Identity and Access Management (IAM) and Automated Provisioning Solution

The District requires a modern, cloud-based identity and access management (IAM) and provisioning solution to automate the full life cycle of digital accounts for students, instructional staff, and administrative personnel. Due to frequent user onboarding, offboarding, and mid-year role transfers, the District seeks to eliminate manual IT account creation, reduce administrative overhead, and force zero-trust security principles, and ensure zero-day access to instructional tools upon enrollment or hire.
- Solution must satisfy the following criteria:
• Automated Account Lifecycle & Directory Synchronization:
o Must integrate directly with primary source systems—including Student Information Systems (SIS) and Human Resources (HR) databases—to automatically trigger user creation, attribute updates, and account disabling/archiving in real time.
o Must support automated provisioning across core target platforms, specifically Microsoft Active Directory, Entra ID (Azure AD), Google Workspace, and Microsoft 365.
o Must feature flexible Role-Based Access Control (RBAC) business rules to automatically assign OU placements, security groups, email distribution lists, network drives, and software licenses based on user roles and locations.
• Single Sign-On (SSO) & Secure Access Portal:
o Must offer a customizable, user-friendly SSO launchpad accessible via web browser
o Must support standard identity federation protocols (SAML 2.0, OIDC, OAuth 2.0) and offer secure credential vaulting for applications lacking modern SSO capabilities.
o Must provide integrated Multi-Factor Authentication (MFA) capabilities with configurable conditional access policies for staff and administrative users.
• Service Automation, Self-Service, & Auditing:
o Must offer a self-service or delegated management portal that allows authorized staff to request or approve temporary access, reset passwords, or manage specific group memberships without IT intervention.
o Must maintain comprehensive, searchable audit logs tracking all account creations, permission changes, and authentication events for security compliance.
• Security, Architecture, & Compliance:
o Must be a cloud-native SaaS platform requiring minimal on-premises footprint.
o Must comply with all applicable state and federal student/employee data privacy standards (e.g., FERPA, COPPA, NYS Ed Law 2-d) and utilize industry-standard encryption for data in transit and at rest.