Core Concepts
Three ideas come up throughout this documentation. Understanding how they fit together makes everything else easier to follow.
Workflows automate what happens to an identity. Role Templates are the bundles of access a Workflow hands out. Resources are what employees can ask for themselves through the Access Center.
Workflows
A Workflow is a configurable sequence of logic that automates an identity management process. Every workflow has three parts:
- A trigger is the event that starts the workflow — a new hire, a role change, a termination
- A condition is business logic deciding when actions fire — department is "Sales", location is "Stockholm"
- An action is what happens when the conditions are met — add to groups, assign a Role Template, send a notification
A new employee workflow triggers when someone joins the Sales department, checks their location and role, then adds them to the right groups for sales tools, regional resources, and company-wide access.
Role Templates
Role Templates bundle related directory groups into a single assignable unit. Instead of assigning a dozen group memberships one by one, a Workflow assigns one Role Template and the user gets everything at once.
A "Finance Team" role template might include groups for:
- Financial reporting tools
- Expense management systems
- Department-specific SharePoint sites
- Budget planning applications
- Compliance and audit resources
When a finance employee is hired, a single workflow action assigns the whole template. No manual steps, no forgotten permissions — and no leftover access when they leave, because the same bundle is removed.
Resources
A Resource is something employees can request through the Access Center: an application, a shared drive, a physical location. Each resource maps to one or more directory groups and is governed by an Approval Flow that decides who signs off.
Where Role Templates grant access automatically based on who someone is, Resources cover access someone has to ask for.
How they fit together
A new hire triggers a Workflow. That workflow assigns a Role Template, so they start with the access their job requires. Later, when they need something outside that baseline, they request a Resource in the Access Center and an Approval Flow routes it to the right approver.