Termination Process

The termination process is triggered when HR terminates the employee account and access in HRMS. IDM reconciles the data from HRMS and disables the user account's profile in IDM and all the corresponding target systems.

Use Case

Terminate User - Day 0

Use Case	Terminate User - Day 0
Brief Description	Terminate user process is initiated when HR terminates the user accounts and its accesses in HRMS. IDM reconciles the records from HRMS and detects the termination and disables the user account's profile in IDM and corresponding target system.
Actors	HR Access Management IT Target Systems
Trigger Events	HR terminates the user in HRMS Current Status= A/P/L New Status = D/Q/R/S/T/U IDM reconciles the record from HRMS into IDM
Preconditions	User record exists in IDM inactive state
Post-Conditions	Success IDM makes necessary changes in Target Systems for terminated accounts User status is changed to Disabled. No Roles are removed on 0 Day Accounts statuses are changed to Disabled on 0 Days Fail IDM does not disable the identity upon termination Failed to disable accounts which are in a provisioned state
Basic Flow	Upon receipt of records with Terminate status from HRMS, IDM disables the user account in stages A new 'Prevent HRMS Updates' flag is added in IDM to prevent updates from HRMS from overwriting a change to a user record in IDM if the user is terminated for cause A new 'Legal Hold' flag is added in IDM to prevent updates from HRMS. If a Legal Hold is identified, the IDM Account remains disabled if the Legal Hold flag is checked. The IDM Termination process is triggered upon receipt of the following HR Flags in the HRMS record. If the HRMS record received contains any of the HR Flags, the IDM user identity becomes disabled and the termination process schedule is initiated. DeceasedDisabled retired with PayDisabled RetiredDisabled TerminatedDisabled Terminated with PayDisabled SuspendedDisabled The basic flow for the termination process is explained in the below activity diagram: On the day of termination IDM account status is changed from ACTIVE to DISABLED IDM sets the de-provisioning date as 95 days after the current date IDM disables the account on all core connected systems (Active Directory, Exchange, Exchange Online, West Mainframe, CCure, EPS) IDM disables all remote access

Terminate User - Day 10

Use Case	Terminate User - Day 10
Brief Description	Terminate user process is initiated when HR terminates the user accounts and its accesses in HRMS. IDM reconciles the records from HRMS and detects the termination and disables the user account's profile in IDM and corresponding target system.
Actors	IDM Target Systems
Trigger Events	Removing roles, entitlements, manager info from the user profile
Preconditions	User record exists in IDM inactive state
Post-Conditions	Success IDM makes necessary changes in Target Systems for terminated accounts Manager details are removed from User Profile Fail IDM does not disable the manager information Failed to remove entitlements, roles which are in a provisioned state
Basic Flow	After 10 days of termination IDM runs a scheduled job to remove all Active Directory Group memberships, except Office365 which remains until the account is revoked Removes all the: Manager's information from the User profile Entitlements for users that have passed 10 days of the grace period (as specified in metadata) except Office365 Roles requested through the Catalog for users that have passed the 10-day grace period (as specified in metadata) Sends a notification and request ID to the Application Fulfiller to remove all accounts on disconnected systems within 30 days. Depending on application metadata rules, the access will either be revoked or disabled. Policy Violations are triggered if accounts are not revoked in the designated timeframe.

Terminate User - Day 30

Use Case	Terminate User - Day 30
Brief Description	Terminate user process is initiated when HR terminates the user accounts and its accesses in HRMS. IDM reconciles the records from HRMS and detects the termination and disables the user account's profile in IDM and corresponding target system
Actors	IDM
Trigger Events	Notification trigger for fulfillment roles
Preconditions	User record exists in IDM inactive state
Post-Conditions	Success Notification trigger for fulfillment roles successful Policy violation triggered Fail Notification trigger for fulfillment roles unsuccessful Policy violation not triggered
Basic Flow	After 30 days of termination IDM runs a scheduled job to notify application fulfillment roles that the removal requests are still pending. A Policy Violation is triggered, and notification is sent to Security Controls Administrators.

Terminate User - Day 90

Use Case	Terminate User - Day 90
Brief Description	Terminate user process is initiated when HR terminates the user accounts and its accesses in HRMS. IDM reconciles the records from HRMS and detects the termination and disables the user account's profile in IDM and corresponding target system. IDM disables the user profile and sets the de-provisioning date as 95 days after the current date
Actors	IDM Target Systems Badge (CCure)
Trigger Events	Remove the AD Home Drive Revokes disabled core connected systems access
Preconditions	User record exists in IDM inactive state
Post-Conditions	Success Disabled core connected systems access revoked Physical Badge remains disabled Fail Disabled core connected systems access not revoked Physical Badge not disabled
Basic Flow	After 95 days of termination IDM runs a job that revokes disabled core connected systems access. Physical Badge shall remain Disabled. Sends a notification to remove the AD Home Drive

Diagram

The diagram below illustrates the basic flow to terminate the user process.

Topics	Questions	Response
Brief description	A brief description only focuses on the de-provisioning date. IDM disables the user profile and sets the de-provisioning date as 95 days after the current date
Post Conditions- Fail IDM does not disable the identity upon termination	There is another scenario which should be considered as failure- Failed to disable accounts which are in a provisioned state
Post Conditions- Success Email Notification: Terminated User’s Manager will receive: Offboarding Email Notification If the user is Nuclear: Notify ITServiceDesk(Role: NOTIFY_IT_SERVICE_DESK_Role) as per email template : Exelon Notification on Nuclear User Termination Home Drive remove Email Notification- IT Service Desk	Need an email template detail for each notification. The template should have the following detail- Mail Subject, Mail Body, Mail Signature, Sender DL/email, and Recipient DL/email
Basic Flow- After 10 days of termination-	Is there a separate requirement for 10-day revocation and 10-day disable?
Basic Flow	Do we have separate requirements for 0-day revocation,10-day revocation,30-day revocation, and 95-day revocation of Entitlement or accounts? As per the current state of system Entitlements, Accounts or Roles there is no field/metadata which holds information like 0-Day revocation,10-day revocation,30-day revocation, or 95 days revocation.
	There should be a separate requirement for employee status change from A/L/P to S (suspended). Is there any specific requirement for different status changes other than the one mentioned above?
After 30 days of termination-	Need clarity on who will create tickets to revoke all disconnected accounts and assign them to whom.