Microsoft Dynamics Users
In EmpowerID, Provisioning policies, also known as "Resource Entitlements" or "RETs," are policies that can be created to automate the provisioning, moving, disabling and de-provisioning of resources to users based on their meeting certain qualifying criteria, such as belonging to a specific group, Management Role, Business Role and Location, or Query-Based Collection. Once a policy is created and enabled, EmpowerID continuously evaluates the policy to determine who should and should not have the resource as specified by the conditions of the policy.
Dynamics AX (DAX) has two types of users, Active Directory users and Claims users. By default, DAX provisions all users as Claims Users. Thus, to create both types of users through RET policies, EmpowerID recommends you create a RET policy for both. The difference between these two types of policies is demonstrated below.
Prerequisites
EmpowerID must first be connected to DAX. For details, see Connecting to Microsoft Dynamics AX.
RET provisioning and RET deprovisioning must be enabled on the DAX account store.
To create a provisioning policy for DAX user accounts
In the Navigation Sidebar of the EmpowerID Web interface, expand Admin, then Policies, and click Provisioning Policies (RETs).
From the Find Resource Entitlements page, click the Actions tab and then click the Create Provisioning Policy tile.
In the Choose Type section of the Policy Details form that appears, select Default from the Object Type To Provision drop-down.
In the General section of the form, do the following:
Type a name in the Name field.
Optionally, type a description in the Description field.
Select User Acount from the Resource Type drop-down.
Select your DAX user resource system from the Resource System drop-down.
Type user in the ObjectClass drop-down.
After completing the above, the General section of the form looks similar to the following image.
In the Throttling Settings section of the form, specify the provisioning and deprovisioning thresholds for the policy. These settings are as follows:
All Provisions Require Approval - If this option is selected, the provisioning of each RET specified by the policy will need to be approved by a user delegated access to the Resource Entitlement Inbox.
All Deprovisions Require Approval - If this option is selected, the deprovisioning of each RET specified by the policy will need to be approved by a user delegated access to the Resource Entitlement Inbox.
Require Approval if Provision Batch Larger Than Threshold - This field allows you to set a numeric value that needs to be reached by a single run of the Resource Entitlement Inbox before an approver needs to approve the provisions. If the threshold is reached, EmpowerID will not provision any of the accounts until approval is granted.
Require Approval if Deprovision Batch Larger Than Threshold - This field allows you to set a numeric value that needs to be reached by a single run of the Resource Entitlement Inbox before an approver needs to approve the deprovisions. If the threshold is reached, EmpowerID will not deprovision any of the accounts until approval is granted.
In our example, we have selected Approve All Provisions and Approve All Deprovisions, meaning that the provisioning and deprovisioning of all DAX user accounts must be approved before those accounts will be processed by RET Inbox.
In the Advanced section of the form, do the following:
Leave the On Claim Action set to Do Nothing.
Leave the On Transform Action set to Do Nothing.
Select Deprovision from the On Revoke Action drop-down. This tells EmpowerID to delete the DAX user account if the person no longer meets the criteria to receive the resource from the RET, such as would occur if the person was terminated or moved to a Business Role and Location without a RET policy for the specified resource.
Leave the Creation Location Path Resolver Assembly and Creation Location Path Resolver Type fields empty. These fields allow you to use a custom assembly to set where an account (or any RET that requires a path) should be created.
The Advanced and Creation Path Resolver sections of the form should look like the following image.
Click Save.
The next section involves setting Configuration Parameters for the DAX User provisioning policy. This is only necessary if you are creating a provisioning policy for DAX users with an Active Directory user account type. If this provisioning policy is for DAX users with the Claims user account type, you can skip the section.
To set the Configuration Parameters for the Provisioning Policy
Navigate to the Resource Entitlements Find page by clicking the Find Policies breadcrumb located at the top of the Policy Details page for the policy you just created.
From the Policies tab of the Resource Entitlements Find page, search for the policy you just created and click the Display Name link.
This opens the View page for the policy.
In the View page, expand the Configuration Parameters accordion and then click the Add Parameter (+) button.
In the General pane that appears, type accountType in the Name field, Active Directory User in the ConfigurationValue field and then click Save to close the pane.