One Identity Active Roles for Provisioning

Active Roles has a powerful provisioning engine in it that lets you do a lot of different things. For example, if you have an HR system and you want to take all those employees and bring them over into Active Directory Azure AD Office 365 cloud systems, whatever you want, Active Roles can do that for you. Let's take a look at how that's done. First, we provision users. Pretty simple and straightforward. We select where they're coming from. In this case, I'm just going to use a simple CSV. And then we tell it how we want to create them. And you can see here, I've mapped all the different things. I've even mapped multiple things. So for example, I'm taking my display name and using the first name, a space, and the last name all together while removing any extra spaces at the beginning or end that might exist from somebody's fat fingering in HR. And let's see that actually happen. Here I've told the system, go ahead and run. This could run on a scheduled basis or whatever we want. But in this case, I want to run it manually. I'm going to click Commit, and you can see here it's supposed to create five users. And you can see it's going ahead and creating those users. It's creating them on prem, in Azure AD, in Office 365, as well as some cloud systems, which we'll show you in a different video. And you can see here, it's done. I can even take a look and see how it's done. You can see all the users. You can see where they were created. I can see all the different things that they were supposed to have done. Now let's take a look at what happens on the back end, because that was pretty simple, but there's more to it than that. In Active Roles, we have policies, and we have a provisioning policy, and a provisioning policy tells the system what to do when new accounts are created. In this case, I have a default. I can have as many as I want, and I can layer them. But you can see here that this particular policy does a lot of things, from generating the account names to setting where the exchange mailbox is stored, generated their email address, provisioning them in my Unix systems, setting their home directories, setting them up for cloud systems, and provisioning OneDrive home folders for them as well. You can see, also, that I can deprovision users. Here, I can set what I want to happen when the user is deprovisioned, even set it to automatically delete after a certain period of time. So I can just either do it through my HR system-- and you can see, if I go over back to here, that the deprovision is set and done right here. And that would call that deprovision policy that I just showed you. I could also just go into the system, go into a user, and, assuming that I had the correct access template, right-click and deprovision. I can even undo that deprovision if somebody made a mistake. Let's say HR had you terminate the wrong John Smith or the person comes back after a few days. All these things can be done quickly and easily inside of Active Roles.