Exchange/Active Directory split permission experience

Hi Arne,

Currently none of my clients use a split permissions approach.

In regards to IDM solutions:

The way an IDM creates and manages depends identities depends on the solution itself. Some use direct API calls to modify  object attributes, some use a scripting approach. If a split permission is in use, you might end up using two different service accounts for each group of tasks. But in this case, what's the usefulness of split permission, when a single solution is being used in the background?

I recommend workflow based solutions to automate identity and account management and used restricted access groups to pre-configured tasks. In that case the access and all actions are part of a single solution audit log.

I think that a split permission approach is useful in a widely distributed infrastructure across regions, where AD is managed regionally and Exchange centrally.

-Thomas