CUES Pre-Enablement Action Guide
Your preparation checklist before starting your RapidIdentity enablement journey
District Enablement Education Guide
Vision Enablement Program: The CUES Enablement Education Guide for RapidIdentity is designed to provide Kentucky school districts with a thorough understanding of the RapidIdentity platform’s core features and capabilities. This guide intends to empower district IT administrators, security personnel, and educators to configure, manage, and optimize RapidIdentity to meet their needs. We aim to foster critical thinking about system configurations and encourage districts to leverage RapidIdentity for secure, efficient identity and access management for students and staff.
Data Validation and Report Analysis
Data validation is crucial for ensuring the accuracy and integrity of information across systems. Here are some key resources, practices, and tips to support effective data validation:
Data Validation Reports: Regularly review data validation reports to identify missing or duplicate source IDs, mismatches between systems, and orphaned accounts.
Consistent Usernames and Emails: Ensure that usernames and emails are consistent across systems like Infinite Campus, Active Directory, and Google to prevent login issues.
Unique IDs in Active Directory: Maintain unique IDs in Active Directory to facilitate accurate identity management and prevent conflicts.
Pre-Enablement Cleanup: Perform a comprehensive data cleanup prior to the third week of enablement to rectify any discrepancies and facilitate a seamless Lifecycle Configuration.
By implementing these practices, you can enhance the reliability of your data and support seamless integration across platforms.
Enablement Best Practices & Tips
Remove Stale OUs
Identify and remove any outdated or unused Organizational Units (OUs).
Ensure that no essential data or active users are tied to these OUs before deletion.
User Account Attributes
The Munis Term Date will take priority over Employee Status. It is crucial to ensure that any users who do not need an identity in RI have a Term Date in Munis.
If you are using a preferred name, please make sure it is populated with Munis.
These fields must be consistently populated to support automation and lifecycle management.
Each unique individual should have only one corresponding ID.
In CUES, the unique identifier is:
Employee ID for staff
Student ID for students
If these ID fields are synced to Active Directory (AD) or Google, be aware:
AD and Google do not require these fields to be unique.
This means it's possible to have, for example, both an old terminated account and a current active account using the same Employee ID (e.g., 123) if IDs are reused.
Recommendation:
Avoid having multiple accounts with the same Employee ID or Student ID, even if AD or Google allows it.
This helps maintain data integrity and prevents potential syncing or identity conflicts
CUES Identity Requirements
If a user is to have an identity in CUES, verify the following:
Personal email addresses must NOT be populated in the primary email field in Munis and IC. Only official email addresses (institution-provided) are permitted.
Default OU
Identify the Default OU
Determine the current default Organizational Unit (OU).
Ensure it is not located at the root level of the directory.
Reorganize if necessary to maintain a proper OU hierarchy and inheritance.
Configure Account-Based OUs
Set up OUs in Active Directory (AD) and Google Workspace based on roles and attributes (e.g., Grade 9 students at School A).
Ensure each account is placed in the appropriate OU according to its characteristics.
Establish a Default or Placeholder OU
Create a default OU for accounts missing key identifying attributes (e.g., building or department).
Use this OU as a temporary holding area until accounts can be categorized appropriately.
Decide whether to use a single placeholder OU for both staff and students or separate ones for each group.
Disabled Accounts
Ensure the existence of:
A dedicated OU for Disabled Staff.
A separate OU for Disabled Students.
These OUs should be used consistently for deactivated or archived user accounts.
Ensure these OUs are distinct from those used for active accounts to support proper lifecycle management and policy application.
Grade Level vs. Graduation Year
Evaluate transitioning from using Graduation Year to Grade Level for student organization and management.
Grade Level may offer better real-time grouping and automation flexibility, especially across multiple academic years.