Skip to main content

EmpowerID Admin Lab 10: Create Active Directory Provisioning Policy

Purpose​

This lab guides you through creating provisioning policies to generate Active Directory (AD) accounts in a connected Active Directory account store, mapping organizational units (OUs) to business locations, and managing the server jobs required to process the provisioning policies.

Prerequisites​

  1. Access to the EmpowerID training environment.
  2. An Active Directory account store already connected.

Steps​

1. Disable Resource Entitlement Processing​

  1. Navigate to Infrastructure Admin > EmpowerID Servers > Server Roles.
  2. Locate the All-In-One Server Role.
  3. Search for the Resource Entitlement Inbox Processor Job and remove it from the server role.
    • This ensures that when the policy is created, records are calculated but not processed immediately.
  4. Navigate to IM Shop > Self-Service Workflows > Recycle Service Environment and execute it to recycle the services and stop the job.

2. Create a Provisioning Policy​

  1. Navigate to Identity Lifecycle > Provisioning Policies.
  2. Click the + button to create a new policy.
  3. Configure the policy:
    • Object Type: AD Account
    • Name: AD Domain Account
    • Directory: Select the connected AD domain directory.
    • Object Class: User
    • Leave the external location field blank to use mappings.
    • Set the On Claim Action and On Transform Action to Move.
    • Set the On Revoke Action to Disable.
  4. Save the provisioning policy.

3. Map OUs to Business Locations​

  1. Navigate to Role and Location Mapper.
  2. Select the Location Mapper tab.
  3. Filter the External locations on the left by selecting the AD domain directory.
  4. Expand the divisions business locations in the Right Business Locations tree to expose the Department locations
    • Map corresponding Division OUs in the AD External Locations to the divisions and departments in the Business Locations on the right.
    • Example:
      • Select the checkbox for Investment Banking AD OU on the left and the Investment Banking division and its department checkboxes on the right and click Save.
      • Repeat for the other three divisions
  5. Save each mapping.
  6. Verify mappings under the All Mappings section, filtered by account store.

4. Scope the Provisioning Policy​

  1. Return to the Provisioning Policies page and open the created policy.
  2. In the Assignees section at the bottom of the page, assign the scope:
    • Scope Type: Business Role and Location
    • Select All Employee Roles under HR flat file locations.
    • Select All Business Locations for locations.
    • Leave the priority as 100.
  3. Save the scope settings.

5. Monitor Resource Entitlement Evaluation​

  1. Navigate to Provisioning Inbox > RET Inbox.
  2. Wait for the resource entitlement recalculation job to populate records.
  3. Verify the job status in Admin > Account Stores and Systems > Job History:
    • Search for Resource Entitlement Recalculation Job.
    • Confirm it runs successfully.
  4. Once records appear in the inbox, verify that policies are assigned correctly.

6. Enable Resource Entitlement Processing​

  1. Navigate back to Infrastructure Admin > EmpowerID Servers > Server Roles.
  2. Add the Resource Entitlement Inbox Processor Job back to the All-In-One Server Role.
    • Note: No need to recycle the environment when adding jobs.
  3. Allow the job to process the records automatically.

7. Verify Results​

  1. Navigate to Provisioning Inbox and confirm records are processed.
  2. Validate account creations:
    • Check System Logs > New Objects to confirm new AD accounts, if applicable.
  3. Ensure existing records are processed correctly, with no unnecessary new accounts created.

Notes​

  • Disabling the Resource Entitlement Inbox Processor Job before creating the policy ensures calculations occur without immediate processing.
  • Map OUs to business locations accurately to avoid misplacements.
  • Monitor job statuses and logs to ensure smooth processing.

Completion​

Once all provisioning records are processed and accounts are created or updated correctly, this lab is complete. Proceed to the next lab for additional EmpowerID configurations and features.

Video Walk-thru​

View a video walk-thru of this lab exercise.