Description

Overview

This use case describes reconciliation process for reading user and group (entitlement) information from the Customers directory and actions that will take place if IGA solution detects exception between information itself and information read from the directory.

Operators

IGA solution
IGA Admin
Directory

Prerequisites

Scheduled-based provisioning task needs to be configured

Result

Reconciliation is completed successfully or an IGA Admin Task is created to IGA Admin for manual handling. 

Operating chain

1. Received user data
   
   
   • IGA solution will read changed user data from the directory based on scheduled-based provisioning task settings
     
     
   • IGA solution will start validating if received data diverges from the data stored in IGA solution
     
     
   • There are several attributes which are validated and they might be different according to the directory in question
     
     
     • For AD: SamAccountName, Distinguished Name, Email address, User Principle Name, 
       
       
     • For Azure AD: User Principle Name, Email address
       
       
   • If I there is exception between information in IGA solution and the information read from the directory, IGA solution will generate IGA Admin Task for IGA Admins to be able synchronize information
     
     
     • IGA Admin can update directory information according to information in IGA solution by choosing synchronize user information and closing the ticket. 
       
       
     • Provisioning will update information automatically to the directory
       
       
2. Received entitlement data
   
   
   • IGA solution will read changed group membership information from the Customers directory
     
     
   • IGA solution will start validating if received data diverges from the data stored in IGA solution
     
     
     • If there is exception with users group memberships (for example there is new group membership connection or removal) IGA solution will generate IGA Administration Task where IGA admin can generate  IGA Re-certification request to Matrix42Self-Service Portal for Managers to be able approve or reject exception.
       
       
     • Based on result for approval request, IGA solution will  synchronize information between users IGA Account and users directory account
       
       
     • There is a time limit for approving the re-certification request and if it is not approved or rejected in that time, IGA solution will generate IGA Admin Task for IGA Admins.
       
       
3. Other views and reports for managing data read from the Customers directory
   
   
   • Orphan user accounts (IGA Account without Identity Storage relation)
     
     
   • User accounts which last login was made x time ago
     
     
   • User accounts with x entitlement and last login was made x time ago
     
     
   • User accounts without group memberships
     
     
   • User account attributes with different values (for example different first name than spoken name)
     
     
   • New entitlements (new group is created into the Customers directory and read to the IGA solution)
     
     
   • Open re-certification requests for de-provisioning

Related datacards

IGA Request
Approval
IGA Account
IGA Entitlement
IGA Admin Task