--- title: Delegated User Provisioning Best Practices description: Of course, authoritative sources are called that because they have authority. With delegated user provisioning, you need to have additional controls. image: https://blog.empowerid.com/hs-fs/file-394420407-jpg/images/delegated_provisioning.jpg --- [![empowerID-logo](https://blog.empowerid.com/hubfs/empowerID-logo.svg "empowerID-logo")](http://www.empowerid.com) **![phone](https://blog.empowerid.com/hubfs/images/phone.svg)   1-877-996-4276   **or**  +1 (614) 652-6825** [![Share on facebook](https://7528309.fs1.hubspotusercontent-na1.net/hub/7528309/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/facebook-color.png?width=24&name=facebook-color.png) ](https://www.facebook.com/220903377569) [![Share on linkedin](https://7528302.fs1.hubspotusercontent-na1.net/hub/7528302/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/linkedin-color.png?width=24&name=linkedin-color.png) ](https://www.linkedin.com/company/85780) [![Share on twitter](https://7528304.fs1.hubspotusercontent-na1.net/hub/7528304/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/twitter-color.png?width=24&name=twitter-color.png) ](https://twitter.com/EmpowerID) [![Share on pinterest](https://7528311.fs1.hubspotusercontent-na1.net/hub/7528311/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/pinterest-color.png?width=24&name=pinterest-color.png) ](http://www.youtube.com/user/empowerID) # All-In-One Identity Management and Cloud Security Emerging technologies are challenging old paradigms and unveiling new ways of approaching the security discipline that enables the right individuals to access the right resources at the right times for the right reasons. EmpowerID has embedded innovative technologies in every aspect, providing flexible and mature IAM capabilities in the cloud, on premise and in hybrid environments, addressing the mission-critical need across increasingly heterogeneous technology environments, and meeting increasingly rigorous compliance requirements. # Delegated User Provisioning Best Practices Posted by [Edward Killeen](https://blog.empowerid.com/blog-1/author/edward-killeen) on Wed, Nov 27, 2013 - [Tweet](https://twitter.com/share) Sometimes there is no authoritative source.  Sometimes you just have to say, "Bob, provision me a user."  These are the cases where you will need a very flexible user interface to control user provisioning workflows. ![delegated provisioning](https://blog.empowerid.com/hs-fs/file-394420407-jpg/images/delegated_provisioning.jpg)See, that's the cool part, the UI is just what initiates the workflows in EmpowerID, the exact same workflows that are used when it detects a new employee in the HR system.  The same series of events are kicked off: assignment of roles, membership in groups, new accounts in the cloud, notification to the party planning committee, a single sign on dashboard.  It's all there, you are just starting it differently. Of course, authoritative sources are called that because they have [authority](http://img.pandawhale.com/81499-cartman-respect-my-authoritah-uFwf.gif).  You can trust them.  With delegated user provisioning, you need to have some additional controls.  The simplest and most efficient is to have an approval workflow shape where somebody in authority has to approve the new user.  Or approve any role with a security level over XYZ.  These approvals can be serial or parallel, they can go to someone in IT or HR or anywhere in between.  They can be decided based on who the new user is.  The important part is that one rogue employee won't be creating any domain admins named Joe Derp. Another consideration is the complexity of the user interface.  EmpowerID ships with over 400 usable out of the box identity management workflow templates.  About ten of these include user provisioning forms, ranging from what we call "super simple user provisioning" to "user provisioning".  The difference is what fields are required.  In super simple, the user puts in the name, department, title, and location of the user and EmpowerID dynamically assigns roles.  In simple, there is a dropdown of available roles depending on the attributes already defined and who the requester is (help desk can create X roles and HR can create Y roles for example).  There is also an IT based form where a sys admin who understands things like OU structures and the such can granularly define any attribute. Just my own personal opinion is that delegated user provisioning should always have an initial lifecycle.  This is easily accomplished by adding an expiration date dropdown on the form or creating a business rule in the workflow that it needs to be certified and renewed within that date period to continue its existence.  This is basically adding attestation to any user provisioning that happens outside of automated processes. The reason I believe this attestation and lifecycle are important is the use cases for delegated user provisioning.  The most obvious ones are: - temporary employees or contractors - task based highly privileged accounts - additional accounts for an existing user - partners and suppliers accounts None of these types of accounts should be subject to having perpetual access and permissions within your network.  With a strong IAM platform like EmpowerID, these security concerns can be alleviated even on users provisioned outside of normal channels. Take a look at this video demonstrating EmpowerID's [role-based user provisioning](http://www.empowerid.com/identitymanagementdemo#UserProvisioning); you can see some examples of the delegated user provisioning forms (because showing automated user provisioning makes for a boring demo :) ).  Then [schedule a personalized demonstration](https://blog.empowerid.com/scheduledemo/) where we can help you start designing your own user provisioning processes. [![Schedule a demo of Delegated User Provisioning](https://no-cache.hubspot.com/cta/default/174819/b53e0574-a805-449f-bf70-ea97b39bcae0.png)](https://cta-redirect.hubspot.com/cta/redirect/174819/b53e0574-a805-449f-bf70-ea97b39bcae0) Tags: [User provisioning](https://blog.empowerid.com/blog-1/topic/user-provisioning), [Identity and Access Management (IAM)](https://blog.empowerid.com/blog-1/topic/identity-and-access-management-iam) ### About EmpowerID EmpowerID is the all-in-one Identity Management and Cloud Security platform designed for people.  Globally managing millions of identities in diverse enterprises, EmpowerID offers comprehensive provisioning, single sign-on and access governance coupled with an industry leading user experience.  Built on a single codebase for manageability and scalability, EmpowerID ships with a powerful API, a visual workflow designer and over 400 ready-to-use workflows for rapid deployment.   [![Free Evaluation of EmpowerID](https://no-cache.hubspot.com/cta/default/174819/daebe087-5275-487d-bf53-bb1d39fb9dc4.png)](https://cta-redirect.hubspot.com/cta/redirect/174819/daebe087-5275-487d-bf53-bb1d39fb9dc4) ### Latest Posts ### Posts by category - [2-Factor (2)](https://blog.empowerid.com/blog-1/topic/2-factor) - [Access Governance (36)](https://blog.empowerid.com/blog-1/topic/access-governance) - [Active Directory (46)](https://blog.empowerid.com/blog-1/topic/active-directory) - [Attestation (4)](https://blog.empowerid.com/blog-1/topic/attestation) - [authentication (6)](https://blog.empowerid.com/blog-1/topic/authentication) - [authorization (2)](https://blog.empowerid.com/blog-1/topic/authorization) - [azure (1)](https://blog.empowerid.com/blog-1/topic/azure) - [Azure security (2)](https://blog.empowerid.com/blog-1/topic/azure-security) - [azuread (1)](https://blog.empowerid.com/blog-1/topic/azuread) - [Cisco (1)](https://blog.empowerid.com/blog-1/topic/cisco) - [Citrix (1)](https://blog.empowerid.com/blog-1/topic/citrix) - [cloud (1)](https://blog.empowerid.com/blog-1/topic/cloud) - [cloud security (28)](https://blog.empowerid.com/blog-1/topic/cloud-security) - [consumers (2)](https://blog.empowerid.com/blog-1/topic/consumers) - [Data Governance (5)](https://blog.empowerid.com/blog-1/topic/data-governance) - [dataprivacy (1)](https://blog.empowerid.com/blog-1/topic/dataprivacy) - [DirSync (1)](https://blog.empowerid.com/blog-1/topic/dirsync) - [eic (1)](https://blog.empowerid.com/blog-1/topic/eic) - [Federation (6)](https://blog.empowerid.com/blog-1/topic/federation) - [Gartner (1)](https://blog.empowerid.com/blog-1/topic/gartner) - [GDPR (2)](https://blog.empowerid.com/blog-1/topic/gdpr) - [Governance and Regulatory Compliance (4)](https://blog.empowerid.com/blog-1/topic/governance-and-regulatory-compliance) - [GRC (3)](https://blog.empowerid.com/blog-1/topic/grc) - [Group Management (12)](https://blog.empowerid.com/blog-1/topic/group-management) - [IAG (4)](https://blog.empowerid.com/blog-1/topic/iag) - [IAM (34)](https://blog.empowerid.com/blog-1/topic/iam) - [IDaaS (1)](https://blog.empowerid.com/blog-1/topic/idaas) - [Identity and Access Management (IAM) (68)](https://blog.empowerid.com/blog-1/topic/identity-and-access-management-iam) - [Identity Management (6)](https://blog.empowerid.com/blog-1/topic/identity-management) - [iga (1)](https://blog.empowerid.com/blog-1/topic/iga) - [M365 security (1)](https://blog.empowerid.com/blog-1/topic/m365-security) - [Magic Quadrant (1)](https://blog.empowerid.com/blog-1/topic/magic-quadrant) - [O365 (1)](https://blog.empowerid.com/blog-1/topic/o365) - [Office 365 (3)](https://blog.empowerid.com/blog-1/topic/office-365) - [open policy agent (1)](https://blog.empowerid.com/blog-1/topic/open-policy-agent) - [Palo Alto (1)](https://blog.empowerid.com/blog-1/topic/palo-alto) - [Password management (13)](https://blog.empowerid.com/blog-1/topic/password-management) - [Privacy and EU-US Data Transfers (1)](https://blog.empowerid.com/blog-1/topic/privacy-and-eu-us-data-transfers) - [Privacy Shield (1)](https://blog.empowerid.com/blog-1/topic/privacy-shield) - [Radius (1)](https://blog.empowerid.com/blog-1/topic/radius) - [RBAC (2)](https://blog.empowerid.com/blog-1/topic/rbac) - [Role Based Access Control (RBAC) (40)](https://blog.empowerid.com/blog-1/topic/role-based-access-control-rbac) - [SAML (4)](https://blog.empowerid.com/blog-1/topic/saml) - [Separation of Duties (2)](https://blog.empowerid.com/blog-1/topic/separation-of-duties) - [SharePoint (8)](https://blog.empowerid.com/blog-1/topic/sharepoint) - [siemens (1)](https://blog.empowerid.com/blog-1/topic/siemens) - [Single Sign-on (1)](https://blog.empowerid.com/blog-1/topic/single-sign-on) - [Single Sign-on (SSO) (26)](https://blog.empowerid.com/blog-1/topic/single-sign-on-sso) - [social media (1)](https://blog.empowerid.com/blog-1/topic/social-media) - [SSO (3)](https://blog.empowerid.com/blog-1/topic/sso) - [User provisioning (28)](https://blog.empowerid.com/blog-1/topic/user-provisioning) - [VDS (1)](https://blog.empowerid.com/blog-1/topic/vds) - [Virtual Directory (28)](https://blog.empowerid.com/blog-1/topic/virtual-directory) - [WS-Fed (2)](https://blog.empowerid.com/blog-1/topic/ws-fed) ### Subscribe via E-mail Share This Page [![Share on facebook](https://7528309.fs1.hubspotusercontent-na1.net/hub/7528309/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/facebook-color.png?width=24&name=facebook-color.png) ](http://www.facebook.com/share.php?u=https%3A%2F%2Fblog.empowerid.com%2Fblog-1%2Fbid%2F326805%2FDelegated-User-Provisioning-Best-Practices%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://7528302.fs1.hubspotusercontent-na1.net/hub/7528302/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/linkedin-color.png?width=24&name=linkedin-color.png) ](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fblog.empowerid.com%2Fblog-1%2Fbid%2F326805%2FDelegated-User-Provisioning-Best-Practices%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://7528304.fs1.hubspotusercontent-na1.net/hub/7528304/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/twitter-color.png?width=24&name=twitter-color.png) ](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fblog.empowerid.com%2Fblog-1%2Fbid%2F326805%2FDelegated-User-Provisioning-Best-Practices%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fblog.empowerid.com%2Fblog-1%2Fbid%2F326805%2FDelegated-User-Provisioning-Best-Practices%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://7528311.fs1.hubspotusercontent-na1.net/hub/7528311/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/email-color.png?width=24&name=email-color.png) ](mailto:?subject=Check%20out%20https%3A%2F%2Fblog.empowerid.com%2Fblog-1%2Fbid%2F326805%2FDelegated-User-Provisioning-Best-Practices%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fblog.empowerid.com%2Fblog-1%2Fbid%2F326805%2FDelegated-User-Provisioning-Best-Practices%3Futm_medium%3Dsocial%26utm_source%3Demail) ![](https://blog.empowerid.com/hubfs/images/logo-empowerid.svg) 4393 Tuller Road Dublin OH EmpowerID is a registered trademark and trade name of The Dot Net Factory, LLC. EmpowerID © 2021 EmpowerID ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Edward Killeen", "url" : "https://blog.empowerid.com/blog-1/author/edward-killeen" }, "datePublished" : "2013-11-27T15:57:00.000Z", "headline" : "Delegated User Provisioning Best Practices", "image" : [ "https://blog.empowerid.com/hs-fs/file-394420407-jpg/images/delegated_provisioning.jpg" ], "mainEntityOfPage" : { "@id" : "https://blog.empowerid.com/blog-1/bid/326805/Delegated-User-Provisioning-Best-Practices", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.empowerid.com/hubfs/Asset%201.svg" }, "name" : "EmpowerID" } } ```