During my presentation at the European Identity Conference, I decided to take a slightly different approach to the identity conversation and focus on the needs of the enterprise in an Identity2.0 world. For those that know me, this shouldn’t be a huge surprise, I spend about 12+ hours of my day working on MS IT’s Identity and Access Management team, and the rest of the time sleeping or playing with my kids…so what I realized, was that while it is important to deal with problems like phishing, and user consent in a consumer world…as an enterprise IT guy…I just really didn’t care that much about the consumer problems (but I’m glad there are people working on it).
When it comes to enterprise identities though, one of the things which I received some feedback on, was a comment that I made during my session which went something like this:
User centric principles are still valid and relevant in an enterprise, but you must remember who the user is. In an enterprise, it’s not the person sitting behind the keyboard, because they are not the owner of the digital identity. When a person is hired, the enterprise issues that person a digital identity, which the enterprise owns, and which may be used by the person on behalf of the enterprise. 2 quick examples:
1. When you leave your company, try to take your enterprise issued digital identity with you. If it’s yours, you’ll be able to have it, and all of the corresponding access that came along with it. But we all know that your account is terminated – and if not, then please go sit through some sessions on provisioning/deprovisioning.
2. When is the last time that an enterprise gave a user the option of determining what information they were going to send to a line of business application? I’m sorry Mr. Application, but my iCard says that you’re going to get my phone number, and I decline to give you this information…so I guess I just won’t do my job now. NOT!
Recognizing the importance of understanding “who” the user is, immediately makes things like how cardspace can be leveraged in an enterprise and the importance of identity selectors in transitioning between user accounts much more interesting.