One Identity Manager and Safeguard, run by people who read the sync logs.
We implement, upgrade and support One Identity Manager and Safeguard. That means the synchronization projects, attestation policies and custom processes that decide whether the platform keeps up with your joiners and leavers.
Cohash implements, upgrades and supports One Identity Manager and the Safeguard privileged access products.
We build target system synchronization, attestation, request workflows and role models, and we connect Identity Manager to Safeguard so privileged access is governed like other access. For Identity Manager 10.0, announced in January 2026 with a browser-based admin interface, we inventory custom scripts and processes before planning the upgrade.
you probably need this if
Every morning the DBQueue is thousands of tasks deep, and nobody can tell you which process put them there.
Custom scripts written years ago block every Identity Manager upgrade.
Attestation cases sit open past their due date and get closed in bulk.
20 Jan 2026Identity Manager 10.0 announced Major release with a browser-based administration interface that needs no desktop install, ITDR playbooks, AI-assisted reporting and Syslog CEF output. Availability details were not in the announcement. source ↗
26 Jun 2026One Identity to become independent Previously part of Quest Software (acquired by Clearlake Capital in 2021). Cork becomes global headquarters, with the transition running through 2026. source ↗
today · Oct 22, 2026
the story · one identity estate
From the first call to a setup your own team can run.
Here's what usually prompts a call about your One Identity estate, what we do about it and in which order, and where you end up.
01 · where it hurts02 · what we change03 · how it runs04 · where you end up
incident board · one identity estate3 open
openEvery morning the DBQueue is thousands of tasks deep, and nobody can tell you which process put them there.
recurringCustom scripts written years ago block every Identity Manager upgrade.
blockedAttestation cases sit open past their due date and get closed in bulk.
exposure
Identity Manager upgrades…Target system synchronizationAttestation and request designSafeguard and Identity Manager…Health checks and support
S/4
startrehearsehandover
Health check
Customization inventory
Rehearsed upgrade
Cut-over and handover
we are here
ready to hand over
New starters get accounts the same morning, and the team can see queue depth before…
Privileged access is requested, approved and reviewed in one place, and the audit…
Custom script, process and schema extension inventory with keep, rewrite or remove…
Identity Manager upgrade runbook with timed rehearsal results
chapter 01 · where it hurts
Why teams reach out
Every morning the DBQueue is thousands of tasks deep, and nobody can tell you which process put them there.
Custom scripts written years ago block every Identity Manager upgrade.
Attestation cases sit open past their due date and get closed in bulk.
chapter 02 · what we change
How we solve it
Identity Manager upgrades, including 10.0
Target system synchronization
Attestation and request design
Safeguard and Identity Manager integration
Health checks and support
chapter 03 · how it runs
Our approach
Health check
Customization inventory
Rehearsed upgrade
Cut-over and handover
chapter 04 · where you end up
What changes
New starters get accounts the same morning, and the team can see queue depth before users start calling the help desk.
Privileged access is requested, approved and reviewed in one place, and the audit evidence comes from one system.
Custom script, process and schema extension inventory with keep, rewrite or remove decisions
Identity Manager upgrade runbook with timed rehearsal results
what we do
Our One Identity work
5 kinds of One Identity work, each run by engineers who have done it on live tenants.
An inventory of custom scripts, processes, templates and schema extensions, then an upgrade rehearsed on a copy of the production database with timings recorded.
Synchronization projects for Active Directory, Entra ID, SAP and databases, with mapping rules documented and revision filters set so full syncs stop running every night.
Attestation policies, approval workflows and IT Shop structure designed around who can actually answer the question, not around the org chart.
Safeguard for Privileged Passwords assets and entitlements requested and attested through Identity Manager, so privileged access goes through the same review as everything else.
A review of the job queue, DBQueue backlog, server roles and custom code, with a ranked fix list and runbooks for the issues that recur.
capability 01 / 05in production
S/4
Identity Manager upgrades, including 10.0
An inventory of custom scripts, processes, templates and schema extensions, then an upgrade rehearsed on a copy of the production database with timings recorded.
Synchronization projects for Active Directory, Entra ID, SAP and databases, with mapping rules documented and revision filters set so full syncs stop running every night.
Safeguard for Privileged Passwords assets and entitlements requested and attested through Identity Manager, so privileged access goes through the same review as everything else.
We pieced these together from One Identity situations that come up a lot. They're patterns. You won't find a specific client in them.
case file 01
Identity Manager with a DBQueue that never drains before 10 a.m.
composite · not a client story
Beforethe situation
Provisioning from HR runs hours late every morning. The DBQueue backs up after the nightly HR import, and a handful of custom processes fire on every person change, even when nothing relevant moved.
What we dothe work
We trace which processes and DBQueue tasks run after the import, add generating conditions so custom processes only fire on the columns that matter, and move full syncs to revision-based runs. Then we set alerts on queue depth.
Afterwhere you end up
New starters get accounts the same morning, and the team can see queue depth before users start calling the help desk.
case file 02
Safeguard running beside Identity Manager with no shared review
composite · not a client story
Beforethe situation
The infrastructure team rolled out Safeguard for Privileged Passwords on its own. Identity Manager governs everything else. Auditors see two separate access processes, and privileged entitlements have never been attested.
What we dothe work
We map Safeguard entitlements to IT Shop products, connect Identity Manager to Safeguard so requests and removals flow through the same approvals, and add privileged entitlements to the quarterly attestation policy.
Afterwhere you end up
Privileged access is requested, approved and reviewed in one place, and the audit evidence comes from one system.
approach
How a One Identity engagement runs
We don't start a step until the last one has produced something you can check.
step 01
Health check
We read the job queue history, DBQueue statistics, sync project logs and custom code, then rank what is slowing provisioning or blocking an upgrade.
step 02
Customization inventory
Every custom script, process, template and schema extension gets an owner, a purpose and a decision: keep, rewrite or remove before the upgrade.
step 03
Rehearsed upgrade
We upgrade a copy of the production database with the Configuration Wizard, run the sync projects against test targets and record timings for the real window.
step 04
Cut-over and handover
We run the production upgrade with your team, watch the job queue until it drains and hand over runbooks for the jobs that fail most often.
ai on one identity
Where AI fits on One Identity, and where it needs guardrails.
One Identity has little vendor AI so far. Identity Manager 10.0, announced in January 2026, lists AI-assisted reporting alongside ITDR playbooks and Syslog CEF output, but One Identity hasn't published availability details or an MCP server. Most of the AI value here comes from work around the platform: documenting old customizations, mapping migrations and triaging sync logs.
AI agentasks for data or an action
Scoped identityonly the access it needs
MCP serverthe one door into the platform
Logged, approveda person signs off on writes
One Identitydoes the work
One Identity doesn't publish an MCP server that we could find. So agents use the Identity Manager REST API with a dedicated service account. Start it read-only and log every request. Before any write or provisioning change, a human approves.
AI-assisted reporting in Identity Manager 10.0
One Identity named AI-assisted reporting as part of 10.0 but published no availability details in the announcement. We'd test it on a copy of your data once it ships, before anyone relies on it for audit evidence.
Documenting legacy customizations
An Identity Manager estate that has run for years is full of custom scripts, processes and schema extensions nobody fully remembers. We export the scripts and have an AI assistant draft plain-English documentation. An engineer then checks it line by line.
Sync and job log triage
Failed sync and job queue entries pile up quietly. We let an agent read the logs, group the errors by cause and suggest fixes. An engineer still makes any connector change.
How One Identity Manager governs accounts and privileged access
HR records drive joiner, mover and leaver events into Identity Manager. Identity Manager synchronizes accounts to directories and business applications, sends privileged entitlements to Safeguard and runs attestation so owners confirm access on a schedule.
ServiceNowaccess requests → One Identity Manager · requests
02 · Identity Manager
One Identity Managersync projects · IT Shop · roles → Active Directory · sync→ Entra ID · sync→ SAP · role assignment→ Safeguard · entitlements→ Attestation · attestation cases
Attestationmanager · owner reviews
03 · Targets
Active Directoryaccounts · groups
Entra IDcloud groups · licenses
S/4
SAProles · profiles
Safeguardprivileged passwords · sessions
Read the diagram as text
HR system → One Identity Manager: joiner · mover · leaver
ServiceNow → One Identity Manager: requests
One Identity Manager → Active Directory: sync
One Identity Manager → Entra ID: sync
One Identity Manager → SAP: role assignment
One Identity Manager → Safeguard: entitlements
One Identity Manager → Attestation: attestation cases
use cases
Typical One Identity projects
The work teams usually bring us, and the platforms One Identity has to talk to while we do it.
ONE-01Identity Manager upgrades keep slipping because nobody knows what the custom scripts do
common request
ONE-02The DBQueue backlog grows every morning and provisioning runs hours behind HR
common request
ONE-03Attestation still happens on paper, because the policies spit out thousands of items nobody can make sense of
common request
ONE-04Nobody reviews privileged access with the rest, because Safeguard was deployed as a separate project and stayed that way
common request
ONE-05You need a One Identity developer who already knows the object layer and can write VB.NET scripts
common request
These are working documents, written against your configuration, so your team can run them without us.
inventory01
Custom script, process and schema extension inventory with keep, rewrite or remove decisions
yours to keep
runbook02
Identity Manager upgrade runbook with timed rehearsal results
yours to keep
inventory03
Sync project documentation with mapping rules and revision filter settings
yours to keep
tests04
Attestation policy design with reviewer guidance and expected case volumes
yours to keep
design05
Safeguard entitlement model mapped to Identity Manager IT Shop items
yours to keep
document06
Job queue and DBQueue tuning notes with the alerts we set
yours to keep
talent and delivery · one identity
Certified engineers, wherever you need them.
Some clients want a project team, some want a couple of engineers on theirs. Either works. Onsite, nearshore or offshore, with handovers across time zones that keep things moving.
Onsite
Engineers at your sites in the US
Nearshore
Overlapping hours with US teams
Offshore
Overnight progress on your backlog
All time zones
Coverage handed over across time zones
24-hour coverage · US Central time
OnsiteUS business hours
Nearshoreoverlapping US hours
Offshoreovernight progress
Combinedhandover, not hand-off
00:0006:0012:0018:0000:00
roles we staff
One Identity Manager developer (VB.NET scripts, processes)
Put these to anyone bidding on your One Identity work. The ones who've done it answer differently from the ones who've read about it.
Q1
Which of our custom scripts and processes will break in Identity Manager 10.0, and how will you find them?
Custom VB.NET scripts and processes decide the cost of any upgrade. A partner should have a method for exporting and testing them, not a guess based on version numbers.
Q2
How will you prove the upgrade window before we book it?
Schema migration time depends on your database size and history tables. Only a rehearsal on a production copy gives a number you can plan a change window around.
Q3
What will you change so the DBQueue stops backing up after the HR import?
Queue backlogs usually come from processes without tight generating conditions. Tuning them is specific work, and vague answers about adding servers rarely fix it.
Q4
How will privileged entitlements in Safeguard show up in attestation?
Auditors expect privileged access reviewed with the same rigor as other access. If Safeguard stays outside Identity Manager, that review happens in a spreadsheet.
Q5
Who on your team has written Identity Manager processes and templates, rather than only configured the web portal?
The portal is the easy part. Sync projects, templates and processes are where deployments go wrong, and they need engineers who have built them.
01What should we do before upgrading to Identity Manager 10.0?
Export and inventory every custom script, process, template and schema extension, then compare them with the 10.0 release notes. Upgrade a copy of the production database first and time it. Because 10.0 moves administration into the browser, check which tasks your team still does in the desktop tools today.
02How long does a One Identity Manager upgrade take?
It depends on how many versions you cross, how much custom code you run and how big the database is. The schema migration itself is measurable on a rehearsal copy, so we set the production window from that run rather than from an estimate.
03Does One Identity becoming an independent company change anything for us?
Not on day one. One Identity announced in June 2026 that it will separate from Quest, with the transition running through 2026. Watch for changes to support contacts, licensing paperwork and portals, and keep your support contract details current.
04Can you take over an Identity Manager deployment someone else built?
Yes. We start with a health check of the job queue, sync projects and custom code, then agree with you what to keep, rewrite or remove.
05Do you staff One Identity engineers on contract or permanent terms?
Yes. We place Identity Manager and Safeguard engineers on contract, contract-to-hire and permanent terms, onsite in the US or nearshore and offshore, across all time zones.
services
Related services
Projects on One Identity usually end up touching one of these, so they're worth a look.
