Challenge
User management occurred in multiple areas on premise and in the cloud. When new hires were provisioned, a long list of actions needed to be taken by the IT staff. Multiple accounts needed to be created (not all of our services support federation), licenses for various services needed to be granted, group memberships needed to be established, etc. As new services were implemented, this required a modification of the provisioning process, which caused confusion and inconsistencies over time when on-boarding new individuals. When employees were terminated, a similarly long list of tasks also needed to be followed, in a specific order. This was rarely followed correctly, which left orphaned licenses and active accounts costing money and exposing systems to unnecessary risk.
Solution
Adaxes allows us to provide Help Desk staff (and others) with a web interface to create a new user. Once completed, a business rule automatically creates the remote mailbox on the Exchange hybrid server, sets the usage location and assigns licenses in Office365, evaluates the user account location in AD and assigns group memberships accordingly, etc. When an employee leaves the company, the same web interface allows a one-click action to disable the user, hide the mailbox from the GAL, set the mailbox to reject incoming mail, prepend 'disabled' to the display name, date/time stamp the description field, remove the user from all groups, move the account to a different OU, revoke all Office365 licenses, converts the user mailbox to a shared mailbox, sets various AD extended properties, send confirmation emails to IT, HR and the employees manager, sync the changes to Azure, and various other tasks. We have since expanded the use of Adaxes to perform other tasks. For example, when a user is moved from one region to another, IT staff will use Adaxes to move the user to the appropriate OU. This triggers a rule that evaluates distribution and security group memberships and makes the modifications automatically. We have also created custom commands for enabling MFA, enabling mailbox archives, etc.
Benefits
Prior to Adaxes, senior IT staff would perform periodic audits of changes to ensure all tasks were completed properly. This resulted in about 2-3 hours per week of work. This is no longer necessary, which returns about 5% of senior staff members time. However, the simplicity, and peace of mind knowing these tasks are performed consistently and correctly each and every time cannot be quantified. Over the past year, Adaxes has proven itself a valuable tool in multiple situations to help simplify administration.
Kevin Kaneshiro
Technical Services Manager