Configuration for ADP integration operations

The base setup of the ADP integration enables successful data aggregation in accordance with the defined integration data schema. The collected and normalized ADP integration data is presented in two perspectives: the account catalogue of the ADP integration and the Analytics warehouse. Both allow users to perform the authoritative source account management and account data analysis.

To support workflow automation, provisioning and reconciliation, additional integration configuration is required, including:

• Identity attribute model definition
• Identity lifecycle management
• Birthright and Mover access configuration
• Other custom integration operations

Identity attribute model definition

Attributes from ADP worker records can be used as authoritative ("master") data and aggregated and mapped to identity properties, such as:

• Identity identifier
• Identity name
• Identity email address
• Manager
• Employment start date
• Employment termination date

The HR Source Attributes Mapping Rule defines the primary attribute authority for each identity property listed above and establishes the inbound update direction, whereby identity attributes are synchronized from ADP (as the HR authoritative source) to ObserveID (as the IGA platform).

Attributes available in the ADP integration data schema can be configured through the HR Source Attributes Mapping Rule to populate identity properties in accordance with organizational business requirements. This process establishes the identity attribute model, defines the authoritative source for each attribute, contributes to the identity governance and ensures the quality of data.

As an initial step, the following matrix can be used to define the identity attribute model. It outlines the baseline identity properties, which can be extended as needed.

Identity lifecycle management

Identity lifecycle events, such as Joiner or Termination Event are triggered by detected changes in identity attributes. The inbound update flow of authoritative data from ADP to ObserveID plays a key role in initiating the corresponding lifecycle processing.

HR Source Rules define the relationship between lifecycle events and changes in identity attributes and must be configured to enable identity lifecycle management when ADP is used as the authoritative source. These rules include:

• HR Source Joiner Rule detects the creation of a new worker record in ADP and may optionally evaluate additional attributes.
• HR Source Leaver Rule detects the disablement or inactivation of a worker record in ADP and may optionally evaluate additional attributes.
• HR Source Reinstatement Rule detects the reactivation of a previously inactive worker record in ADP and may optionally evaluate additional attributes.

As an initial step, the following matrix can be used to define the dependency between the identity attributes and the corresponding lifecycle event governed by a HR Source Rule.

Birthright and Mover configuration

Both birthright access assignment and mover-driven access assignment are triggered by detected changes in identity attributes. The inbound update flow of authoritative data from ADP to ObserveID plays a key role in initiating these access assignment processes.

Birthright access occurs during onboarding or reinstatement, while mover access assignment is performed by a scheduled Identities Update request. For both scenarios, the Assignment Rule of a birthright role defines the relationship between eligible access and changes in identity attributes and must be configured to enable automated access provisioning and deprovisioning.

The Assignment Rule evaluates identity attributes against defined birthright access conditions to determine whether access should be granted or revoked.

As an initial step, the following matrix can be used to define the dependency between identity attributes and the corresponding birthright or mover access governed by the Assignment Rule of a birthright role.

Custom Integration Operations

Upon request, the ADP integration can be extended with custom operations implemented on an ad hoc basis and tailored to the specific needs of an organization. This enables the creation of customized functional capabilities designed to meet unique business requirements.