Name: The Future of Identity & Access Automation: Introducing the New Rippling IAM
Uploaded: 2025-10-29T20:07:04.132Z
Duration: 1 h 7 min
Description: The Future of Identity & Access Automation: Introducing the New Rippling IAM

Transcript for "The Future of Identity & Access Automation: Introducing the New Rippling IAM": Oh, hi, everybody. Welcome, for the to the webinar today, and thanks for joining us. I'm really excited today to show you how Rippling is approaching identity and access management or I'm in a completely new way. But before we do that, we're gonna throw a quick poll up. Would love to get some answers here and some insights from y'all about which of the following solutions does your organization currently use for identity and access management. So while you're answering that poll, I just wanna let you know that over the past six months, our product team has been reimagining what IAM should look like in 2025. Not just a collection of access controls or a tool that's strictly tied to HR, but a fully unified system that connects identity, access, and device security, all powered by your workforce's employee data. So today, you'll see how Rippling gives you a single pane of glass to manage every user, every app, and now every third party connection and groups all in one place. But for the webinar, I wanna give you some quick housekeeping items. So a full recording, will be shared with you of the webinar later today. We also have a q and a section where, you can a a q and a feature, I should say, where you can ask questions during the session. We will have a live q and a at the end to answer those, live if we have time. And then finally, check out any of our related content and the future events, in the side panel. So agenda for today, we'll give brief introductions of who is on the webinar, and then we'll talk about, you know, what is Rippling, the challenges that we hear IT teams facing constantly and every day, and then how Rippling is different and how we hope to solve those challenges through our product's unique value proposition. We'll also go through some of our new features that we've launched this year. There's been a ton of new features launched in 2025, but we'll spend most of the time, on a demo, actually going through Rippling IAM so you could see it for yourself, and then we'll leave some time for a q and a at the end where we'll answer your questions in real time. So some brief intros. My name is Jacob Whisner. I am the lead product GTM manager for Rippling IT. We will also have Tyler Coltesse on the call. He is a lead solutions consultant for Rippling IT. He does these demos all of the time, and we're very grateful to have him on the call so he can actually walk us through the product and and show us what it's capable of. But before we do that, and dive in, I wanna clear up one common misconception. And it's no secret that Rippling, we're really known for our amazing HR products. They can do a lot. But I think that with that comes the misconception that Rippling IAM is an access management feature that is tied to HR. And that's not what this is. For years, Rippling IT has been a powerful stand alone solution, from is a powerful stand alone solution separate from Rippling HR. So it's built for IT teams that need enterprise grade access control, automated provisioning, and deep visibility regardless of where their employee data lives. Whether you're running Workday or BambooHR or ADP as your HRIS, Rippling IAM integrates seamlessly with your existing systems. So you don't need to be a Rippling HR customer to necessarily take advantage of what we're about to show you today. Now challenges that we see IT space today. Let's be honest. IT teams have never had a harder job keeping access secure, accurate, and up to date. With every new hire, every promotion, or a contractor onboarding, it triggers another wave of tickets. There's too many spreadsheets and too many one off exceptions. And traditional IAM tools today, they try to solve this by promising automation, but they rely on either static rules or really time intense custom configurations and scripting that constantly break or take time to fix as your org evolves. And with drift happens, when someone still has Salesforce access after leaving the company or a manager forgets to deprovision a contractor, IT gets stuck cleaning all that up manually. Meanwhile, new security frameworks, compliance demands, and SaaS sprawl continue to make the job even harder. So that's the world we're designing Rippling IT to fix and to make this easier for teams. And Rippling IAM is built around this simple truth that identity providers are only as effective as the data that they rely on. And nobody manages workforce data better than Rippling. That's what we're known for. So by connecting identity and access directly to live employee and device data, Rippling makes hands off and, for the most part, set it and forget it automation actually possible. When a new hire starts, access is provisioned instantly based on their role, department, location, or any other data attribute associated with that employee. When someone changes Teams, their permissions update automatically. When it defaults file falls out of compliance, access is automatically blocked until it's remediated. And when employees leave, access is automatically revoked and logged for audit. So that's identity and access that keeps up with your workforce without IT having to go and chase tickets. And that's because Rippling completely redefines identity and access management by connecting access directly to that real world data that powers your workforce, who people are, what they do, and what devices they use. Rippling is the easiest way to automate role based access controls or RBAC. So if you're using Rippling HR, this happens seamlessly. HR and IT live in the same platform. So when an employee changes departments or gets promoted or boosts locations, all of their app and device access updates automatically. There's no manual updates, no scripting, no maintenance required. But the important part is that, like I mentioned earlier, you don't need Rippling HR to get these benefits. Rippling IT is a standalone solution for IAM that integrates with over 70 HRIS systems like Workday and Bamboo and the others that I mentioned. So you can plug in your you can plug that into your existing HRIS and still automate identity access and device management with the same live employee data. And because Rippling also has a natively built device management product, something that most providers and IDPs don't provide, IT teams get unified controls across both Mac and Windows devices all from a single console. That also means access can be automatically tied to device trust. If a laptop isn't encrypted or patched, Rippling blocks logins, to sensitive apps until it's back in compliance. Every identity and access and device event lives in one system of record. So you get total visibility, faster audits, and built in alignment with compliance frameworks like SOC two, NIST, and others. And this is what makes Rippling different. Instead of managing multiple systems, multiple scripts, multiple syncing of different systems, you get one unified platform that connects employee data, employee access, and device security, and a single automated workflow. So let's talk about what's new because Rippling IAM has evolved a lot over the past six months. A few highlights you'll see in the demo today include our new third party access app, which is a single dashboard to set up and manage and monitor every third party SaaS integration. We also now have access assignments where you can use saved super groups, which are definable usable groups that automatically grant or revoke access as employees join a company, move, or leave teams. We also have access previews where you can see exactly who will gain or lose access before you push those changes live. So you have confidence in the changes that you make. We've done a lot of work with our group syncing. So we have a new enhanced group management where we continuously detect and fix mismatches between rippling and connected apps. And maybe my personal favorite, I love this feature, is one click issue resolutions where you can now see and instantly correct access drift and access discrepancies like a user who might have lingering access after an offboarding without having to manually audit that access or use custom scripting to see it. And we have integration attributes where you can assign mutually excuse exclusive attributes like org unit, license tier, or department to control app entitlements precisely and to ensure every user has the right permissions. And then finally, we have some new bulk hiring, transition, and termination flows that makes it really easy for managers or HR to automate access provisioning and removal at scale, for employee changes. So let Thank you, Jacob, for the introduction, and thank you to everybody else for joining another very exciting Rippling webinar. Without further ado, we are going to get straight into it. I've got my IT overview up on my screen here, and this is going to be your central hub as an IT admin in Rippling and and where you start your day and where you can look at a couple of the different things that you might need to take care of. So we offer identity and access management and MDM, the logistics of retrieving and storing devices, and a lot of different security elements. So I can see a rundown of maybe any connection issues of any errors that are occurring on a device, like a piece of software hasn't been deployed appropriately. If there was a, an issue in an order, or for that matter, something like an MFA reset that needs to happen, or if there was a blocked sign it after a certain number of attempts. All of these very common issues are going to show up in this single pane of glass for you. But you can do a lot of other things here from the central hub. So, I can go into IT management from here and actually look at some of my current employees. This is going to, again, give you a top down, look into everything that they have access to in the context of the Rippling platform. I'm signed in as a super administrator, which is why I can see things like their, personal information or their, you know, documents that they may have signed. There's the ability to create any number of permission profiles inside of Rippling so that what you see or what you can interact with is defined to your role. So as an IT admin, really what I would care about are things like the applications that this person has access to, like internal things, Rippling documents, or external things like Google or Slack, but also their devices or their, multifactor authentication that they've turned on, a passkey or or an authenticator app. And we give you a lot of different ways to interact with the same data. This is, Jane's assigned device can very easy easily open up this MacBook and take a look at the specs of the computer or double check that she's got the appropriate encryption level or that our device trust certificate has been issued into the device. So, again, very simple, pane of glass for you as an IT admin, but it also, allows you to do things like a a role transfer. So I've got a scheduled change already in effect here, for Jane where she is going to become a vice president. And using Rippling as a part of that change, we can make updates to the applications that she will get access to or the groups that are a part of those applications, even the policies that are delivered to her device. So very, very simple change management process all right from, the central console. So make her a vice president, make her a manager, probably won't drop her down, but very simple to, to add these sort of promotions into Rippling and know that the appropriate things are going to flow from there. Alright. So we've taken a look at Jane. We talked a little bit about a migration process or a promotion process, but let's go a little bit deeper into the actual applications inside of Rippling. So we've got a list of, third party access. This is where you can see, number one, all of your current integrations with tools like Atlassian or Box, Brex, etcetera. And also in a real production environment, we would show who was, connecting these different applications and the status, as well as the ability to remediate any issues. So I'm going to bounce over here. This is a real rippling production account that my team uses for testing, where you can see more of the appropriate data. So, I know the person who has connected Freshdesk. In this case, I know the account that we were using for it and when. And you can see that there's some status issues on the other side. So in the event that something is partially installed, like multiple, instances of Microsoft three sixty five, one click to resume that installation step. And if for whatever reason, like an OAuth token expires, that will be another option that you could take. I don't have any of those, you know, OAuth reconnect things in here, but, if that were the case, there would be a little icon for me to, reauthorize the integration with a single click. So we know what is connected to Rippling, and we give you a very simple way to address any issues, or at the very least, you know who to talk to because, the appropriate person, you know, who authorized the app in the first place, you can go and ask them some questions. So that's the overview of what's already turned on inside of third party access. You can also very easily go and create new integrations. The app shop that I'll open up here, this is basically a list of all of Rippling's prebuilt integrations. There's more than 800 of these that we support out of the box. You can very easily search for a common integration here like Google, but you'll see things like Ignite or even Lever in the recruiting space. And if we click into Google, you can see a description of all of the different things, all of the features that this integration supports out of the box. So we'll be able to create accounts, suspend accounts, manage groups, as well as manage attributes, inside of the context of Google. We'll come back to this Google integration so I can show you how you assign access, how you assign group memberships, and how you can resolve issues. But before we get there, I also wanted to point out that you can create custom integrations with Rippling. Any application that supports SAML or SCIM is going to work just fine with Rippling. So you give it a name, you can categorize it. If it's a finance application or accounting, give it a picture, and then tell us the protocol that it actually supports. And from here, it's a very standard SAML, install flow where you'll give us metadata and certificates, and your employees will then be able to gain very simple access into a tool that might not be a part of the existing Rippling catalog. You also might notice dashboard links here. We'll probably do another webinar that's all about password managers and some of the neat ways we can integrate, tools that are not SAML enabled. But just know, we have a password manager and the ability to create dashboard links to give you this very familiar end user experience where all of your applications, whether it's integrated with SAML in the case of Google, or a password, in the case of LinkedIn, they look and feel the same. To your end users, we give you a single, place where they can do everything that they need to do their job, launch their applications, request time off, etcetera. Okay. So that's an overview of the actual third party access here, but let's get into a particular integration. So I want to use Google as my example. And I'll close out some of these tabs so we don't get too crazy, too many tabs open here. So I've already enabled this integration with Google. There's a couple of things that I want to highlight. Number one, we're going to give you a list of all of the, employees who currently have a Google account. So you know, you do not need to have every single Ripley user assigned to every single Google account. If you have service accounts, if for whatever reason you need to maintain, Google accounts that you don't want to match to an existing user, totally fine. Doesn't need to be a one to one match. But from a more practical perspective, there's a couple of things that you want to do with any integration. Number one, you want to make sure the right people have an account created for them at the appropriate time, in their hiring process. You wanna make sure they're authorized to access the appropriate groups inside of a third party system, and you wanna make sure that their attributes are kept in sync and that you can securely off board employees. So we'll go through this stuff sequentially. The first thing I want to bring up here is an access assignment, and what underpins this is a concept in Rippling that we call super groups. So what you're seeing here is different Google OUs and different prioritizations. Got a marketing OU, admins, and then just a general employees OU. And so if you're in the marketing department, you go into the top level one. If you're in IT, then you go into the administrator side, and everybody else gets added to this organizational, bucket for general employees. So prioritization is very cool, but what's underpinning this again is super groups. This is simple Boolean logic that you can use to combine attributes of employees in pretty amazing and novel ways. So I have a very general example here. This is a catch all group. But maybe moving forward, we start bringing in some contractors, and contractors should not have, access to this particular OU as an example. So I can make an exception based on somebody's employment type in this case. So I want to exclude contractors or ten ninety nine employees. And inside of this row, I can also see who is now, being excluded. So there were 27 people that were a part of this group, and now there are only 24. So we could search for individual people to say, hey. I thought Tyler was going to be a part of this group. You know, why isn't Tyler in this group? Because Tyler was off boarded yesterday? When is that? Couple of days ago. Losing track of time here. But gives you very simple ways to track who is in what group and why. And just in case it is not clear, if I make these changes, we're also going to give you a very clear picture for, what what else is changing. You know, what other applications, this group is being used, used for in terms of assignments or even, like, group memberships inside of third parties. So super groups is the underpinning of the entire Rippling platform. Talked about how to build them, how to change them, and how they're used in prioritization. They're also used in, third party group assignments. So what a group is is going to vary. This could be a, Google OU or a Google group. If this were Slack, this could be a public or a private Slack channel, or it could be a, Salesforce role or profile or permission. But Rippling, as a part of these integrations, will import all of your existing group structures and their current group memberships. And now you can use that same sort of logic of super groups to make smart choices about what people are authorized to access inside of these third party applications. So, again, I've got a very simple rule here. If you're going to be a part of this Chicago Google Group, you need to be a part of the Chicago office. So very simple assignment. Now I want to switch over to a production, Rippling account to show you how we can handle issues when it comes to access assignments as well as group memberships inside of third parties. So this is not going to be as pretty. Again, this is a full, production account that we use for testing. So there's going to be a lot of issues, a lot of errors here. If I come into users, I can tab over to this issues section. And in practicality, this is, you know, a person has an account in Google, and they shouldn't according to a supergroup or vice versa. This person doesn't have an account and a supergroup says that they should. So we're going to tell you all of the information that you need. This is the super group that's supposed to be granting them access, to this particular account, Google. This is the o u that they'll be a part of, and we've got different ones here, and then a description of the actual issue. So this person that we're trying to assign, they just have an inactive account inside of Rippling. So I could resend an invite email. Or for some of these other users, we just might need to retry creating an account and see what's going on with the API logs. So you'll have this one click resolution path for not only creating an account inside of a third party, but also monitoring what we call third party group drift. So I know I'm talking pretty fast here, but the idea behind this is while Rippling is designed to drive group memberships inside of these third party applications, your administrators can still go into Google and make an access change. You know, I can go into Google and I can add an individual person, to a particular group, but they that might not fit the rules that you've created inside of Rippling. So we will throw an error here. We know that, in this case, Roger is included in the group, but he's not part of the membership rule that you have configured inside of Rippling. So what do we wanna do in this case? I could either remove them from the Google group, or I can modify the supergroup inside of Rippling to automatically add this individual person, Roger, in. So, again, very ugly production environment over here, but I hope you can see the the power of a tool like this. We're not only giving people the appropriate access to tools at the appropriate time, but we're we have your back on monitoring for any issues, that might happen there. So from a security perspective, really, really nice to know, that only the appropriate people have the appropriate level of access to the appropriate tools. I'll get off my soapbox on this piece. There's a couple of other things to talk about feature wise in this Google integration, and we can go through them quite quickly here. I mentioned access assignments. This is who gets an account created. But with Rippling, you can also dictate when these different accounts actually get provisioned. So this is all relative to your new hires' start dates. So maybe for a tool like Google, you want to give them an account two days before they start. And you'll set up these rules for each integration. So you get a Google account two days before you start, and then on your start date, you get the other 10 apps that you use for your role, Slack, Salesforce, AWS, Asana, whatever it happens to be. We also have really flexible attribute mapping. What I mean by that is you get to pick and choose how these attributes are aligned. So my first name attribute that exists in Google, this is aligned to the preferred first name attribute inside of Rippling. And I can also choose how these are kept up to date. So do I want to pass this over once or when a change occurs in rippling, like when we promoted Jane earlier, I guess that is effective sometime later next week, we'll make sure that this is, passed through in the appropriate way. But there might be certain, attributes that you simply don't want rippling to touch, like employee ID. So, again, pick and choose how each attribute is aligned, how they are kept up to date, and, ultimately, which rippling attribute is mapped to these core fields in Google. This does support custom Google attributes as well. Now the last thing we wanna talk about is offboarding. So we have built, a pretty powerful Google offboarding engine that goes beyond the standard steps. So for every integration that's tied into Rippling, we are at least going to suspend your account when you're terminated in Rippling. And that can be an immediate termination or it can be scheduled for some time in the future. But with Google, we go one step deeper where we can actually facilitate a transfer of data to a designated person. So this is just more quality of life. Right? One one stop shop for for common tasks, that you need to handle in IT. In this case, we're going to give the terminated employees manager temporary inbox access. We'll change this to two weeks. We'll transfer any unshared drive files as well as any recurring calendar events that were associated with this employee. And I think you can extrapolate, a couple of different scenarios here. Right? I'm talking all about, you know, an individual employee's life cycle. But if you're doing a mass hiring, if you're doing a riff, you know, on the unfortunate flip side of things, you can have the peace of mind that all of the right changes are going to flow into any connected system, into a device, into an application like Google, or into all of the other HR oriented things that Rippling can handle. With all of this said, let's wrap things up with an actual offboarding procedure. So I'm going to go back to the Rippling home page here. And I know that we had just promoted Jane, but, unfortunately, Jane is also getting canned today. Sorry, Jane. We'll go through this sequentially so you can see how all this stuff ties together and how this ultimately makes your security practices, a little bit easier to understand. So why are we terminating this employee? Voluntary or involuntary? There can be different additional reasons, you know, laid off or they just resigned, they retired, whatever it happens to be. But from a security standpoint, this is where you tell us. Is this going to be an immediate termination? So I can say today, or this can be scheduled for some time in the future. Right? So let's schedule their last day of work. At 05:01PM, in their local time zone, whatever that happens to be, that's when we're going to kick off this off boarding process. And so I'll actually make this November 7 at 05:01PM. Okay. Let's keep going through this termination flow. You can actually see all of the steps that we're going to go through here. So everything is kinda sequential here inside of Rippling. Will we rehire this person in the future? No. Jane is going to retire in this case. I briefly narrated that, password manager that we have. In this case, Jane owns a password that is shared with other people. So we're going to automatically reassign ownership of that shared password to a designated person. Are we going to issue a termination payment? We'll skip over that for now, but we also have the ability to issue a one off payment with Brooklyn payroll. And there might be different documents they need to sign, a, non compete, a non solicit. You can load in your own custom documents to Rippling. Now this is a pretty basic demo account that I have set up here, but we're connected to Google and Zoom. So, again, they're going to lose access to Google at the appropriate time. And with that transfer of data that we were talking about just a moment ago, we know that Paul can now follow-up on any, any emails that come in or any, anything else, you know, that was tied to her Drive account, for example. There were devices assigned to this employee. So as a part of Rippling's inventory management service, we are going to send a box to get this MacBook Pro back. And before it goes in the mail, you can tell us exactly what you want to do from a security perspective. We could lock the account. We could do a full wipe, or we could just lock the user profiles. And if they need extra boxes for other things you might wanna retrieve, we can send that too. So these are the costs. Because Rippling is an HR system, we already know where Jane lives. But we could very easily send this to a company headquarters or wherever else she might be at that particular moment. Sorry if you can hear a baby. And now that is it. We're going to issue a final paycheck. There were no approvals. I don't think, that were built into this particular offboarding workflow. But if somebody else needs to sign off, on an onboarding or an onboarding process before it goes into effect, that is what you can review here. So you're terminating the employee. We're not giving them a final payment in this case, and this is just a, you know, verbal written list, I suppose, of all of the things that are going to happen, who is going to get their data. And now we can finally confirm that offboarding and when this is going to go into effect, and there's that, approval. So I won't actually terminate Jane today. We'll let her go through with her promotion for next week. I hope this was helpful. It's a lot of information, that you can listen to all at once. But if there are any other questions, if you wanna see a deeper demo of the Rippling platform, please reach out to us. We're more than happy to help. Thank you. Hi. Sorry about that, folks. Hi, Tyler. Thanks for similar today. Absolutely. Yeah. Technical difficulties when you're the IT guy is always a good look. Hey. We made it happen. That's all that matters. It's all about the end state. Well, we only have a few minutes left, but I see some really great questions in here in the q and a. And just so everybody is aware, if we don't get to your question, we'll follow-up with you after to make sure that we answer your questions. But, a a couple of them that I'm seeing right here that I I wanna ask you, Tyler, is, from Greg. He asked, how is Rippling IT a standalone solution? I've, seen in the past IT limitations due to permission limitations and the inability to add users without onboarding them. Tyler, what what's your take on that? Yep. So, the exact timeline for when we released IT as a stand alone product is escaping me, but it's been, many months at this point where we have like, we have a couple years now at this point. But Hey. Look at that. I don't know. Never lived for a while now. Yeah. The but the standalone element of this, we can actually, like, integrate with, other directory sources. So if you have another HR system, if you're using something like Google, like, we can actually pull in user information from these third party systems. And then you get all the, you know, the features of identity and MDM that you were we were walking through in the demonstration today. So there is still an element where you the employee needs to, like, accept an invite, but outside of that, their, all of their information is grabbed from third party sources, with this new directory sync tool. Well, not the new one. Direct resync tool. No. That's great. And then, a question from Wahid. So can I replace Jamf and Microsoft Intune? The specifics of that are always worth going through with somebody like me or on my team, but, yes. Short answer, yes. We do this all the time. Replacing other MDM solutions that are out there, you get one pane of glass for for everything inside of Rippling. I'd say that's the, the focus of what we do when, when people have incumbent MDMs in place is to consolidate them to Rippling. Great. And I'm seeing, Rob asked, I see Freshdesk is supported, but how about their larger platform, Freshservice? Yep. So we've got a couple of different ways to integrate with with these tools. For Freshdesk, we just have, like, a SAML integration. But there is a tool that we didn't talk about today called, workflow studio that actually allows you to create tickets inside of these different services among many other things. So So you define a trigger event, and we can send an email. We can call public APIs, send Slacker teams messages. So kinda similar to a Zapier or Workato in effect. So no explicit integration with Freshservice in our app shop, but certainly the ability to interact with Freshservice. Awesome. Well, thank you so much, Tyler. I know we're at time. We have so many more questions we could get out of you. Again, I wanna remind everybody, thank you for your questions. We'll follow-up with you after this to make sure we get you your answers. And just wanted to let, everybody know that if you're one of the first five attendees to book a demo with us, we will also, send you a LEGO Technic Mercedes AMG f one LEGO set. Pretty rad. I know, Tyler, you were saying earlier how we gotta get you one of these as a thank you for doing the demo, which absolutely. So join Tyler in getting one of these LEGO sets. Be one of the first five attendees to book a demo with us. We'll send out a poll right now to to get your information. And when you book with one of our our sales reps and have that demo scheduled, we'll send you your gift. And then maybe the moment we've all been waiting for is that we want to announce the winner of the $500 Visa gift card as a thank you for, to attending today's session. And it looks like the winner of today is Gloria Perez. So congrats, Gloria. Thank you so much for attending. We will reach out to you specifically for your gift. And just thank you again everybody for attending today's session. Always reach out to us if you have questions or wanna book a demo. We we'd love to show you these features and show how they can really help you and your organization automate identity and access, in a way that, you know, we're not seeing other people do it today. So thanks again. And, yeah, see you at the next one. Thanks, everyone.