HR-Driven Identity

From the HR System of Record to Entra ID — how hire, transfer, and separation records become accounts, access, and evidence

One series for HR-driven identity in a federal civilian agency: why the HR system of record is the source of authority, the Federal HR 2.0 program, attribute authority, the API-driven provisioning pipeline, one canonical attribute schema, joiner-mover-leaver with Lifecycle Workflows, credentials and certificates, attribute-derived access, drift and evidence, the phased execution plan, and an illustrative reference deployment.

HR-Driven Identity: From the HR System of Record to Entra ID

ImportantStatus — Draft series

This series consolidates what used to be nine separate pages on HR-driven identity (two execution plans, a vendor-neutral lifecycle guide, three reference-deployment write-ups, a whitepaper, an architecture note and a dynamic-group library) into one ordered reading sequence, and adds a chapter on credentials and certificates. It’s a draft. Program facts about Federal HR 2.0 are dated and change; check them at engagement time.

TipDownload the full series

hr-driven-iam-bundle.docx — every chapter concatenated into one Word document. Regenerated on every site deploy.

One chapter at a time: 00 · 01 · 02 · 03 · 04 · 05 · 06 · 07 · 08 · 09 · 10 · 11

An agency’s identity platform can prove, cryptographically and at every hop, that a claim was signed by the party allowed to sign it. It can’t tell you whether the claim is true: whether the person behind the credential still works for the agency, still holds the position the access was granted for, still reports to the supervisor who approved it. That is an employment fact, and it lives in exactly one system: the human capital system of record.

This series is about wiring that system to Microsoft Entra ID so that accounts, access, and their removal become consequences of HR records rather than tickets. It’s written for a federal civilian agency in the commercial Microsoft cloud at GCC-Moderate / FedRAMP Moderate, receiving its HR data from the government-wide Federal HR 2.0 platform (Oracle Fusion Cloud HCM), and it stays source-agnostic wherever it can.

Reading sequence

Chapters 00–02 make the case and set the context. Chapters 03–05 define the data: who owns which attribute and what it’s called everywhere. Chapters 06–09 turn the data into lifecycle, credentials, access and evidence. Chapter 10 is the execution plan and Chapter 11 an illustrative deployment.

Title Description
Chapter 00 — Overview and Applicability The problem, the HR-agnostic architecture in one paragraph, where the series applies (commercial cloud, GCC-Moderate, FedRAMP Moderate, Federal HR 2.0 agencies) and where it doesn’t, and what federal guidance does and does not require.
Chapter 01 — Why HR Is the Source of Authority Fragmented identity truth, the orphaned account as its structural output, the federal frames that require a designated source, why the usual patches fail, and the division of labor between what HR provides and what identity architecture must add.
Chapter 02 — Federal HR 2.0 and the Core HCM Platform What OPM HRIT is, the Federal HR 2.0 memo and the Oracle Core HCM award, the wave clock that sets an agency’s provisioning deadline, why EHRI-shaped integrations have an expiry date, and what OPM does and doesn’t require of the identity leg.
Chapter 03 — Attribute Authority What the HR system of record owns and what the identity platform owns, effective dating, the authoritative-versus-derived rule for every attribute, one person one identifier for life, the worker-type boundary, and the operating rules that keep one master per attribute.
Chapter 04 — The Provisioning Pipeline API-driven inbound provisioning end to end: the Oracle HCM source surfaces, the four middleware duties, the bulkUpload contract and its limits, the two landing zones (Active Directory through the provisioning agent, Entra ID directly), native connectors, and one-way writeback.
Chapter 05 — The Canonical Attribute Schema The one attribute schema the whole site uses: each canonical field with its Oracle HCM source, SCIM attribute, Active Directory and Entra ID carrier, whether a dynamic membership rule can read it, and what it’s for — native Entra attributes first, three coded extension attributes for access, and the writer rules that protect them.
Chapter 06 — Joiner, Mover, Leaver The five lifecycle events and the identity actions each one causes; who creates accounts (provisioning) and who acts on them (Lifecycle Workflows); triggers, schedules and built-in tasks; emergency termination, rehire, conversion and deletion.
Chapter 07 — Credentials and Certificates Across Joiner, Mover, Leaver How identity-based certificates follow the HR record: PIV issuance and the Master User Record, binding PIV certificates to Entra users with certificateUserIds, CRL checking, derived PIV credentials, Intune and Cloud PKI device certificates, and the canonical leaver sequence that revokes them in the right order.
Chapter 08 — From Attributes to Access The derivation chain from worker record to entitlement: rules for dynamic membership written against the canonical schema, administrative units for delegation, access packages and access reviews routed to the supervisor of record, and where PIM and assigned groups take over.
Chapter 09 — Drift, Metrics and Evidence The lifecycle metrics an event-driven pipeline makes measurable, the classes of drift between HR and the directory and how to detect each one, the evidence each lifecycle event leaves, and how the architecture closes NIST SP 800-53 Rev 5 AC-2, AC-2(1), PS-4, PS-5, IA-4 and SI-12.
Chapter 10 — Execution Plan One phase model for the whole program, Phase 0 to Phase 6, with the work and the exit gate for each: program alignment, attribute authority and schema, pipeline build and test, hybrid go-live, lifecycle automation and attribute-derived access, cutover to cloud-mastered populations, and sustained posture. Plus roles and the open verification register.
Chapter 11 — Reference Deployment (Illustrative) An illustrative walk-through of the series for a mid-size federal civilian agency in Wave 2: the starting estate, what each phase does and finds, the evidence package an assessor receives, and what the agency keeps afterward. A pattern, not an attested engagement.
No matching items

How this series relates to other parts of the site

Back to top