Learning about account, identity and access process

For Employees: the process begins when an individual accepts a position at Sask Polytech and HR creates an employee record in Banner. 

For Students: the process begins when a student applies for a class or program at Sask Polytech and Registration creates a student record in Banner

These processes trigger the creation of a unique Third party id (unique username). An automated Banner process runs which outputs all changes during the day, then the Identity Manager system performs an update in Active directory with any new accounts and updates any accounts changes that have been added in banner (see Account Creation Schedule).  An Active Directory account is created using the unique username created in Banner. The Active Directory account provides basic login rights to the domain and the Portal. 

Students are automatically provided with email, M365 license and OneDrive storage and added to student groups based on course of study.  Additional access is granted through Group membership based on requirements for their area of study.   

For employees as part of the basic AD account they get email, M365 license, OneDrive, basic access to mySaskPolytech, and are added to the campus distribution lists.

When an employee record is created by Human Resource, an email with the ITS Permissions Request form is sent to the supervisor of the new employee.  The Program Head or supervisor fills in the access request/authorization that is required for the employee in their role and then they forward the form to IT Service Desk. Additional access is verified/granted depending on the request. 

When an employee or student’s relationship with Saskatchewan Polytechnic is ended, their access to most resources are terminated.  Saskatchewan Polytechnic Policy 806-G states that students, faculty and staff will retain limited access to the Saskatchewan Polytechnic portal indefinitely for access to personal information such as tax forms, unofficial transcripts and pay information. In order to comply with this policy, staff and student accounts are never completely removed from the system. IT has developed procedures to remove all access except the limited access which is guaranteed by the policy.   

There are two types of Employee terminations which are handled using two different procedures 

•  Immediate termination. Team Lead, Enterprise Applications receives notification of employee termination directly from HR. Access is removed according to Enterprise Applications procedures. Any follow up action is taken as per standard termination.  
• Standard termination: 
  • Human Resources flags an employee to terminated in Banner as part of their employee off-boarding procedures. 
  • An automated Banner process runs which outputs all employee changes entered during the day. Then the Identity Manager system performs an update on Active directory accounts based on Banner changes. An employee is account is disabled on the later of:
    • - the capture date - the date that HR has entered the employee’s termination.  
    • - the date of the employee’s actual termination.  

A report is generated each evening with employees terminated during the current day.  The report is emailed IT Service Desk and they verify employee terminations have been completed.  

As per policy 806G student accounts become alumni accounts.  A Student account cleanup process is scheduled daily which applies login restrictions, moves the account to an alumni and removes the student from all but basic log-in group.  Students retain access to the portal for access to T2202A and grades.