This use case allows the IGA admin to easily define and modify account management settings (IGA set account information) for creating, updating, or removing accounts in directories. This use case requires that the work period management settings are configured, and that personal and employment information for users is received from the source system(s).

IGA admin can change account management settings from IGA set account information data card, and settings are depended on the directory in question (for example, AD requires OU-path). 

Work period management settings are described in user lifecycle management article. 

User with one work period and one account

1. Create IGA set account information data card, where user type and directory information are matching with IGA work period data card settings, where amount of work periods is set to "one" and one directory is selected.
2. Create as many IGA set account data cards as there are different user types, who need different type of account attributes.

User with one (1) work period and several accounts

1. Create IGA set account information data card, where user type and directory information are matching with IGA work period data card settings, where amount of work periods is set to "one" and several directories are selected.
2. Create IGA set account information data cards according to:
   • To how many directories accounts are created per user.
   • How many accounts, with different settings are created per user.

User with several work periods & one (1) account

1. Create IGA set account information data card, where user type and directory information are matching with IGA work period data card settings, where amount of work periods is set to "multiple" and one directory is selected.
2. Create as many IGA set account data cards as there are different user types who need different type of account attributes or if different work periods need to have different type of directory accounts.

User with several work periods and several accounts

1. Create IGA set account information data cards according to:
   • To how many directories accounts are created per user.
   • How many accounts, with different settings are created per user.

User with one work period and one account (for access right management)

1. There is no need to do any settings for account management, in case user lifecycle management use cases are not implemented, and only access right management use cases are used.

Primary account calculation

Primary account is calculated automatically (calculation in person data card), and it is needed for different reasons. For example: 

• Information from the primary account is showed in users person data card.
• Users login to Self-Service and to IGA solution, using primary account related to the users person data card.

IGA solution contains pre-defined primary account calculation:

1. If user has one account, it is always calculated as primary.
2. If user has two (2) or more accounts:
   • Primary account is first created account, based on creation date.
   • If creation dates are the same, primary account is the one missing expiration date.
   • If expiration date exists in both, primary is the one valid for longer.
3. If primary account cannot be calculated automatically, IGA admin can define primary account for the user, from users account data card. 
   • Remove primary account information first, from the existing primary account and after that update primary information to correct account data card.
   • IGA admin instructions can be found from user lifecycle management article, under IGA admin use cases chapter.

Available settings 

IGA set account data cards are used for workflow to validate settings related to directory account creation/updates. Therefore, configuration is not needed unless changes are made to the actual settings.

Follow up account management settings chapter for creating new settings for different user types.

Relations to other use cases, 

Create new users (on-boarding)

Update user information

Update departing user information

Self-Service: create new users, update user information, update departing user information

This use case is tested as part of user lifecycle management, when users are created, updated or departing user process is started, which means that use same test users, but at the end of the processes validate from directory/directories that users is created/updated correctly and they can login to Self-Service. 

1. Test user creation/update according user lifecycle management or Self-Service: create/update user information/update departing user information use cases.
   • When new user is created, allocate Self-Service access for the user.
2. Login to customers directory/directories:
   • Validate that new user account is created correctly:
     • Account attributes are generated according to settings in IGA set account management data card.
     • Generated attributes are provisioned to correct account attributes in the directory.
     • Account is activated according to work period start date, if start date is in the past, account is active immediately.
     • Birth rights are granted according to IGA set account information settings.
     • In case the directory is using OU-structure, validate that user is created to correct OU-path.
     • Communication is made according to IGA set account information settings.
       • Validate also email content.
   • Validate that user information is updated correctly:
     • If users personal information (of the users names) is changed.
       • Validate that account attributes, which are based on of the users name attributes, are re-generated correctly, according to settings in IGA set account information data card.
     • If users employment information is changed:
       • Validate that account attributes related to users work period information is updated correctly.
     • Generated attributes are provisioned to correct account attributes in the directory.
     • In case the directory is using OU-structure, validate that user is moved to correct OU-path.
     • Communication is made according to IGA set account management settings.
       • Validate also email content.
   • Validate that departing user information is updated correctly:
     • Employment date is updated to directory/directories.
     • Account(s) are disabled according to IGA set account information data card.
     • In case the directory is using OU-structure, validate that user is moved to correct OU-path.
     • Communication is made according to IGA set account management settings:
       • Validate also email content.
3. Login to Self-Service with the user, who has Self-Service access:
   • Validate that user can login to Self-Service.
   • Validate according to manage IGA solution users use case, that user has access only to those services defined in the use case.