Active Directory Automation RFSP # 1382 Addendum # 1 November 5, 2015

Transcription

1 Active Directory Automation RFSP # 1382 Addendum # 1 vember 5, 2015 This document will be updated as new Questions and Answers are added. Please check back to see if there are updates. 1. How many environments is RISD planning on implementing for this project? Environment examples are Development, Test, and Production. Test & production 2. Approximately, how many AD groups are involved in this project? We currently have just under 1,900 groups in AD. 3. Can you please provide a breakdown of the 40K users? Are they all staff/employees or do they include students? Roughly 5k-6k staff, the rest are students. From a licensing perspective, we re currently looking at licensing for 26k (5-6k staff, rest students). 4. Does RISD prefer for consultants to do the work onsite, offsite, a mixture of both? Please provide the preference in terms of ratio. Completely off-site is acceptable. 5. Is RISD requiring us to produce an Operational Guide from the administrators? 6. Will Project Management and Controls be provided by the vendor or by RISD? Vendor. That is, if it s even required. There are products that will cover the RFP that are simple enough to roll out without any need of Vendor involvement. At this point, we are not looking to integrate this with anything beyond AD, Exchange and possibly Office Is the vendor required to produce the Test plan for the Acceptance Testing?

2 8. How long would RISD require the vendor to provide Post production support? 9. Is the vendor required to do a performance audit? Performance example would be response times, task times. 10. Is the vendor required to conduct a Rollout and Communication strategy to assist RISD on rolling it out to the end users?. 11. Is the vendor required to integrate the solution with a Single Sign On solution, for example, ADFS? Or is passthrough authentication with AD credentials sufficient?. Passthrough with AD credentials is sufficient. 12. Please describe RISD s testing cycles. 13. Are there resources dedicated on the RISD side to test the solution? Resources can be interpreted as bodies and/or hardware. Dependent on the scope of testing, yes, RISD will provide hardware and or staff support for testing where appropriate. 14. Is there a system of record for the identities, such as an HR system? If so, what is that system? For the purposes of this RFP, AD is the system of record. 15. Besides AD, are there other target systems that you want the automated provisioning for, even if it s for the future 16. Is RISD requiring the vendor to configure a periodic review of access, whereby Managers or Role Owners would review and certify direct reports access or Role members?. 17. Is RISD requiring that the newly-reset password be synchronized across other target systems?.

3 18. Is RISD requiring that the users can do the Ctrl-Alt-Del sequence in PC workstations in order to reset the passwords? If so, how many workstations are there, roughly? The number of PS workstations/laptops in active directory is roughly 18, What types of reports is RISD looking to produce from the solution? The item s that we re concerned with from a reporting perspective are listed in the RFP. 20. Approximately, how many Roles is the vendor configuring to automate the provisioning process? 21. Is RISD requiring that Integration with a ticketing system be configured?. 22. Is it required to have a solution that can provide a delegated view of AD that maps directly to a user s delegated rights assignments? t required. 23. Is it required to have a solution that can provide password self-service that would extend to non- Windows systems? If this question is aimed at password self-service from the login screen on non-windows systems, the answer is no. Web based password self-service is enough. 23. Is it required to have a solution that can provide the ability to provision and deprovision O365 accounts? t required. 24. Is it required to have a solution that can provide dynamic groups defined by query? I m going to answer that this is not required. But, we d like a solution that reduces the number of assignments that we currently have to make to manage at least rights The easier it makes assignments, the better. As an example of what we d consider as the optimal solution, it would allow us to setup a permission set that gives specific rights to user objects and that role can include multiple assignments to multiple scopes such that a scope could include assignment of rights to objects in all of the OUs named student without having to manually designate all of the student OUs. And the defined scopes can also be used in other roles. A scope in this case would be considered what we defined as a Virtua OU in the RFSP. A more concrete example: Role1 (permission set for managing accounts ) Assignments to role1

4 - Helpdesk group: scope = all staff OUs (staff virtual OU), and all student OUs (student virtual OU) - Campus student account administrators at campus XYZ: scope = one specific student OU Role2 (permission set for managing phone number(s)) Assignments to role2 - Telephony group: scope = all staff OUs (the same staff virtual OU used previously) 25. Is it required to have a solution that can provide MS Lync provisioning and management? t required. 26. Can you provide a breakdown of the number of students and number of faculty/staff? 38,000 / 5, Are you currently using AD FS & DirSync to synchronize O365?. It s an option that we are considering. 28. Can you elaborate on the 5 year warranty request? This solution will provide 8x5xNBD Software and/or Hardware support and maintenance. RISD will pre-purchase five years of support. 29. Are you currently leveraging Azure AD and Azure AD Synchronization (with AD FS) for SSO within Office 365? 30. Do you currently own any licensing related to the Azure AD Premium product? I really don t know what the term Azure AD premium products includes. If it helps, we have O365 E2 licensing that basically amounts to being a bonus based on what we were actually purchasing. 31. What is the goal with Virutal OU requirement (is it based on allowing dynamic management of geographic OU s without providing rights to individual OU s)? Answered in other Q&A s 32. How many Forests and Domains will be managed and what are their functional levels? One forest with two domains (parent/child) Currently we don t have plans of adding more of either and we hope we never have to do so. Child domain is the only one that we actually need to support with this solution. Forest level: 2008R2, both domains: 2012 (not R2)

5 33. How many full-time employees does Richardson ISD currently have? 5,000 is the relative number of RISD employees. I do not have a break down as to Full/Part time. 34. In section 4.2 is states the solution must be Windows based. Is a soft appliance (i.e. Linux) acceptable? Yes, as long as the VM can be run in hyper-v 2012r What accounts are included in this project (staff, student and parent accounts)? Staff and students. 36. What sources of authority exist for these different account types? For the purposes of this RFP, AD is the source. 37. Can you please provide additional information regarding your vision for Virtual OU s? I hope this was explained in other answers. 38. Can you please explain "customizable value generation of properties that can be customized based on customizable scopes (Virtual OU, AD Groups etc.)? The easiest way I can think of explaining this is to give an example. Staff virtual OU (as defined in a previous answer) When someone goes to create an user account in any of the OUs in that virtual OU, they would type in: first name, possibly initials, last name and based on rules we create, other properties would fill in automatically. Examples: Display name would be filled in with last, first, samaccountname would fill in with first initial + up to 7 digits of last name. Based on the actual OU (not virtual) where the account is created, it will be put into certain groups. Student virtual OU - type in first, possibly initials, last and samaccountname. The format of samaccountname for students is such that it can t be generated based on what they ve already typed in. But, that value would automatically be used to fill in other properties. 39. Is there any flexibility in the requirement to not extend the AD schema? We will consider minor changes in the AD schema.