User Information Synchronization Between Azure AD (Entra ID) and Ramp

1. Introduction to User Information Synchronization

Synchronization' in a broad sense refers to the orderly, recurrent sharing of information between two or more synchronized entities with the goal of achieving the same state. Unidirectional synchronization is termed 'replication', and bi-directional synchronization is often just called 'synchronization'. 'Provisioning' is the synchronization of user account information. This synchronization process is a non-trivial operation in complex administrative systems, pertaining in particular to semi-autonomous organizations featuring traps and deadlocks under disconnection. Step-up integration strategies can proceed abstractly from integration on the level of the identity, user account, or role. Nevertheless, increasing complexity in the integrated mechanisms, as well as a growing trend for outsourced specialized services in enterprises, increasingly suggest a single sign-on strategy on the identity level. In this essay, we attempt to study identity integration mechanisms' ability in federated service frameworks. We outline the synchronization mechanism that presently interconnects the internal account management system with liberalized access controls for the research infrastructure with the identity system of a third party. Future efforts will specify versus non-technical barriers in approximate areas.

2. Azure AD (Entra ID) Overview

Introducing Azure Active Directory: What is Azure Active Directory? Azure is the Azure cloud service platform that provides identity and access management. This platform eliminates easily predictable passwords and allows a user to access all the applications and services via one click. There are multiple integrations with non-Microsoft systems such as SaaS and on-premises, with thousands of such applications. Azure AD provides a full set of user management features; it manages these functionalities through groups.

User Management Features: With Azure AD, one can manage new user account creation and manage permissions, including their roles.

Security Features: It provides features for limiting unsuccessful sign-in attempts to a maximum limit within a certain period. It checks the source of the sign-in location, and the integrated applications are also made to pass their security policies to protect the applicant.

Integration Features: With the rise of non-Microsoft and SaaS applications, Azure AD comes with its greatest feature of integrations. This tool integrates with Office 365, Dynamics 365, Intune, and Windows Store for Business. With a large number of APIs available, you can also do integrations with various services.

Identity Types: There are three types of users:

Guest User: These types of users are temporary; they can be created and deleted anytime, and some of them do not even require a sign-in ID and password at the time of acceptance as guest users. Hence, these types of users have very limited validity, and they receive an invitation from the source to access some services or applications. Such types of registrants can also have some temporary permissions.

3. Ramp Overview

Over the years, Universal Identity Services has been developing a modern platform for user management and access to information and applications – Ramp. In short, it is designed to be the primary store for today’s user information and a high-performance application front end. Its architecture is built with the user at the center, and its technology is based mainly on a platform as a service language, with an event-based, defaults-first design. We want to meet enterprises where they are and bring them to a new era of administrative efficiency.

Ramp is capable of serving both internal and external customers with valuable applications and services that enable them to better operate or interact. A major aspect of what Ramp is designed to ease is the time and thought that has to be put into managing user information – the system is designed to be as easy as providing the minimal amount of detail of an identity. That information results in the ability for that identity to access what they require based on the applications at the unit level as well as the roles and sites the identity requires.

User data integrity is of critical importance to both customers and users. In the era of increased demand for data privacy, a design decision has been made to have the user accounts owned and operated by the employee, and a means for user management information to be automatically deleted in a compliant manner has been provided. This feature supports the customer’s ability to manage their user information in a manner that aligns with business and regulatory requirements. In addition to the global attributes and specific details, the following are the integration points from a user information perspective. Ramp provides a set of sub-services that give those requests and responses accessibility as well as provides additional abilities for user and role information. Some of the use cases possible on the platform include application provisioning, kick-off workflows and actions, user transfer, and system delete/numbering processes. There is also a self-service lookup view that can be granted for read-only visibility for individual services. The staff member assigned this role can search against an email or username and get back several details. Many of the granular feature specifics are outlined in the relevant aspect of the Ramp User Model. The platform is ever-growing and moving to be aligned with new and changing practices based on current use cases or development trends.

4. Synchronization Methods and Best Practices

There are different methods for synchronizing user information between Azure AD and Ramp.

• JIT - the user login workflows store required user details. These details can be used for provisioning or for performing authorization calls against Azure AD. Ramp’s API has to be exposed to be used in this fashion.
• Azure AD Synchronization can synchronize user profiles or certain attributes to an application through an automated workflow. The workflow will, when triggered, pull in details about a user from Azure AD and update the user’s profile accordingly. These workflows can be scheduled to run at 12 hours, 24 hours, monthly, or yearly intervals.
• Azure AD Synchronization can synchronize user profiles or certain attributes to an application through our CIAM APIs. This is done by configuring “API Connectors” in Ramp.

Synchronizing user information automatically has some potential pitfalls. The biggest risks are related to data accuracy. Updated user information is always an artifact of a process that may fail or may have failed to begin with. If accidental losses of coverage may be unacceptable, flexible strategies to mitigate risks, such as accommodating the occasional possibility of an unseen object identifier mismatch, are essential. All synchronization methods share some security and governance considerations. Best practices to ensure compliance and data accuracy are:

• Start by determining if a user does or does not exist and/or if a user is active or not prior to synchronization. This user is generally handled in heavier workflows using the Graph API in Ramp scenarios.
• Make certain that data mapping is a “one-to-one” relationship.
• Standard practice: Sync operations should only push changes in one direction.
• In any user sync scenario, it’s important to establish clear governance and monitoring of their synchronization methods. Utilize Azure AD RBAC roles in your sync configuration to monitor, manage, or update Connectors. Ensure to schedule regular audits to account for changes in enrollment as new users enroll or previous users become non-students or staff. Operational considerations need to take into account time zone differences. Regular updates also ensure that systems remain compliant administratively with any changes in policy that may require a larger re-enrollment wave.

In any user sync scenario, it’s important to establish clear governance and monitoring of their synchronization methods. Utilize Azure AD RBAC roles in your sync configuration to monitor, manage, or update Connectors. Ensure to schedule regular audits to account for changes in enrollment as new users enroll or previous users become non-students or staff. Operational considerations need to take into account time zone differences. Regular updates also ensure that systems remain compliant administratively with any changes in policy that may require a larger re-enrollment wave.

5. Conclusion and Future Developments

Five years ago, managing user information was not a "big problem" for many companies. The cloud-based identity provider could be asked to provision, update, and delete user accounts in software as a service without on-prem data stores by using either SCIM or the software provider's API from the SaaS. However, as time passed and the software migrated to the SaaS model, automation needed to be set up to synchronize user information between Azure AD and these different SaaS. The main obstacle was that Entra ID's user information was the authoritative source, and other SaaS had to be provisioned, updated, or removed to be in sync, as almost no data moved from AAD upwards at all.

The manual synchronization of user information between Ramp and Entra ID every time it is changed in Entra ID is not very efficient from either a security or an effective organization perspective. Synchronization between two directories can reap a lot of benefits. This has to be done in an efficient and safe way, though. To minimize the risks of repetitive changes going back and forth, products that use AI technology for identity management can keep track of which platform the user is active in and changes in one directory. Functionality and AI improvements in such and similar software for user synchronization may be future enhancements, although it could be a challenge to implement. They adapt and improve over time. Organizations can't be static, and they need to continually learn to become better at making informed predictions about the future.

This discussion ends by arguing that there are more, and probably new, things to discover, and maybe solutions and principles to invent for creating efficient synchronization processes or creating business processes that are adaptive to new tools and changing environments. This calls for attention from organizations. As a practitioner, we can recommend stakeholders involved in user synchronization to pay close attention to their practices in this field and to act on reasonable impulses or insights.