Once again time to share where we are on this project.  We are in the home stretch.

Attached is the latest spreadsheet of what is happening with the reorg.  It differs from the last one I sent in that I’ve added delegation groups for AD and UFX.  There are also notes regarding what needs to happen at the bottom of the sheet.   On Thursday these delegation group changes will happen (renames and permissions granted).  Unfortunately the new permissions won’t be that useful since it’ll be granted on the new OUs (and people objects haven’t moved yet).

I’ve asked before and remember that these groups were not being used in scripts or shib arp authentication so these renames shouldn’t be an issue.  However, if you do notice something off late Thursday or after and it has to do with one of these groups it may be because of a rename.  Permissions are being added; they are not being removed from existing OUs (so you won’t lose any existing access you have to your current OUs).

Thursday afternoon I will also be meeting with Identity Access Management to finalize the date/time that they can handle our NMB touches.  I’ve considered many different ways to handle the NMB touches to make sure people move appropriately.  In the end the best way to handle this is to work off UFAD data instead of trying to get data out of the directory.  The day the NMB touch is to be done I will be dumping current data from UFAD, running it through my processes to create a list of UFID to NMB assignments and supplying it to IAM.  If people exist in your old OUs they will exist in your new OUs.  Where an old OU is being done away with the NMB will be assigned based on the below crosswalk.  You will then be able to use the DEPTIDs in the spreadsheet to move people about as you desire.

If you have questions please let me know.  I will let you all know the scheduled date of the NMB assignments change and IAM touch after my Thursday meeting.