernization/). A major factor holding teams back is that you can't do an overhaul all at once.

That's ok, you just need to find your pain points, prioritize, and get started with some quick wins. We'll first talk about how legacy systems are damaging, and then lead you through how to locate the places in your system that need the most work, how to prioritize by cost, benefits, and alternatives, and how to update one piece at a time.

## How legacy systems hurt you

Legacy systems are structures that run on outdated technology, but that a company is still heavily reliant on. Using legacy systems can cost you money, time, quality, and trust. These are some of the biggest headaches of legacy systems:

* The old hardware needed to run legacy systems is rare, and thus more expensive (consider pagers, still widely used by hospitals and costing them about [$180,000](https://www.altexsoft.com/whitepapers/legacy-system-modernization-how-to-transform-the-enterprise-for-digital-future/) a year).
* Legacy systems were often built without modularity, meaning they don't include the code-sharing of modern systems and thus require changing many blocks of code, instead of just one, to make an alteration.
* The vendor who sold you your system may no longer support it, or even exist, which makes patching the system much more difficult.
* As staff who implemented the legacy system leave or retire, you need to train newcomers to use the system.


![How legacy systems hurt you](https://images.ctfassets.net/23aumh6u8s0i/2XhloKwu4vbzqUcEGZmrGy/aba30fe8f5ef9a536ac2de71e57445f5/legacy-systems-dilbert)

_[Source](http://dilbert.com/strip/2006-12-08)_

* Legacy systems often have backdoors to databases built in, making you an easy target for hackers.
* As your system accumulates little patches over time, it becomes more complicated and more prone to breakages.
* Legacy systems don't rely on open standards, so integrating with new technology is sometimes impossible.

Despite all these problems, companies are often reluctant to spend the time and money to replace these systems because it can cripple their short-term ability to innovate. They also risk eroding customer confidence in the product if a [customer might experience](https://www.zendesk.com/resources/why-companies-should-invest-in-the-customer-experience/) adverse, if temporary, effects.

For example, a football stats app may not want to make drastic changes which could cause downtime right before the playoffs, the night before the Super Bowl, right before the draft, or when fantasy football starts, leaving them feeling like there might not be any good moment to tackle upgrades.

But the issues with legacy systems will get larger and larger over time—the longer you wait, the more entrenched you'll be, and the less vendor support you'll have during a switch.

![How legacy systems problems get bigger and bigger](https://images.ctfassets.net/23aumh6u8s0i/3q0fFL6UqspTLpi34otcW9/b252be30e856c44cd7a82b7dd7076a37/legacy-system-dilbert-02)
_[source](http://dilbert.com/strip/2017-02-22)_

In addition to all the other problems above, legacy systems can cause you to miss out on new security protocols. In an area near and dear to our hearts, [authentication](https://auth0.com/blog/is-passwordless-authentication-more-secure-than-passwords/), legacy systems using sessions and cookies no longer cut it with modern applications.

You can learn more about how sessions and cookies work [here](https://auth0.com/blog/5-steps-to-add-modern-authentication-to-legacy-apps-using-jwts/), but what you really need to know is that the process requires the server to save the user's authentication state. This state is then referenced whenever the user makes a request. This protocol works fine for traditional apps, but today apps are deployed across many servers, use RESTful APIs, and rely on downstream services. All of this runs slower when using [stateful](https://nordicapis.com/defining-stateful-vs-stateless-web-services/) systems rather than stateless ones, like JSON Web Tokens (JWTs).

Sticking with your legacy systems prevents you from harnessing the full benefits of this new technology.

## Identifying ways to modernize your system

If your system does need an upgrade pretty much everywhere, how do you know where to start? You likely only have the resources to take care of a few issues at any one time.

The first thing you need to do when looking to modernize your system is to [find your pain points](https://www.altexsoft.com/whitepapers/legacy-system-modernization-how-to-transform-the-enterprise-for-digital-future/) by following these three steps:

* Check which parts of your technology stack are no longer supported by their vendors.
* Conduct an architecture audit to determine how each area is performing, and how patched it is already.
* Create a flowchart, using a tool like [Gliffy](https://www.gliffy.com/), of how different parts of your legacy system work together.

The architecture audit is what comes to mind first when looking for pain points, but the other two steps are just as important. Checking for vendor support tells you how easy it will be to get help and updates for parts of your system, and the flowchart will reveal dependencies, one section may only appear weak because it's dependent on another one, which is actually the problem.

After you've created your list of pain points, you can perform a cost-benefit analysis for replacing those individual parts of your system with a new service, or simply patching them up. The short-term costs of replacement will always loom, but when you calculate the long-term saved repair costs, increased efficiency, and customer satisfaction, you may find that this outweighs the negatives.

## Prioritizing improvements

Once you know how much you'll gain (and lose) from replacing the parts of your system that hurt you the most, you need to be able to prioritize.

Distill your cost-benefit analysis of each of your pain points into the answers to three questions:

1. What will the company gain from replacing this portion of our system?
2. How much time/effort will we need to pull off this replacement?
3. How helpful would just patching this part be in the long-run?


This will form the basis of selection for what to work on first.

![Prioritizing Improvements](https://images.ctfassets.net/23aumh6u8s0i/4jOcbba0mNQETjHPt2kYfq/f057874cef16ecb438148e45efaed307/prioritizing-improvements)

Check out our diagram above: You want to take on the problems that will get you the most value quickly. Notice that our chart shows preference for 'minimal time to replace' over 'higher benefit' (compare rows 3+4, or 5+6), that's because every bit that you update and separate from the rest of your legacy system declutters it and frees up your engineers' time.

Taking the time to dissect and prioritize at the beginning will ultimately make your modernization a shorter, easier process. It transforms your daunting update into a feasible plan.

## Updating one section at a time

Now we'll discuss how to get started on those improvements. The two things to focus on are a microservices-based approach and getting yourself some quick wins!

### Moving toward Microservices

You should look to remove pain points from the rest of your stack rather than simply replacing them. Following this process will guide you toward a microservice-based system, in which an application is separated into small sets of services. Once your monolithic legacy system is reconfigured as microservices, each service can further evolve without disrupting the rest of your system.

![Moving toward Microservices](https://images.ctfassets.net/23aumh6u8s0i/2Ye6NV4YgqkhjgVTL68ATc/7c26590bbf10fd7ad42269e6c389c366/moving-toward-microservices)
[*[source](http://soolan.com/microservice-architecture-implementation/)*]

Keeping microservices in mind will help you today and in the future when small parts of your system can be easily updated as needed.  You don't want to keep your system monolithic and end up with the same complicated, entangled mess 5-10 years in the future.

### The quick first step

Every app is going to have a slightly different list of priorities. But three areas that are usually a great place to start for quick and high value are [payments, messaging, and identity](https://auth0.com/blog/getting-a-competitive-edge-with-a-microservices-based-architecture/). These areas all have comprehensive solutions which let you offload critical functionality to a 3rd party SaaS product in a snap.

* **Payments. **Customers have come to expect a seamless online payment system, and there's no point to risking turning them off by relying on your legacy system when platforms like Stripe and Zuora provide fast, well-trusted payment processing.
* **Messaging. **Messaging too has become an essential part of any app as customers no longer only interact with a product through email. But with products like Twilio, your team doesn't have to worry about any of it.
* **Digital identity.** Identity is one of the most complex items a company has to deal with, and one tiny mistake can result in a devastating data breach. Trying to constantly make changes to keep up with security protocols by adding [multifactor identification](https://auth0.com/learn/get-started-with-mfa/) and breached password detection to your legacy system is a disaster waiting to happen. When you work with providers like Auth0, all the facets of identity, [authentication, authorization, user profiles, and security](https://auth0.com/blog/the-role-of-identity-in-application-modernization/) are taken care of by us.

When you get started on modernizing your system, the rest of it will still be problematic. You want your first steps to be handled by experts, far away from your hiccuping legacy system. But once you get those first steps done, you'll already be so far ahead of your old system.

## Upgrade before you get left behind

Modernizing a legacy system can seem impossible, but breaking it down into small pieces will help you get started.

This is a task you cannot procrastinate on, it will just get harder and harder to maintain your legacy system. Switch over now and reap the benefits of a modern system instead of waiting to be forced into a more painful, more expensive switch later on.

Don't be like the [52%](http://www.techradar.com/news/more-than-half-of-businesses-still-rely-on-windows-xp) of businesses that still run instances on the long outdated Windows XP, you're better than that.


How Do I Modernize my Legacy System?

Security measures should augment productivity, not impede it



Your company would never let a random person walk through the front door of the office without authorization, grab a cup of coffee and start going through confidential files. In the digital workplace, this is exactly what is happening, minus the coffee.

Today, work happens in the cloud on multiple devices, which means your company's data and systems are accessible from anywhere.

You have to find new ways to manage your employees' identities and permissions, so the right people have access to the right systems and data. While security is critical, adding too many security measures hampers productivity.

So how do you balance security and productivity within [the modern digital workplace](https://www.interana.com/blog/how-leading-companies-are-tackling-the-challenges-of-digital-transformation/) where employees are using unsanctioned devices, running hundreds of applications and sharing company resources with outside partners?

Start with an identity and access management (IAM) tool that is designed to keep up with the pace of digital transformation.

### Simplify the digital workplace with IAM

Software for businesses is booming. But hundreds of applications running on unsanctioned devices poses a huge security risk and keeps IT professionals up at night.

While the complexities of managing access across so many tools and devices is a huge challenge, the benefits of the digital workplace are ushering in a new era of productivity where employees can work anytime, in any place with anyone around the world. [Digital transformation](https://www.interana.com/blog/curiosity-got-cat-promoted/) is moving fast, and it's your job to stay ahead of the game.

![The complexity of one employee's digital workspace](https://images.ctfassets.net/23aumh6u8s0i/3ILL4BCkM5rTmj9j8Y7aXd/f1114e008ecd6950c0173d3841eb0861/complexity)

[[Source](http://www.zdnet.com/blog/hinchcliffe/)]

That's why cloud IAM tools, like [Auth0](https://auth0.com/b2e-identity-management-for-employees), are growing so quickly. IT departments no longer need to manage access and authorizations in-house, or scramble to keep up with securing every new application and cloud system that employees bring into the corporate environment.

IAM tools simplify the complexity of the digital workplace by managing all of your user identities and access permissions across your internal systems, employee devices and cloud-based technologies. All of your users, both internal and external, are authenticated and authorized based on the roles that you set within one easy-to-use system.

IAM allows you to keep up with the pace of technology, but more importantly, the security features are designed to enhance productivity. Your organization can maintain high-level security measures, while removing the barriers that interrupt a productive workflow.

### Better productivity without a security compromise

Employees expect a quick and seamless experience when accessing all of their tools. When a user can't log in or is locked out, valuable time is lost contacting a help desk. Productivity comes to a screeching halt.

The whole point of [digital integration](https://amplitude.com/blog/2017/05/18/analytics-stack/) is to be more productive by eliminating tedious and repetitive tasks, including logging in to multiple applications every day. So how can you keep security and permissions in place while eliminating individual logins for every single application? Single sign-on.

In the same way your Google sign-on gives you access to several other applications like Google Analytics, Youtube, and Adwords without re-entering your username and password, good identity management will enable your organization to implement a [single sign-on ](https://auth0.com/blog/what-is-and-how-does-single-sign-on-work/)for your entire network.

Once users create their single sign-on (SSO) credentials, they'll no longer have to waste time logging in over and over, giving them a seamless work experience regardless of the application, device or domain.

![Single Sign On](https://images.ctfassets.net/23aumh6u8s0i/74KAL716uJ2wcnwhseJXRa/95dad10d4d42fabbd20490467815eb93/singlesignon)

Single sign-on drastically reduces IT help desk tickets and centralizes admin tasks like password resets. When a password is revised, the change automatically updates every app and system connected to the SSO. IT no longer spends all day helping users with access issues, while your employees enjoy a seamless, more productive work experience.

### Added security that provides flexibility

Employees need the flexibility to work on any device or register a new application to conduct business, but the proliferation of 3rd party applications has broadened the security surface area far beyond any internal IT department can manage.

Cyber threats have become an everyday reality for both large and small businesses. The [2016 Cyber Security Intelligence ](http://ibm.biz/2016CyberIndex) found that 60% of data hacks involved an employee's access data. Either a hacker used an employee's credentials or the employee abused their access privileges.

IAM tools that offer [multifactor authentication ](https://auth0.com/multifactor-authentication)(MFA) provide an extra layer of security that allows your team to use any devices and sign up for new applications without the worry of compromising credentials.

MFA is one of the best ways to identify and verify a user. By asking them for several pieces of information through various stages, the user must demonstrate knowledge (E.g. password or pin number) and possession (E.g. mobile phone). For example, a user is prompted to input their password, which triggers an SMS message with a unique code.

![Multifactor](https://images.ctfassets.net/23aumh6u8s0i/1AUVdavXrQLYR1Y5WFA0N0/6f190786a9012296aca348c5474d8887/multifactor)

[[Source](http://it.miami.edu/_assets/images/multifactor1.png)]


When something unusual is detected, such as a sign-in attempt from a new device, MFA requires the user to have two or more types of ID proof before gaining access. If your password is compromised, your account remains safe. Apps like [Auth0 Guardian](https://auth0.com/multifactor-authentication) offer easy setup for MFA security.

Multifactor authentication offers the flexibility for employees to securely access their resources wherever and whenever, enhancing their productivity.

### Automated permissions keeps business moving

The basic idea behind IAM is to grant each user access to their authorized resources using one set of credentials, which helps streamline IT's workload in tracking permissions. But the bigger challenge for IT is in keeping up with each user's ever-changing privileges status.

In a given week, you can have new employees needing access to start working, other people leaving the company who need their access terminated, and a variety of other employees changing roles, who require different levels of access.

Tracking each user's permissions within an organization is nearly impossible. Your IT team shouldn't waste their valuable time trying to keep up with these constant changes.

The right IAM tool centralizes control of identity and access with an interface that helps you manage every aspect of user ID including automating authorizations, creating and provisioning users, password resets and blocking and deleting users.

![Users](https://images.ctfassets.net/23aumh6u8s0i/G9b0mA8dKR8wYPxtlG2g5/abff6316bcae956309520dcb89242cb1/users)

Administrators can stay ahead of the constant changes by defining security protocols for specific applications and granting permissions to users to access resources at different levels from a central control panel. For example, when an employee leaves the company, your human resource system triggers IAM to terminate access for that user.

You can also automate authorizations by setting rules that define user requirements, such as by devices, location or by limiting unsanctioned applications from connecting to your corporate environment.

When an employee's status changes, they can't wait days for access. Automated permissions and centralized user management help you keep up with the daily authorization changes.

### Stay ahead of your company's digital transformation

Your digital workplace is constantly evolving as [technology continues to evolve](https://amplitude.com/blog/2017/04/26/digital-transformation-yellow-pages/). Employees have the tools and access to information to be more productive. The goal is to keep your company's resources secure without hindering this new level of productivity.

The right IAM technology solution should deliver the best-in-class security measures that work to create a flexible and efficient workflow for employees across all of their tools. When users have a great work experience, they probably won't thank you, but they will work faster and smarter, which helps the company succeed.


Enhancing Productivity With Identity and Access Management

DPM, a Microsoft tool, lets you back up various forms of enterprise data in real time.



After the February 1st, 2017 Gitlab incident, in which six hours of production data were accidentally deleted, the importance of making and maintaining adequate system [backups became very clear to the world](https://about.gitlab.com/2017/02/10/postmortem-of-database-outage-of-january-31/).

As we saw in that incident, a lot of companies make backups. What they seem to forget is that backups are just one part of the equation. It's equally important to consider how those backups will be accessed during an outage, whether it will be possible to restore them in a timely fashion, and what tests need to be consistently run to ensure adequate restore.

If you work within a Microsoft ecosystem, then Data Protection Manager (DPM) is a powerful option for creating and managing backups of all of your data.

### How DPM Works

You can configure DPM to back up your folders and volumes, create full system backups, initiate backups of workloads like SQL Server or Exchange, backup entire Hyper-V virtual machines, and more. Information can be backed up to disk, tape, or to the Microsoft Azure cloud:

- **Disk-based:** In DPM's disk-based protection, a copy of your data is generated, stored, and regularly refreshed on the DPM server. Separate copies are made and maintained for different data sources such as database instances or volumes from a server cluster.
- **Tape-based:** DPM also offers tape-based backups, and though it is mainly intended for long-term storage (where it's combined with disk-based backups for the short-term), you can back up your data primarily to tape.
- **Azure-based:** Whether you deploy DPM as a physical server or Azure virtual machine, you can back up your data to an Azure Recovery Services vault as an alternative to long term tape-based protection.

In the event of a disruption, DPM allows you to immediately restore all of that data.

### Best Use Case Scenarios for DPM

If you're a small business with just one office, or you're backing up volumes that are rarely on-premises, then a more simple, scaled-back solution like Azure Backup agent might be [right for you](https://docs.microsoft.com/en-us/azure/backup/backup-introduction-to-azure-backup). Azure Backup supports backups of both files and folders, but it won't back up VMs, applications, or workloads.

The following kinds of data and workloads can be backed up using DPM:

- Files
- Folders
- Volumes
- Hyper-V VM (Windows)
- Hyper-V VM (Linux)
- Microsoft SQL Server
- Microsoft Sharepoint
- Microsoft Exchange

([Source](https://docs.microsoft.com/en-us/azure/backup/backup-introduction-to-azure-backup))


Microsoft has also put out a slightly less scaled-back version of DPM, [called Azure Backup Server](https://4sysops.com/archives/microsoft-azure-backup-server-mabs-vs-data-protection-manager-dpm/). It's a available for free when you download Azure Backup. Azure Backup Server also offers backups of workloads and other data sources, with some key differences:

- Tape-based protection is only offered with DPM
- DPM allows redundant backups—where you can protect one DPM installation with another
- DPM will also perform recovery of Hyper-V replicas—Azure Backup Server will only do the backing up

Your choice of backup system should track with your needs:

- **I just need to backup files and folders**: Azure Backup agent
- **I need to back up more than files and folders:** Azure Backup Server
- **I need all-in-one management, tape-based protection, and better redundancy:** Data Protection Manager

### Aside: How We Do Backups at Auth0

We have designed Auth0 from the bottom-up to ensure that we can keep serving our customers in the event of any disruption or threat:

- **Infrastructure:** We use SaaS tools and hosts that offer redundancy, so an outage at a single data center or a single disk failing won't affect the continuity of our customers' services.
- **Personnel:** Our staff is distributed all around the world, capable of responding to any problem remotely, and all staff is cross-trained to ensure that there's always someone around that can respond to a threat.
- **Data Storage:** All critical data is stored in the cloud where it is subject to redundant backups. A rigorous testing schedule ensures that all of our backup procedures themselves are operating correctly.

The risk of system failure is always with us, which is why we've worked hard to mitigate that risk through these practices.

![How DPM works](https://images.ctfassets.net/23aumh6u8s0i/3ZUjImSskjBdoSUeoMQdrZ/361224d289fc4f80e945140f5db12db3/auth0)


How Data Protection Manager (DPM) Works

99c4080f412ccf46b9b564db7f482907?s=200 avatar

99c4080f412ccf46b9b564db7f482907?s=200

I'm currently a Senior Developer Advocate at MongoDB. I'm also a Google Developer Expert for Web Technologies and spend most my time giving talks at conferences and meetups, mentoring developers and running workshops, and creating online content to help technology professionals.

Former Auth0 Employee

Ado Kukic

Learn why identity is the right component to modernize first in your digital transformation journey.



<div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>Forrester Consulting analysis determines that using Auth0 can yield a 548% ROI and $3.7M in identity-related savings. Read the full report: <a href="https://resources.auth0.com/forrester-tei-research-case-study/">Total Economic Impact of Auth0</a>.</strong>
</div>

---

Digital identity is at the core of any application - invisible yet crucial. We often take identity for granted as most of its magic happens behind the scenes. But identity plays a much larger role beyond the login screen for your applications. At a high level, we can break up identity into four distinct components: authentication, authorization, user profile, and security.

![Authentication](https://images.ctfassets.net/23aumh6u8s0i/67qEWKZ4IrYyWu7msBhHo5/d210fc4edddcd5f832727a3c9b3a9b7c/authentication)

## Authentication

Authentication dictates the way a user logs into your application. While in the past, a simple username and password form did the trick, today it is much more complicated. In addition to providing the traditional means of authentication, social connections through providers like Facebook and Twitter, enterprise federation and single sign on (SSO), and even passwordless authentication are becoming the norm. Implementing all of these various types of authentication methods in your application is a tiresome, repetitive, and expensive task.

![Authorization](https://images.ctfassets.net/23aumh6u8s0i/3xJ0fCozdfmFc3brsLnDE0/ccafe0e415bb88c0a1da51ca7b51e933/authorization)

## Authorization

Authorization is tasked with ensuring the right users have the right access at the right time. Admins of your application should easily be able to make system wide changes, while regular users can only make changes to their accounts for example. From small businesses to large enterprises, access has to be fine tuned to ensure that the right users have access. Multiple departments, complex hierarchies and groups, and users moving throughout the system need up to date access to work effectively. Access is very important to making sure your application operates as intended and getting this aspect of identity right can be quite challenging.

![Security](https://images.ctfassets.net/23aumh6u8s0i/1dMwIvLWqoN21PQ790xNGA/9e44b70c1f7b52f8b167b57c528c1a41/user-profile)

## User Profile
The user profile is concerned with the data that your application has collected on each individual user. The better you know your users the better experience and personalization you can provide. With disparate networks and various sets of data floating all around the web, it can be difficult to get a clear understanding of your users, but companies that can will have an upper hand.

![Security](https://images.ctfassets.net/23aumh6u8s0i/3NyEKlPGMbZxGN1IxxIZHR/73722014fa0c8f2b84a9c1058ebd3a64/security)

## Security

Finally, the security part of the modern identity story ensures that user data is protected both in motion and at rest. Security can be looked at through various lenses. The first, starts when a user attempts to login. Protecting user accounts at time of login with multifactor authentication, anomaly detection, and breached password detection are just some of the quick wins that will make your application more secure and stand out from the crowd. Ensuring data is protected at rest, passwords properly encrypted, and adherence to industry standards and certifications are other aspects of security that must be enforced.

## Application Modernization and Identity

Looking at identity as a constantly evolving and unified view of your user base, rather than a one-and-done requirement, will help you understand the importance of this component in your application. Application modernization is the refactoring, repurposing or consolidation of legacy software to align it more closely with current business needs. Whether you call it application modernization, digital transformation, platform refactoring or re-architecting, the need to have a software that meets the needs of your business is a priority. 

[Read our initial application modernization post](https://auth0.com/blog/getting-a-competitive-edge-with-a-microservices-based-architecture/) to learn more about why application modernization is sweeping the software industry. In today’s post, we will look at how you can kickstart your modernization journey by tackling identity first.

Identity has to be done right, not as an afterthought or side project, making it an ideal candidate for a service that needs to be separated out from the legacy behemoth applications. Identity requires ongoing efforts to secure and maintain but expertise is scarce. Much like how you generally wouldn’t build your own database or email platform, identity is best left to experts whose sole job is to ensure that your platform is as safe and secure as it can be, leaving your developers to focus on your organization's core competencies.

![Modern Identity](https://images.ctfassets.net/23aumh6u8s0i/4EeT5pZAOfFGHHwXx5hsUW/247e8b25051cb9454622ce02e68440af/auth0-identity)

## Modern Identity with Auth0

Auth0 is an Identity as a Service provider that takes a completely new approach to providing a modularized, pluggable identity service by simplifying the most complex identity challenges with a powerful, secure, extensible, and easy to integrate platform. Rather than re-inventing the wheel when it comes to identity, leveraging Auth0, can help you reach your goals faster.

Wherever you are in your digital transformation journey, Auth0 can help. Whether you are re-building your legacy application from scratch altogether or going about a phased restructuring of the legacy system, it’s ideal to offload a the critical part of the application, which not your core competency or expertise, externally as a cloud-based service. With Auth0, you can do just this, and the benefits will be immediate including:

* **Code as an asset** - Stop every line of code from becoming a cost center - for maintenance, audit, upgrade and so on. The more you externalize using services, the lesser you actually pay. Auth0 _provides identity as a service, ensuring your identity remains an asset - always_.
* **Ease of deployment and integration** - Auth0 Identity works with any technology stack, language, and framework. Get your identity system up and running quickly within your existing ecosystem, and get back to modernizing the rest of the app.
* **Easy configuration to meet your needs** - Once Auth0 is integrated into your app, adding additional configuration, like multifactor authentication, anomaly detection, or breached password detection, is as easy as flipping a switch.
* **Support for virtually any identity source** - Username and password, social connection, enterprise federation, and single sign on (SSO). Auth0 allows quick and easy integration with any identity source you choose.
* **Flexible deployment** - Your apps are evolving but you still have legacy systems to work with. Auth0 gives you flexible deployment options - our public cloud, a private cloud controlled by Auth0, or, for AWS users, a private deployment in your own cloud.

Implementing a modern identity solution will present many benefits to your business. Providing your users multiple ways to access your application on their terms will lead to increased conversion rates. Having a better understanding of your users will allow you to provide a more personalized and enhanced user experience, increased user efficiency, and better management. Going above and beyond to protect your user data will build trust and loyalty as well.

Your users are not the only ones that will benefit. You will be able to react to market events faster, gain a deeper understanding of your users, and your developers will be able to focus on building software that makes your product stand out. Over 80% of Auth0 customers were able to go to production within two weeks and with over 42 million login transactions processed daily, Auth0 is ready to serve your users today regardless of where you are in your application modernization journey.

## Summary

The question is no longer “should we or shouldn’t we”, but rather “how do we modernize our platform” for current and future needs. The software industry is going through a radical transformation and legacy monolithic applications are no longer compatible with today’s business needs and user expectations. Application modernization is not something that can be achieved overnight and there are many paths to the end goal, but starting with identity is a surefire win-win for both your organization and your users.


The Role of Identity in Application Modernization

The need for application modernization is sweeping the software industry. It’s a challenge to know where to start, but we’ve got the quick wins that will get you on your way to modernization in no time.



<div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>Forrester Consulting analysis determines that using Auth0 can yield a 548% ROI and $3.7M in identity-related savings. Read the full report: <a href="https://resources.auth0.com/forrester-tei-research-case-study/">Total Economic Impact of Auth0</a>.</strong>
</div>

---

Traditionally, companies have built “monolithic” applications that addressed many business needs and intertwined business logic, user interfaces, and other components all in one. As the business grew, so did this application, adding more and more features, becoming harder and harder to maintain, deploy, test, and secure. These types of applications are commonplace today, however present numerous challenges to organizations looking to respond quickly, reliably, and efficiently to today’s changing business needs.

Monolithic applications slow organizations down. Long development cycles, high infrastructure and licensing costs, often single points of failure, and difficulty scaling are just some of the risks and challenges posed by these applications. Not to mention the difficulty of testing and fixing bugs, addressing vulnerabilities in such complex systems, and challenges integrating new technologies into the mix. In short, legacy architectures and monolithic applications are not compatible with today’s business demands.

Application modernization is the refactoring, repurposing or consolidation of legacy software to align it more closely with current business needs. Whether you call it application modernization, digital transformation, platform refactoring, or re-architecting the need to have software that meets the needs of your business is a priority. Nine out of ten decision makers claim that legacy software is keeping them from achieving their goals.

## Transitioning from Legacy Monoliths to Microservices

To remain competitive, organizations of all sizes are realizing that they need to be nimble, evolve fast, and maintain a healthy balance between customer expectations, business needs, and IT agility. Utilizing a microservices based architecture is a growing trend that helps achieve these goals. In this approach, applications are split into small sets of interconnected services based on business capability where each service has a well-defined boundary.

![Microservices](https://images.ctfassets.net/23aumh6u8s0i/18ttZOWoNAUgdI2sbKFdUP/4a46c78d26216ca770eae04087454988/microservices-example)

A good way to think about microservices is to think of them as individual lego pieces that come together to form something useful - like your ideal software. Each microservice can evolve independently based on the changing needs of the business. An easy way for organizations is to utilize SaaS vendors to fill in the feature and functionality gaps that are not core to the business, allowing the development teams to focus on building business value rather than re-inventing the wheel or so to speak.

The benefits of a microservices based architecture are clear. New features and functionality is much faster to develop, test, and deploy. Services can be deployed independent of each other and no single point of failure exists. Developer productivity and IT agility are increased, and the demands of business can be met head on. The challenge however is, knowing where to start.

## App Modernization Done Smart: Go For Quick Wins

Whether you are re-building your legacy application from scratch altogether or going about a phased restructuring of the legacy system, it’s ideal to offload critical parts of your application, which isn’t your core competency or expertise, externally to a cloud-based service. Using out-of-the box solutions will allow you to quickly implement key functionality. Some of the components that range from complex to almost impossible to build in-house but have various Software as a Service solutions are Payment Processing, Messaging, and Identity.

### Payment Processing
Payment systems have seen major disruptions in recent years and users are adapting fast. Whether it’s offering more payment methods such as cryptocurrency or direct debit payments, or ways to pay through contactless payments like Apple Pay or one-click buy, users are becoming accustomed to a seamless checkout experience. Payment processors like Stripe and Zuora are well known for providing payment platforms and APIs for enabling and managing all aspects of accepting payments via the Internet.

### Messaging

Given the number of communications channels available today, getting a consistent message to your users is harder than ever. Messaging is becoming more and more bi-directional and customers are increasingly engaging with organizations through social media, messaging bots, voice activated AI and more. Twilio is an example of a platform that provides messaging and communications services to handle SMS, voice, and other forms of communications to deliver consistent messaging across all channels.

![Identity](https://images.ctfassets.net/23aumh6u8s0i/4FP9tc3RggO7IwmtRgJlMn/9f722f14acd7c5eb5f2cc9783c58fe40/identity)

### Identity

Digital identity is at the core of any application - invisible yet crucial. An application of any nature requires digital identities, to [represent users and other entities interacting with it](https://auth0.com/user-management). With mobility, BYOD, IoT and smart entities becoming essential parts of the digital ecosystem, the “identity” piece of an application now has even more responsibilities and expectations than before.

Identity is complex. There’s username and password authentication, social connections, single sign on, and these are just ways to login. [Multifactor authentication](https://auth0.com/multifactor-authentication), [breached password detection](https://auth0.com/breached-passwords), anomaly detection, securing sensitive data like passwords, and many other topics comprise identity and having your engineers try to build, manage, and secure all these is like expecting an elephant to win a sprint race. You need to use their expertise at the right place.

Auth0 takes a completely new approach to providing a modularized, pluggable identity service by simplifying the most complex identity challenges with a powerful, secure, extensible, and easy to integrate platform. We will cover how Auth0 can solve your identity challenges in an upcoming article on modernizing your applications.

### Conclusion

Legacy monolithic applications are outdated and incompatible with today’s business needs and demands. Whether you are in the planning or re-architecting stage of your digital transformation, utilizing a microservices based approach alongside SaaS vendors is a sure-fire way to get quick wins and stay one step ahead of the competition.

Today’s blog post focused on introducing you to the quick and easy ways to get started on the  transformation from your legacy systems. In an upcoming post, we will dive deeper into how Auth0, as a Identity as a Service provider, can be a trusted partner in your modernization journey by solving your identity challenges and continuing to evolve as you do.


"modernization"