Chapter 23 — Identity and access management: methods I

Chapter 23 — Identity and access management: methods I

Lesson map

Lesson 23 published. Map, example, EX067.

flowchart TD
  N0["Learning outcomes"]
  N1["23.1 HR-driven leavers"]
  N2["23.2 Replacing shared accounts"]
  N3["23.3 Involving owners"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX067"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["23.1 HR-driven leavers"]
  N2["23.2 Replacing shared accounts"]
  N3["23.3 Involving owners"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX067"]

[Learning outcomes]
    |
    v
[23.1 HR-driven leavers]
    |
    v
[23.2 Replacing shared accounts]
    |
    v
[23.3 Involving owners]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX067]

Learning outcomes

You will (1) design an HR-driven leaver process; (2) plan individual accounts to replace shared ones; (3) involve owners in each method.

23.1 HR-driven leavers

Elena designs a leaver method that starts from HR rather than email. When HR records a leaving date in its system, a scheduled job compares HR with the office suite each evening and disables accounts whose leaving date has passed. A report lists the person's accounts in other systems, such as finance, for their owners to disable the next morning, with a reminder if not done. This turns a process relying on memory into one triggered by data, while keeping owners responsible for systems outside single sign-on.

23.2 Replacing shared accounts

For reception, Elena proposes individual accounts for each receptionist, with access to a shared reception mailbox and calendar through group membership. For the repairs app, she works with the supplier to enable sign-in with office suite accounts and gives each operative a security key that works on the tablets. Each change is tested with two volunteers before rolling out. Replacing shared accounts takes effort, but it restores traceability and means leavers lose access automatically when their own account is disabled.

23.3 Involving owners

Each method affects people who own systems or processes. HR must keep leaving dates accurate and timely; system owners must act on reports; managers must request access through groups. Elena meets each owner, explains the reason, listens to concerns and adjusts. The finance manager worries about disabling accounts before final payroll tasks, so leavers in finance are disabled at the end of their last day rather than at midnight before. Methods agreed with owners are far more likely to be followed than ones imposed by IT.

Worked example

The HR-driven method disables office suite accounts each evening and reports other accounts to owners; shared reception and repairs logins are replaced with individual accounts and security keys.

Synthetic case. Methods, owners and systems are synthetic.

Errors and limits

Designing a leaver process without HR's commitment to timely dates makes automation act on wrong data.

Exercises

• EX067 — Leaver trigger. What triggers leaver disabling in the new method? Rubric: 3 = HR leaving date checked nightly;; 2 = HR date;; 1 = email;; 0 = none.
• EX068 — Repairs fix. How are repairs operatives given individual sign-in? Rubric: 3 = office suite accounts with security keys on tablets;; 2 = keys;; 1 = shared;; 0 = none.
• EX069 — Finance timing. When are finance leavers disabled, and why? Rubric: 3 = end of last day, for final payroll tasks;; 2 = end of day;; 1 = midnight;; 0 = none.

Synthesis

HR-triggered leavers, individual accounts and owner involvement are the first core methods.

Continue studying — chapter 23 of 40

← Chapter 22 (draft) · Course chapter index · Chapter 24 (draft) →