Microsoft Services

Customer Solution Case Study

Science Agency Empowers HR to Manage User Accounts Through Directory Synchronization

“Before the Identity Lifecycle Management engagement, it could take anywhere from five to seven business days to make a change to a user account. Now it only takes, at most, 24 hours.”Hussain Alsaiari, Assistant Director of IT, King Abdulaziz City for Science and Technology

Business NeedsKing Abdulaziz City for Science and Technology (KACST) is an independent scientific organization administratively reporting to the Prime Minister of Saudi Arabia. KACST is both the Saudi Arabian national science agency and its national laboratories.

Supporting the organization as it builds new government policies, collects data, and funds external research are more than 2,700 employees, including an IT department tasked with managing an IT environment consisting of 50 servers that provide critical services. Among its many duties, this IT team had, in the past, tasked itself with managing user accounts as employees joined, left, or changed roles within the organization. In fact, three full-time employees were solely dedicated to such duties, as a lack of synchronization between the organization’s human resources (HR) system and Active Directory service meant HR staff could not manage the process from their end. Rather, new employees or employees that needed to make a change to their account would

approach both HR staff and their department leads to get approval for their request. They would then bring the approved request and related account information to IT staff to provision the new account or make the requested change. Because of this manual effort, it could take five to seven days for an account change to go into effect.

For Hussain Alsaiari, Assistant Director of IT at King Abdulaziz City for Science and Technology, reducing account-processing time was a top concern. He understood that if KACST were to automate the process, it could free his team’s time for more value-added tasks and help ensure data integrity by eliminating manual processes. “We needed to find a way to automate the entire process so that IT staff could spend less time managing user accounts and more time working to improve our IT services,” he says.

Because KACST used Active Directory as its main security infrastructure for providing employees with access to network resources, these manual

processes impacted security as well. Says Alsaiari, “We understood that through directory synchronization, we could let the HR team manage user accounts directly from the HR system they were already using, providing them with reassurance that the identities in Active Directory would be accurate and up-to-date. This would also help to ensure that when employees, such as contractors, left the organization, their accounts would be properly deprovisioned.”

SolutionTo synchronize directories across its HR system and Active Directory, KACST called on the expertise of Microsoft Services and took part in an Identity Lifecycle Management engagement. As a key part of this engagement, Alsaiari and consultants from Microsoft Services worked together with the KACST HR team to define how that team would like the solution to reflect user information across IT systems. Microsoft Services then helped KACST to deploy Microsoft Identity Lifecycle Manager 2007 to synchronize the HR system with Active

Customer: King Abdulaziz City for Science and TechnologyWeb Site: www.kacst.edu.sa Customer Size: 2,700 employeesCountry or Region: Saudi ArabiaIndustry: National government agencies

Customer ProfileKing Abdulaziz City for Science and Technology has 2,700 employees and is both the national science agency and national laboratories of Saudi Arabia.

Software and Services Services− Identity Lifecycle Management

Microsoft Server Product Portfolio−Microsoft Identity Lifecycle

Manager 2007 Technologies−Active Directory

Microsoft ServicesAs the consulting, technical support, and customer service arm of the world’s leading software company, Microsoft Services enables the successful adoption, deployment, and use of Microsoft solutions and technologies for all customers.

For more information about Microsoft Services, go to: www.microsoft.com/microsoftservices

Directory and build a related approval workflow, ultimately putting the power to manage user accounts in the hands of HR staff. During this time, Microsoft Services also provided the KACST IT team with in-depth training, helping it to fully support the new solution when it went into production.

Now when KACST hires a new employee, HR staff members enter that employee’s data in the HR system and Identity Lifecycle Manager 2007 will facilitate the creation of a Microsoft Exchange Server mailbox and a related Active Directory account that includes the appropriate security group. In addition, when HR staff members make any changes to employee information in the HR system, Active Directory will reflect those changes and, if needed, move that user to another security group as well. When an employee leaves the organization, the HR system will disable that employee’s account in Active Directory, changing the security group and hiding that user’s account from the e-mail address book.

During the engagement, Alsaiari also worked with Microsoft Services consultants to build an employee self-service portal based on Microsoft Office SharePoint Server 2007. This portal enables KACST employees to change basic account information, such as their name, without having to first engage their department leads and subsequently HR staff. Identity Lifecycle Manager 2007 helps route this information for approval and then updates the HR system and Active Directory service.

BenefitsThrough the Identity Lifecycle Management engagement with Microsoft Services, the KACST IT team was able to successfully synchronize its HR system with Active Directory and automate all processes for managing user accounts in only one and a half months. And by

taking a best-practices approach to the implementation, undergoing training for enhanced supportability, and working to ensure close alignment with the needs of the organization, KACST is on track to continue to get the most out of its IT investment.

“Our relationship with Microsoft keeps getting stronger,” says Alsaiari. “With every engagement, Microsoft Services continues to help us add value to our organization, which we appreciate.”

Build a System That Delivers on Business GoalsBecause of the Identity Lifecycle Management engagement, KACST has seen results that extend well beyond IT. Although the solution has helped IT staff eliminate manual processes, it has also empowered HR staff, and in some cases, the employees themselves, with ownership over employee information.

The benefits have extended to end users as well. For example, now, when end users search for and communicate with co-workers via Microsoft Office Outlook, they can do so rest assured that the information is accurate.

Drive Bottom-Line ResultsAfter the Identity Lifecycle Management engagement, two of the three IT staff members charged with managing user accounts have moved to other roles in the IT organization. And the remaining team member has transitioned away from data entry into a more proactive role, monitoring and reporting on user account information to help improve the overall service.

In addition, KACST has now greatly improved the time it takes to modify user accounts. “Before the Identity Lifecycle Management engagement, it could take anywhere from five to seven business days to make a change to a user

account. Now, it only takes, at most, 24 hours.”

KACST has also improved security, a proactive measure that helps the organization avoid unforeseen costs in the future. Says Alsaiari, “We discovered that we had almost 20 active accounts of employees that had left the company, which is a high risk. Now, we can avoid this inaccuracy; once an employee leaves the organization, his or her account is disabled immediately.”

Learn from Leading Experts for Enhanced SupportabilityMuch of the value of the engagement also came through the knowledge transfer from working side by side with Microsoft consultants and participating in formal training sessions. Alsaiari and the IT staff member who would support the solution gained the skills, knowledge, and best practices needed to continue to support and improve upon the system without the need to bring in outside resources in the future. Says Alsaiari, “We worked together until the end of the project, so by the time there was an official handoff of the solution to our team, we had the knowledge to troubleshoot and solve any problems that might occur.”

© 2010 Microsoft Corporation. All rights reserved. This case study is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY. Microsoft is either a registered trademark or trademark of the Microsoft group of companies.

Document published February 2010