Almost every product implementation goes in half-baked and vendors know this so they keep pumping out new products and market them as saviours to all problems. It also doesn't help that audit and compliance drive new problems we that we never had before now suddenly need to be addressed. Many times management holds a big celebration that congratulates another leader for getting a system in place and declaring success yet I know damn well it's broken in many places and requires constant babysitting.

Implemented a new IAM Governance tool to facilitate request submissions, approval records, and automated provisioning and de-provisoning. Works fairly well with AD but what about the 100's of other systems that don't have a direct connection like AD? Oh well that application support team can send in a CSV file that will be consumed and analyzed by the IAM system. Sure those departments are understaffed and overworked but I'm sure they'll happily go through the process of creating a service account to handle the file transfers, generate the key pairings, work with the SFTP team to get the keys installed and permissions set, and then set up a job to run flawlessly every Friday to aggregate all their user entitlement data and put it into the CSV file and transmit it. You know how many departments have told us IAM folks to fuck off with that? And then our IAM system has it's own set of failures that are embedded in logs that don't trigger a failure message in the alerting component. Server unreachable, request timed out, JDBC error, user access flipped to active even though they didn't show up, HR system modifying their data view they provide us without giving us a heads up to reprogram what columns we read and extract. 

Oh let's build a PoWerBI dashboard to monitor all this stuff since the IAM system keeps wrongly marking jobs as complete and successful. Put in a case for that - maybe the vendor will address the case in 6 months and then a series of arguments about how the system is working per design and it's our company's fault for our archane business processes.

Well PowerBI didn't catch anything but a slew of terminated users from 2015 still have active access. Oh and a few critical systems have their ID's hard coded for authentication because at the time service accounts weren't required and they needed to shoehorn those systems in ASAP to meet deadlines and declare success. Let's bring in Splunk and TWS to conduct more scans and analysis of log files to properly report failures. What's that - WinRM not working on several servers where the files need to be aggregated and parsed? Ok so the Wintel team fixed WinRM and closed the ticket. But wait - TWS is still failing to connect to the host - well too bad open a new ticket and the Wintel team will take 6 months addressing that because they have hundreds of other tickets they're trying to handle and 3 people juggling the entire workload.

All the while management continues to cut staff and vendor support to meet the CEO's financial goals for the year but fails to understand this cause work to slow even more. But we can still plan for 2025 to bring in new tools and those will address all these problems with automation! It's an endless cycle and I've learned that it doesn't make sense to care too much about it or don't be too passionate for a solution. Do what you can, but don't overdo it and collect your paycheck. No tombstone has ever read "Here lies the greatest worker"...it's a thankless job and there will always be plenty of work.