User provisioning - how are you doing it?

[Jamman960]

How does everyone handle new user provisioning? when someone new starts we need to provision various accounts for different platforms then we need to inform the parents of these details. We've also ended up giving out training materials during lockdown as in some cases pupils are starting having never been into a classroom(2 pupils last year).

 

I'm thinking of putting an ordering system in place to formalise the whole process but wondered if anyone had done similar or whether I'm over thinking it all, the result would be us receiving an order per child/staff member detailing the requirements from the registrar, us fulfilling the order and returning login details etc to the registrar/hr who would then send the login details and intro materials to the parent/user.

 

If anyone is doing similar what are you using to achieve it? I'm thinking about using a sharepoint document library with templates along with a few flows for notifications etc

[mavhc]

Firstly if you can't log in with MS or Google, don't let anyone sign up to it, blame GDPR.

 

Secondly sync MIS to AD, and then AD to MS/Google/Both.

 

Thirdly selenium scripts for ye olde websites that think having an API/Oauth is bad.

 

Then make the whole thing output an email to send to the office for a staff member, or registered parent's email address for pupil. If no address exists, default back to office email.

[psydii]

SIMS->Salamander ->AD----AzureADConnect->AzureAD/MS365->Google.

AD (email addresses)->Salamander->SIMS so all staff and student have school emails populated in SIMS

 

SIMS->Groupcall ->Many Things

SIMS->WONDE -> Many Other Things

 

Many (other) things then use the email address to match to Office365/Google OAUTH etc.

 

Anything that can't use the above is kept up to date by the teacher who commissioned it.

 

 

We never create or disable accounts - it is all handled by Salamander (or GC/WONDE) as the data in SIMS changes.

[Sibrows]

Firstly if you can't log in with MS or Google, don't let anyone sign up to it, blame GDPR.

 

On what grounds?

[jthompson]

Firstly if you can't log in with MS or Google, don't let anyone sign up to it, blame GDPR.

 

Touching on this, if you're using G Suite be sure to lock down API access so that users can only use their Google accounts with apps and websites that you whitelist. Otherwise it's a free-for-all, data protection wise. https://support.google.com/a/answer/7281227?hl=en&ref_topic=10021546

 

Not so familiar with M365 but I should imagine the equivalent measures are available.

[mavhc]

On what grounds?

 

They didn't do all the work to prove that site is safe, do they really want to do all the work? Bet they'll change their mind quickly

[KevinB]

What @psydii said!

 

Salamander handles everything from Sims>AD>Azure and back again, and Google's own account and password sync to AD covers Google accounts. Probably 95% of all subscriptions we have can use O365/Google/Groupcall/Wonde as a data source and the odd 1 or 2 that can't are managed by the dept that wants to use them.

[Sibrows]

They didn't do all the work to prove that site is safe, do they really want to do all the work? Bet they'll change their mind quickly

 

Sorry to be a PITA; I've got a request that I'd like to throw back at the requestor as it doesn't link in to M$365 but I need a bit more to work with.

Would you mind elaborating on your basis for it not being safe?

[jmak]

Sorry to be a PITA; I've got a request that I'd like to throw back at the requestor as it doesn't link in to M$365 but I need a bit more to work with.

Would you mind elaborating on your basis for it not being safe?

It may be safe, but every time you share pupils' data with that an external organisation (which you will need to do if you're providing individual logins), your organisation needs to carry out a risk assessment and Data Protection Impact Assessment, which includes understanding how they will process and safeguard your data. This would need to be approved by the DPO.

 

Assuming you already use O365 or G Suite and the DPIA had been carried out, no personal data would need to be shared with the new organisation of you could sign in with an organisational Google or Microsoft account.

 

I think the point being made here is that if $staff-member wants to choose a new supplier, they should be the ones carrying out that task, not the IT support team.

 

It doesn't seem an unreasonable approach to me, but I've certainly worked in places where I'd end up in trouble for doing it. Make sure you know what the consequences would be for you before you make too much fuss...

[supportman]

We use Bromcom ---> Salamandersoft ---> AD -----> Azure AD now.

 

Works really well after they set it all up. All users are automatic including staff and students. Single sign on the lot!

Edited September 29, 2020 by supportman