Office 365 User Account Provisioning Policies

Provisioning Policies allow you to automate the provisioning, moving, disabling, and de-provisioning of resources for users based on their roles, memberships, and locations within your organization.

This topic demonstrates the following:

• How to create a provisioning policy that provisions Office 365 user accounts

• How to assign the provisioning policy to an EmpowerID actor type

How to create a provisioning policy for Office 365 User Accounts

1. n the navbar, expand Identity Lifecycle and select Provisioning Policies (RETs).

2. On the Policies page, click the Add button at the top of the grid.
   
   

   Open

   

    

3. Under Choose Type, select Office 365 Account from the Object Type To Provision drop-down.
   
   

   Open

   

    

4. In the General section of the form fill in the following fields:

   1. Name – Enter a name for the policy.

   2. Description – Enter a description for the policy.

   3. Tenant – Enter the mailbox load balancing group.

   4. Office 365 Subscription – Select the subscription and then select the licenses from that subscription to be granted.

   5. Email suffix – Select the appropriate email suffix.
      
      

       

5. In the Throttling Settings section of the form, specify the provisioning and deprovisioning thresholds for the policy. These settings are as follows:

   • All Provisions Require Approval – If this option is selected, the provisioning of each RET specified by the policy will need to be approved by a user delegated access to the Resource Entitlement Inbox.

   • All Deprovisions Require Approval – If this option is selected, the deprovisioning of each RET specified by the policy will need to be approved by a user delegated access to the Resource Entitlement Inbox.

   • Require Approval if Provision Batch Larger Than Threshold – This field allows you to set a numeric value that needs to be reached by a single run of the Resource Entitlement Inbox before an approver needs to approve the provisions. If the threshold is reached, EmpowerID will not provision any of the Office 365 user accounts until approval is granted.

   • Require Approval if Deprovision Batch Larger Than Threshold – This field allows you to set a numeric value that needs to be reached by a single run of the Resource Entitlement Inbox before an approver needs to approve the deprovisions. If the threshold is reached, EmpowerID will not deprovision any of the Office 365 user accounts until approval is granted.

6. In the Advanced section of the form, do the following:

   1. Select a desired option from the On Claim Action drop-down. You have the following options:

      • Do Nothing – No action occurs. This tells EmpowerID to simply mark any previous resources assigned to the user that match this policy as RET-managed resources. For example, if the user already has an Office 365 user account and is placed in a Management Role targeted by the RET policy, EmpowerID marks that user's Office 365 account as RET managed.

      • Publish Workflow Event – Executes custom workflow code.

   2. Select a desired option from the On Revoke Action drop-down. You have the following options:

      • Do Nothing – No action occurs.

      • Deprovision – The Office 365 user account is deleted if the person no longer meets the criteria to receive the resource from the RET.

      • Disable – The Office 365 user account is disabled if the person no longer meets the criteria to receive the resource from the RET.

      • Publish Workflow Event – Executes custom workflow code.

7. Click Save to create the policy.

8. After EmpowerID creates the policy, you should be directed to the completed Policy Details page for the policy.
   
   

Next, assign the policy you just created to one or more targets as demonstrated below.

How to assign the provisioning policy

1. On the Policy Details page, click the Find Policies breadcrumb. 
   
   

   
   
   

2. Search for the policy you just created and then click the Display Name link for it.
   
   

    

   This directs you to the View page for the policy. This page allows you to manage the policy as needed. 
   
   

   
   
   

3. On the View page, click the Assignees accordion to expand it. This accordion allows you to assign the policy to any or the following EmpowerID actor types:

   • Business Roles and Locations – All people in the selected Business Role and Location combinations receive the resource granted by the policy.

   • Management Roles – All people in the selected Management Roles receive the resource granted by the policy.

   • Management Role Definitions – All Management Roles that are children of the selected Management Role Definition receive the resource granted by the policy.

   • Query-Based Collections (SetGroup) – All people in the selected collection receive the resource granted by the policy.

   • Groups – All people in the selected groups receive the resource granted by the policy.

   • People – All people selected receive the resource granted by the policy.

4. From the Assignees accordion, click the Add button above the assignee type to which you are making the assignment.
   
   

    

5. In the Add Entry pane that appears, search for and select the appropriate assignee.

6. Enter a number to specify the priority for the RET policy in the Priority field. This value is used to determine the priority of the RET if the user qualifies for the same RET via another assignment, such as being a member of a group that has the same policy. The lower the number, the higher the priority. 
   
   

    

7. Click Save.