The functions and features most commonly offered by identity and access management platforms (Okta, Microsoft Entra ID, SailPoint and Duo), and the HERM business capability each one supports. The service covers one identity per person and what it can reach: identity sources and matching, affiliations and joiner, mover and leaver events, provisioning, single sign-on and federation, passwords, MFA and adaptive sign-in, groups, roles and privileged access, access requests and certification, self-service, logging and threat detection, and integration, security and operations. The SIS, HR and ERP remain the systems of record for person attributes and affiliations, and applications keep their own data and business-process access rules. Passwords and MFA factors are owned by the identity service.
Shows which parts of the institution the identity service supports, where it overlaps other systems, and where it stops.
A function's main HERM home vs others it touches. Features narrow to one capability.
17 HERM capabilities touched, centred on identity and access management, information security and integration. Almost every feature sits in Enabling capabilities.
Wheel to explore, tree to scan every mapping, CSV or JSON to reuse it.
How this was compiled: three AI assistants (Claude, Perplexity and Grok) were each asked to identify the core functions and features of the major identity and access management platforms used in higher education. Their lists were reconciled into this single set, using the Claude draft’s structure; source letters on each feature show which drafts named it. Treat it as a starting point, not a vendor-verified specification.
{{ xwIntro }}
The full hierarchy: areas, functional areas, functions and features, each with its HERM mapping and definition. Select any HERM capability or feature to see its full definition.
Identity is rarely one system. Here the same functions and features are mapped to the applications a fictional Example State University actually runs: a vendor core, add-on modules, third-party products, homegrown tools and spreadsheets. Each link records how well the application covers the feature and its role. HERM coverage is then calculated from those links, not mapped by hand.
Also see this ecosystem as a capability × application matrix or a HERM-to-application flow.
Inner rings: area and functional area. Outer ring: one slice per feature, split into bands when more than one application provides it. Marks outside the ring flag gaps (red) and competing systems of record (violet).
{{ fd.desc }}
The executive view. Each bar is the capability’s features, coloured by the best coverage any application gives them. Select a capability for its HERM definition, or an application to see its footprint.
{{ pop.body }}