Identity Standard Proposal Identity and Access Management Subcommittee December 12, 2013

Situation 2 Exchange service provides to 30,500 users across the UCSF enterprise Many separate systems have been consolidated including the Medical Center and School of Exchange currently receives for 140 distinct domains Some units adopted primary address when consolidated, but accounts are still being provisioned for 73 domains Rules for assigning a new individual to appropriate domain are manually implemented

Consequences of Current Situation 3 Delay in creation of new accounts Barrier to implementing automated processes Movement of individuals between units results in additional addresses (and confusion) Rollout of new services and integration with cloud service providers become more complicated and are often delayed

Target 4 A uniform address for all members of the UCSF community Continuous delivery of sent to all historical addresses in perpetuity Benefits –Simpler experience for UCSF community –Department or organization move does not affect address –Simpler account provisioning logic, leading to faster turnaround and opportunities for automation –Single namespace is aligned with most cloud service integration requirements

Proposal 5 New individuals joining the UCSF community will receive a primary address The ‘mail enable’ web page used during account provisioning will have alternate domain choices removed Existing UCSF individuals using a primary address not matching the new standard will have: –proxyAddress populated with their current address –Primary address reset to format –UCSF Listserv memberships automatically updated with new address –Authoritative directory listings (CLS, SIS, E*Value) automatically updated

User Impact 6 sent to prior address and new address will be delivered to single mail box – No Impact Loss of identity and ‘branding’ associated with domain suffixes on outgoing mail – Impact Variable Ability to send to external Listservs that restrict input to validated addresses will be interrupted until Listserv account is updated with new address – Impact Moderate Business cards and other collateral with prior address may need updating – Impact Low to Moderate

User Impact 7 Custom inbox rules built manually from addresses rather than the global address list will need updating – Impact Low External correspondents may notice multiple entries in their address book for UCSF staff – Impact Low Users may forget that registrations on external websites used their previous address – Impact Variable Business processes that query AD for users (sub-optimal choice, but may exist) will no longer work – Impact Unknown

Alternate Servers 8 There is no requirement that members of the UCSF community use the enterprise Exchange server Small number of units continue to operate independent servers Options for provisioning / cloud integration for this population –Create even when account is provisioned for individual joining unit not on Exchange –The Exchange account might not be used, but existence will facilitate integrations that need address –Inform account owner that address is used for authenticating to these services

9 DomainAccounts ucsfmedicalcenter.org9381 anesthesia.ucsf.edu529 peds.ucsf.edu481 obgyn.ucsf.edu447 medsfgh.ucsf.edu416 medicine.ucsf.edu388 orthosurg.ucsf.edu ccrc.ucsf.edu1 chanoff.ucsf.edu1 ebinet.ucsf.edu1 clinlab.ucsfmedctr.org1 uap.ucsf.edu1 Alternate Domain Statistics

Visual Impact of Domain – Outlook Web Access (OWA) on Mac 10

Visual Impact of Domain – OWA on Windows 11

Visual Impact of Domain – Outlook on Windows 12

Visual Impact of Domain – IOS 13

Integration Project Examples 14 UCSF Box –Box expected a single primary domain –Two UCSF staff members spent significant portion of month to resolve complication –Initial Implementation Delayed Cisco Unified Communications –Uniform Resource Identified (URI) must be constructed for each individual –Primary address can’t be used, because UC implementation overly complex if many domains supported –Ad hoc heuristics in development to pick address from among multiple candidates in proxyAddress field

UCSF Box Integration 15

Recommendation 16 Request approval via IT Governance Process Define process for obtaining necessary community input Identify resources and schedule for the implementation of proposal