NHSmail User Provisioning

Size: px

Start display at page:

Download "NHSmail User Provisioning"

Marcus Smith
5 years ago
Views:

1 NHSmail User Provisioning Version 2.0

2 Contents 1 Introduction Purpose 3 2 NHSmail Object Types Users Contacts Pre-provisioned Accounts 6 3 Provisioning Methods Portal Based Provisioning Connector TANSync Connector Provisioning Matrix 8 Page 2 of 8

3 1 Introduction NHSmail delivers a national directory service enabling day to day communications across health and social care organisations. The service enables organisations to provide regular and automated updates to people data from a wide variety of sources. NHSmail supports an open approach to directory data updates using a number of methods outlined in this document. This is a key part of the strategy to empower each organisation to update and manage people data, in contrast to the previous centralised service. To facilitate this, a number of discrete methods are available for organisations to provision and update user and contact objects in NHSmail. 1.1 Purpose This document sets out the different options for adding, updating and removing user data from NHSmail. The objective is to ensure that each option is clearly described and for NHS organisations to be able to choose the best, most appropriate method to meet their individual needs. This document outlines the capabilities and basic requirements for the following methods of adding, updating and deleting user information in the NHSmail service. Manual management of data through the NHSmail portal Bulk upload of data via CSV files via the portal submission of data with CSV files Automated data management via TANSync The following areas are out of scope for this document NHSmail Portal Service API specification (to be provided in a separate specification document) TANSync detailed information (available separately). This should include detail on how filters are applied to ensure only account that are need are activated. Page 3 of 8

4 2 NHSmail Object Types Section two of this document provides an overview of the different types of objects and attributes that can be managed in the NHSmail service. Please note this refers to people data types and not, for example, groups and distribution lists. 2.1 Users The NHSmail service centres on the management of users however there are two key classifications of users and it is important for planners within NHS organisations to understand the differences between them. The main user type in NHSmail is a mailbox user. A mailbox user in NHSmail is a single, unique user account with the following attributes. A unique username and password address A mailbox quota (4GB as standard) A unique user ID (generated within NHSmail2) All NHSmail mailbox users are charged for on a monthly basis. There are a number of differences between the previous NHSmail service and the new NHSmail service in respect to mailbox users. The key difference is that in original NHSmail service there was a general classification of user or account which represented a number of different classifications, for example: Active accounts with a mailbox Pre-provisioned accounts (same as above but where the user had not yet activated the account through the self-registration process) Directory entries for users with an address in another system (Contacts) Directory entries for non- users (Contacts without an address) On the new NHSmail service users are simply users, there are no different classifications or types. All mailbox users have a mailbox and can be described using the attributes set out at Page 4 of 8

5 the beginning of this section. The new NHSmail service has an additional and new classification called Contacts which is described in the next section. The key difference therefor to be understood is that on the new NHSMail service there are no pre-provisioned accounts. All mailbox user accounts on the new service are considered active and will be billed as part of the service unless disabled and removed from the service. Please see section 2.3 (Pre-provisioned Accounts) for more information on this specific use case 2.2 Contacts NHSmail has a separate classification for users that do not have an NHSmail mailbox. These are Contacts, and can be split into two categories: Mail-enabled Contacts Directory Contacts Mail-enabled contacts are contacts with an address in an system other than NHSmail. All mail-enabled contacts have one attribute in common, they must have an address. Furthermore, that address cannot be from domain sub-domain. Mail-enabled contacts added to NHSmail will be included in an organisations address list and be visible in the NHSmail Portal as well as applications such as Outlook Web App and Outlook. Directory contacts are any contact that does not have an address. Directory contacts will still appear in search results of People Finder in the NHSmail Portal, but not in address lists for applications such as Outlook Web App and Outlook. At present the NHSmail service does not support Contact objects without an address, this will be delivered in a later release. Page 5 of 8

6 2.3 Pre-provisioned Accounts On the previous NHSmail service there was a concept of pre-provisioned accounts. These were accounts that had been provisioned with a mailbox ahead of a user taking ownership and logging in for the first time. On the new NHSmail service there is no such category and as stated in section Error! Reference source not found., all mailbox users are considered active, irrespective of whether the user has taken ownership of the mailbox and has started using it. For organisations that made extensive use of pre-provisioned accounts on the previous NHSmail service, this represents a significant change. Organisations should only create mailbox users as they are required as opposed to creating them too far in advance of being needed. The same principle applies to users that have left in that all users whether active or inactive are chargeable under the new NHSmail service whereas only active users were chargeable under the old NHSmail service. Any organisation using the new NHSmail should take this into account when provisioning users. In the future, organisations will be able to pre-provision users as Contacts and convert them into a mailbox user via the NHSmail Portal when they are required. 3 Provisioning Methods Section three of this document details the various methods via which NHSmail subscribers can provision their mailbox users and Contacts. 3.1 Portal Based Provisioning NHSmail users assigned to the Local Admin or Local Primary Admin roles can create mailbox users and Contacts through the portal using a number of different methods Single Object Provisioning Mailbox user and Contact objects can be managed individually via the NHSmail portal. Step by step instructions on how to create users are contained in the NHSmail Portal Admin Guide. Please refer to the User Management section. Page 6 of 8

7 3.1.2 Bulk Object Provisioning via CSV Upload Mailbox Users can be added in bulk via the portal using the CSV Upload feature. Step by step instructions on how to create users are contained in the NHSmail Portal Admin Guide. Please refer to the CSV Uploads section. There are two formats of CSV files accepted by the bulk upload facility in the NHSmail portal: The old NHSmail format, which is maintained for backward compatibility; the new NHSmail format which provides additional options over and above the previous NHSmail format. The following is a template of the new CSV file format: BulkUploadSample.cs v 3.2 Connector NHSmail organisations can a CSV file conforming to the old NHSmail specification or the example provided in section Error! Reference source not found. containing their people data to the connector.data@nhs.net mailbox for batch processing. This process will create new accounts and update accounts active in the directory. The process runs on a daily basis and whilst organisations can submit as many CSV files via as needed, only the most recent file will be processed. Please note that users submitting CSV files for their organisation must be granted the role to perform that action by their LOA. There are two formats of CSV files accepted by the connector service in the NHSmail portal: The old NHSmail format, which is maintained for backward compatibility; the new NHSmail format which provides additional options over and above the previous NHSmail format. Page 7 of 8

8 3.3 TANSync Connector TANSync is a standard deployment of Microsoft Identity Manager packaged with a custom developed Management Agent able to connect to the NHSmail service API. TANSync replaces the legacy pull connector service. Organisations can use TANSync, or any other solution capable of interacting with the NHSmail web service API, to automatically provision both mailbox users and Contacts. There are many advantages to implementing TANSync, or a similar solution, such as: More frequent and automated data updates. TANSync can be run on a schedule to meet the local organisation s needs, more or less frequently than once per day Through the NHSmail service API TANSync or any other service can write-back directory data from mailbox users or Contacts into a wide variety of internal systems such as Active Directory or local databases/intranets Detailed information on the TANSync solution can be found on the NHSmail support website 3.4 Provisioning Matrix TANSync Portal Single Update Portal CSV Upload CSV Create Contact Y Y Y Y Create NHSmail Account Edit Contact Y Y Edit NHSmail Enabled Account Transfer Contact Y Y Mark NHSmail Account as Leaver Delete Contact Y Y Delete NHSmail Account Y Y Y Y Y Y Y Y Y Y Y Y Page 8 of 8

NHSmail TANSync Overview

NHSmail TANSync Overview November 207 Version 3.0 Contents Purpose of Document 3 2 Overview of Solution 3 3 Non-Functional Specification 5 3. Hardware Specification 5 3.2 Software Specification 5 3.3 Security