Account Inbox

EmpowerID is built on an Identity Warehouse model in which Person objects represent each human being that could log in or be managed by the system. And those Person objects can have or own any number of user accounts in any number of external systems. These user accounts are linked or joined to their respective Person objects via a process known as the “Account Inbox.” The Account Inbox processes user accounts discovered during inventory to determine whether those accounts should be joined to an existing Person object or used as the basis for provisioning new Person objects.

What is the Account Inbox?

The Account Inbox is simply a view of the Account table that utilizes status fields to determine how user accounts should be processed. In doing so, it asks the following questions:

Does the account already belong to a Person?
Has the account already been processed and what is the status of that processing? Does it need to be reprocessed?

If the PersonID field of the Account table for any given account is NULL, then that account is considered to be an orpan account. The Account Inbox workflow claims orphan accounts in batches to determine if they can be joined to an existing person, provisioned to a new person, or ignored.

Account Inbox User Interface under the Identity Lifecycle Section

Account Inbox Prerequisites

At least one EmpowerID Worker role container must have a role with the Permanent Workflow Job/Role enabled
The Account Inbox permanent workflow must be enabled.

Account Store Settings Related to the Account Inbox

Allow Person Provisioning – Allows or disallows EmpowerID Persons to be created from the user accounts discovered during inventory.
Allow Automatic Person Provision on Inventory – This allows EmpowerID to provision EmpowerID people for new accounts discovered during the inventory process if they meet the Provision Rule
Allow Automatic Person Join on Inventory – This allows EmpowerID to join newly discovered accounts to people during the inventory process if they meet the Join Rule

Account Inbox Permanent Workflow

Account Inbox Join Rules

With EmpowerID, you can set rules that evaluate the accounts in those directories to determine whether EmpowerID People should be provisioned from those accounts. The logic that determines this is specified by the Join and Provision Rules and the Join and Provision Filters, specified on the Account Inbox Settings page. These settings are grouped on the Account Inbox Settings page, which you can access by navigating to Identity Lifecycle > Settings.

Rules can be provisioned by different combinations of First Name, Last Name, DOB, Email, EmployeeID, or account attributes. You can write custom SQL logic in the Join by Custom Match field to extend the default options and implement your own logic for join rules. A setting to specify whether joining an inventoried account to an EmpowerID Person is allowed by setting the Join Rule.

An extensive review of the joiner rules and description can be found here Review Account Inbox Settings.

Account Inbox Provision Rule

The default shipping logic ensures that for provisioning an EmpowerID Person from an inventoried account, the following conditions must be met:

Person provisioning is allowed (A.AllowProvision = 1)
An account store exists in EmpowerID for an external system
Person provisioning is allowed on the account store with the accounts

If the above conditions are met, EmpowerID will provision an EmpowerID Person for each user account in a connected user directory that does not currently have a Person linked to it (based on the Join Filter and rules specified above).

Core Identity Inbox Settings

EmpowerID supports Core Identity, a “master identity” representing one individual who might have one or more professional identity (represented in EmpowerID as a person). Settings can be configured for how the joining of person objects to the corresponding core identity is determined.

Join by First Name and Last Name: Specifies that Person objects be joined to the same core identity when the first name and the last name attributes of the Person objects are the same.

Join by Birth Date and First Name and Last Name: Specifies that Person objects be joined to the same core identity when the Person objects' birth date, first name, and last name attributes are the same.

Join based on this list of comma-separated attributes: In addition to the above join rules, allows you to specify one or more custom Person attributes that must be the same for the Person objects to be joined to the same core identity.

Core Identity Provision Rule: Allows you to write custom provision rule for creating core identities.

New “Proposed” tab to Preview Rule Change Impact Before They Are Saved

Please find below the video demo regarding the EmpowerID account inbox. This demo has the references of EmpowerID web interface to locate various settings regarding account inbox process.