Active Directory User Accounts
Provisioning Policies allow you to automate the provisioning, moving, disabling, and de-provisioning of resources for users based on their roles, memberships and locations within your organization.
This topic demonstrates how to create a Provisioning policy that provisions AD user accounts.
Prerequisites
EmpowerID must first be connected to Active Directory. For details, see Connecting to Active Directory.
RET provisioning and RET deprovisioning must be enabled on the Active Directory account store.
To create a provisioning policy that provisions AD user accounts
In the Navigation Sidebar of the EmpowerID Web interface, expand Admin, then Policies, and click Provisioning Policies (RETs).
From the Provisioning Policies management page, click the Actions tab and then click the Create Provisioning Policy tile.
In the Choose Type section of the Policy Details form that appears, select AD Account from the Object Type To Provision drop-down.
In the General section of the form, do the following:
Type a name and display name in the Name and Display Name fields, respectively. These fields are required.
Optionally, type a description in the Description field.
Select User from the Object Class drop-down.
Select your Active Directory domain in which the accounts are to be provisioned from the Directory drop-down.
The General section of the form looks similar to the image below.
In the Throttling Settings section of the form, specify the provisioning and deprovisioning thresholds for the policy. These settings are as follows:
All Provisions Require Approval - If this option is selected, the provisioning of each RET specified by the policy will need to be approved by a user delegated access to the Resource Entitlement Inbox.
All Deprovisions Require Approval - If this option is selected, the deprovisioning of each RET specified by the policy will need to be approved by a user delegated access to the Resource Entitlement Inbox.
Require Approval if Provision Batch Larger Than Threshold - This field allows you to set a numeric value that needs to be reached by a single run of the Resource Entitlement Inbox before an approver needs to approve the provisions. If the threshold is reached, EmpowerID will not provision any of the accounts until approval is granted.
Require Approval if Deprovision Batch Larger Than Threshold - This field allows you to set a numeric value that needs to be reached by a single run of the Resource Entitlement Inbox before an approver needs to approve the deprovisions. If the threshold is reached, EmpowerID will not deprovision any of the accounts until approval is granted.
In our example, we have selected All Provisions Require Approval and All Deprovisions Require Approval, meaning that the provisioning and deprovisioning of all accounts must be approved before those accounts will be processed by RET Inbox.
In the Advanced section of the form, do the following:
Select a desired option from the On Claim Action drop-down. You have the following options:
Do Nothing - No action occurs.
Delete and Recreate - The user account is deleted and recreated.
Move - Marks any previous resources assigned to the user that match the RET as RET-managed resources and moves the user object to the OU specified by the RET policy.
Publish Workflow Event - Executes custom workflow code.
Select a desired option from the On Transform Action drop-down. You have the following options:
Do Nothing - No action occurs.
Delete and Recreate - The user account is deleted and recreated.
Move - Marks this resource with the new RET policy number and moves the user object to the OU specified by the RET policy
Publish Workflow Event - Executes custom workflow code.
Select a desired option from the On Revoke Action drop-down. You have the following options:
Do Nothing - No action occurs.
Deprovision - The user account is deleted if the person no longer meets the criteria to receive the resource from the RET.
Disable - The user account is disabled if the person no longer meets the criteria to receive the resource from the RET.
Disable and Move - The user account is disabled and moved to the OU specified in the OU to Move Disabled Users field if the person no longer meets the criteria to receive the resource from the RET.
Publish Workflow Event - Executes custom workflow code.
Leave the Creation Location Path Resolver Assembly and Creation Location Path Resolver Type fields empty. These fields allow you to use a custom assembly to set where an account (or any RET that requires a path) should be created.
Back in the main form, click Save.