Microsoft Dynamics Users

To create a provisioning policy for DAX user accounts

1. In the Navigation Sidebar of the EmpowerID Web interface, expand Admin, then Policies, and click Provisioning Policies (RETs).
2. From the Find Resource Entitlements page, click the Actions tab and then click the Create Provisioning Policy tile.
   
   
   
   
3. In the Choose Type section of the Policy Details form that appears, select Default from the Object Type To Provision drop-down.
   
   
   
   
4. In the General section of the form, do the following:
   1. Type a name in the Name field.
   2. Optionally, type a description in the Description field.
   3. Select User Acount from the Resource Type drop-down.
   4. Select your DAX user resource system from the Resource System drop-down.
   5. Type user in the ObjectClass drop-down.
      
      After completing the above, the General section of the form looks similar to the following image.
      
      
      
      
5. In the Throttling Settings section of the form, specify the provisioning and deprovisioning thresholds for the policy. These settings are as follows:
   • All Provisions Require Approval - If this option is selected, the provisioning of each RET specified by the policy will need to be approved by a user delegated access to the Resource Entitlement Inbox.
   • All Deprovisions Require Approval - If this option is selected, the deprovisioning of each RET specified by the policy will need to be approved by a user delegated access to the Resource Entitlement Inbox.
   • Require Approval if Provision Batch Larger Than Threshold - This field allows you to set a numeric value that needs to be reached by a single run of the Resource Entitlement Inbox before an approver needs to approve the provisions. If the threshold is reached, EmpowerID will not provision any of the accounts until approval is granted.

   • Require Approval if Deprovision Batch Larger Than Threshold - This field allows you to set a numeric value that needs to be reached by a single run of the Resource Entitlement Inbox before an approver needs to approve the deprovisions. If the threshold is reached, EmpowerID will not deprovision any of the accounts until approval is granted.
     
     

     As a best practice, when testing provisioning policies, you should select All Provisions Require Approval and All Deprovisions Require Approval to become familiar with how EmpowerID processes RETs. Then, when moving to production, you can set the approval thresholds to a number that makes sense for your environment.

     
     In our example, we have selected Approve All Provisions and Approve All Deprovisions, meaning that the provisioning and deprovisioning of all DAX user accounts must be approved before those accounts will be processed by RET Inbox.
     
     
     
     

6. In the Advanced section of the form, do the following:
   1. Leave the On Claim Action set to Do Nothing.
   2. Leave the On Transform Action set to Do Nothing.
   3. Select Deprovision from the On Revoke Action drop-down. This tells EmpowerID to delete the DAX user account if the person no longer meets the criteria to receive the resource from the RET, such as would occur if the person was terminated or moved to a Business Role and Location without a RET policy for the specified resource.
   4. Leave the Creation Location Path Resolver Assembly and Creation Location Path Resolver Type fields empty. These fields allow you to use a custom assembly to set where an account (or any RET that requires a path) should be created.
      
      The Advanced and Creation Path Resolver sections of the form should look like the following image.
      
      
      
      
7. Click Save.

1. From the View page for the DAX RET, return to the Policy Details form by clicking the Edit link for the policy located at the top of the page.
   
   
   
   
2. From the Policy Details form, scroll to the Policy Assigned To section and click the Add (+) button underneath the specific target type to which you want to assign the RET. In our example, we are assigning the policy to the Intern in Corporate Business Role and Location so we are clicking the Add (+) button in the Business Role and Locations pane of the section. 
   
   
   
   This opens the Add Entry pane, which is where you select the specific actor you want to assign the policy to. Because we are assigning the policy to a Business Role and Location, the Add Entry pane is contextualized for that actor type.
   
   
   
   
3. From the Add Entry pane, click the Select a Role and Location link. In the Business Role and Location selector that appears, do the following:
   1. Search for and select the Business Role to which you want to assign the policy. In our example, we are assigning the policy to the Intern Business Role, so we have selected Intern.
      
      
      
      
   2. Click the Location tab and then search for and select the Location. In our example, we want the policy to be applied to all Interns in or below the Corporate location, so we have selected Corporate.
      
      
      
      
   3. Click Select to close the Business Role and Location selector.
   4. Type a number to specify the priority for the RET policy in the Priority field. This value is used to determine the priority of the RET if the user qualifies for the same RET by virtue of another assignment, such as being a member of a group that has the same policy.
   5. Click Save.
      
      
      
      
4. Back in the main form, click Save.

If you selected Approve All Provisions, you must manually approve each item in the Resource Entitlement Inbox before EmpowerID will provision the DAX accounts. This is demonstrated in the next section.

To approve the resource entitlements

1. In the Navigation Sidebar, expand System Logs and click RET Inbox.
2. Click the Pending Approval tab. You should see a record for each RET that needs to be approved.
   
   
   
   
3. To approve the RETs, click the Approve drop-down for each RET and select Approve from the menu.
   
   
   
   
4. Click the shopping cart icon at the top of the page, then type a reason for the approval in the cart dialog and then click Submit.