Book 03 — HR-Driven Identity

HR-Driven Identity Modernization — an enterprise data architecture case study: using Federal HR 2.0 and the Entra ID migration to start HR-driven Entra ID, Active Directory and ICAM on OPM standard attributes

Book 03 of the Modernization Workbook, one book for HR-driven identity modernization in a federal civilian agency: the modernization outcomes, why the HR system of record is the source of authority, the Federal HR 2.0 program, attribute authority, provisioning services, the canonical workforce identity model, joiner-mover-leaver with Lifecycle Workflows, credentials and certificates, attribute-derived access, drift and evidence, the phased execution plan, and an illustrative reference deployment.

Book 03 — HR-Driven Identity: An Enterprise Data Architecture Case Study

ImportantStatus — draft book

This book is the former HR-Driven Identity series, which had already consolidated nine separate pages. It now reads Why / What / Who / How, with a new chapter on who owns workforce identity. Every external claim was checked against a primary source on October 20, 2026 and carries a footnote. The previous pages are kept in the repository’s archive/b03-hr-identity/ folder, and their old addresses forward here. Federal HR 2.0 program facts change; check them at engagement time.

TipDownload and present

b03-hr-identity-bundle.docx: the whole book as one Word document, regenerated on every site deploy. The old hr-driven-iam-*.docx file names still work.

One chapter at a time: 01 · 02 · 03 · 04 · 05 · 06 · 07 · 08 · 09 · 10 · 11 · 12 · 13

15-minute presentation: the Why / What / Who / How deck and its narrated version are in presentations/b03-hr-identity/. The earlier interview edition is in presentations/hr-driven-identity-interview/.

An agency’s identity platform can prove, cryptographically and at every hop, that a claim was signed by the party allowed to sign it. It can’t tell you whether the claim is true: whether the person behind the credential still works for the agency, still holds the position the access was granted for, still reports to the supervisor who approved it. Those are workforce facts. They originate in workforce business processes and are recorded in the human capital system of record; identity services consume governed projections of them and remain authoritative for credentials, authentication, sessions, directory objects, and policy enforcement.

This book is a proposal: use Federal HR 2.0 and the move from Active Directory to Entra ID together to start HR-driven identity, so that accounts, credentials, access and their removal become timely, explainable consequences of personnel records rather than tickets. It is not a plan to implement HRIT; HRIT is happening regardless. It is a plan to use it. It’s written for a federal civilian agency in the commercial Microsoft cloud at GCC-Moderate / FedRAMP Moderate, receiving its HR data from the government-wide Federal HR 2.0 platform (Oracle Fusion Cloud HCM). For federal employees its contract is OPM’s standard personnel data — the government-wide data standards and nature-of-action codes — mapped once into a governed workforce identity model; vendor field names are replaceable boundary logic. HRIT does not cover contractors and vendors, so they need their own authoritative source mapped into the same model (Chapter 06).

Two grey boxes, HR moves to Core HCM and Identity moves to Entra ID, feed an amber box for OPM standard attributes and a blue box for HR-driven identity, which drives Entra ID and AD and then ICAM.

Two migrations, one opportunity: HR moves to Core HCM and identity moves to Entra ID; together they start HR-driven identity on OPM standard attributes.

Modernization outcomes

  • Day-one readiness: required accounts and approved baseline access are available when an affiliation begins.
  • Separation-to-block latency: logical access is blocked at the effective separation time, or within the agency-approved threshold.
  • Revocation completion: PIV and derived credentials, device certificates, sessions, and application-specific credentials are reconciled to completion.
  • Mover convergence: access derived from the prior assignment is removed, the new baseline applied, and residual exceptions reviewed.
  • Correlation coverage: governed workforce identities reconcile with enabled enterprise accounts.
  • Orphan reduction: enabled accounts without a current, approved authority record are found and resolved.
  • Explainable access: covered entitlements trace to a rule, an approved exception, an authoritative attribute, or a privileged-access decision.
  • Continuous evidence: provenance, provisioning results, workflow outcomes, exceptions, and drift findings come out of normal operation.

The canonical model and provisioning services exist to produce these outcomes; Chapter 01 sets out the scope, authority boundaries, and principles behind them.

Why, what, who, how

Question Chapters
Why Why should HR, not IT, decide who exists, and why now? 01, 02, 03
What What data, owned by whom, flowing how? 04, 05, 06
Who Who owns, uses and guards workforce identity data 07
How Lifecycle, credentials, access, evidence, the plan and a reference deployment 08, 09, 10, 11, 12, 13

Appendices: A — Lifecycle rules · B — Security and privacy assessment · C — Acceptance and cutover

Chapters

Title Description
Chapter 01 — Overview and Applicability The proposal: use Federal HR 2.0 and the Active Directory to Entra ID migration together to start HR-driven Entra ID, Active Directory and ICAM, built on OPM standard attributes. The outcomes, the architecture in one paragraph, authority boundaries, principles, where the book applies and where it doesn’t, and what federal guidance does and does not require.
Chapter 02 — Why HR Is the Source of Authority Fragmented identity truth, the orphaned account as its structural output, the federal policy and guidance that support a designated source, why the usual patches fail, and the division of labor between what HR provides and what identity architecture must add.
Chapter 03 — Federal HR 2.0 and the Core HCM Platform What OPM HRIT is, the Federal HR 2.0 memo and the Oracle Core HCM award, the wave clock that sets an agency’s provisioning deadline, why EHRI-shaped integrations have an expiry date, and what OPM does and doesn’t require of the identity leg.
Chapter 04 — Attribute Authority What the HR system of record owns and what the identity platform owns, effective dating, the authoritative-versus-derived rule for every attribute, the identifier layers and the enterprise identifier decision, the worker-type boundary, and the operating rules that keep one master per attribute.
Chapter 05 — Provisioning Services Provisioning services end to end, with API-driven inbound provisioning as the Microsoft implementation: the Oracle HCM source surfaces, the five middleware duties, the bulkUpload contract and its limits, the two landing zones (Active Directory through the provisioning agent, Entra ID directly), native connectors, and one-way writeback.
Chapter 06 — The Canonical Workforce Identity Model The standard-attribute layer — OPM data elements and nature-of-action codes as the contract — and the one attribute schema the whole site uses: each canonical field with its Oracle HCM source, SCIM attribute, Active Directory and Entra ID carrier, whether a dynamic membership rule can read it, and what it’s for — native Entra attributes first, three coded extension attributes for access, and the writer rules that protect them.
Chapter 07 — Who Owns Workforce Identity Who owns the workforce data (HR, the OPM Federal HR 2.0 program and the contractor sources), who uses it, who guards it, the data architect’s role as steward of one model and one key, a responsibility matrix for the key decisions, and where ownership commonly fails.
Chapter 08 — Joiner, Mover, Leaver The five lifecycle events and the identity actions each one causes; who creates accounts (provisioning) and who acts on them (Lifecycle Workflows); triggers, schedules and built-in tasks; emergency termination, rehire, conversion and deletion.
Chapter 09 — Credentials and Certificates Across Joiner, Mover, Leaver How identity-based credentials follow the workforce lifecycle: PIV issuance, certificate binding, revocation checking, derived PIV credentials, device certificates, immediate logical-access blocking, and reconciliation of offboarding actions to completion.
Chapter 10 — From Attributes to Access The derivation chain from worker record to entitlement: rules for dynamic membership written against the canonical schema, administrative units for delegation, access packages and access reviews routed to the supervisor of record, and where PIM and assigned groups take over.
Chapter 11 — Drift, Metrics and Evidence The lifecycle metrics an event-driven pipeline makes measurable, the classes of drift between HR and the directory and how to detect each one, the evidence each lifecycle event leaves, and what the architecture contributes to NIST SP 800-53 Rev. 5 AC-2, AC-2(1), PS-4, PS-5, IA-4 and SI-12 — and what the agency still has to supply.
Chapter 12 — Execution Plan One phase model for the whole program, Phase 0 to Phase 6, with the work and the exit gate for each: program alignment, attribute authority and schema, pipeline build and test, hybrid go-live, lifecycle automation and attribute-derived access, cutover to cloud-mastered populations, and sustained posture. Plus roles and the open verification register.
Chapter 13 — Reference Deployment (Illustrative) An illustrative walk-through of the book for a mid-size federal civilian agency in Wave 2: the starting estate, what each phase does and finds, the evidence package an assessor receives, and what the agency keeps afterward. A pattern, not an attested engagement.
Appendix A — Lifecycle Rules The rules that keep HR-driven lifecycle automation safe: scope, leave versus leaver, event precedence, rescinded offers, cancellations, partial leavers, the quarantine contract, manager links, rehire and conversion.
Appendix B — Security and Privacy Assessment The data-flow security and privacy assessment for HR-driven identity: the Privacy Act disclosure basis and the PIA, attribute minimization, protecting every leg, service identities without secrets, least privilege, and what the logs may hold.
Appendix C — Acceptance and Cutover How a population moves to HR-driven identity: acceptance tests in business terms, a signed validation report, a dry run, cutover with rollback, proof that HR is the sole source, and closing the ticket path.
No matching items

Where this book sits in the workbook

Back to top