We turned on Auto Provisioning about 6 months ago. We currently map First and Last Name, Email, Company, Title, and phone extension. We tried Supervisor, Access Level, and Groups, but the work to modify the AD and Ping challenged the IT organization and we are currently regrouping on that. Keep in mind that some of these fields (phone extension for instance) have limits on size, so if you map a field that is too big, it will break. The key for success is three-fold:
Setup a request queue for your new users to request access. In that request, make sure the custom form asks all the questions that you are not able to capture through the SSO gateway or important information that will support any governance you have. I would also suggest you build the form to support account changes so that there is one user management form. Regardless of the approach, remember to share the form with either the default group (below) or everyone; whichever is applicable. And if you have multiple admins, this is the time to build out the queue topics to route the request to the right admin.
When a new user is created, it defaults the account into the first group alphabetically in the system. Create a new group (such as 1Autoprovision) that will help find those people. If you don't want to share the one user management form/request queue with everyone, share the project with this first ranking group and then it will disappear once you complete the provisioning process. Best practice: Do not leave people in this group. You will invariably need to update at least one item on the record of the user and this is a great way to distinguish those that have from those that haven't.
When a user is deactivated, auto-provisioning will no longer work for that user. They will get an error and a login screen. Build a communications plan and a process to triage these exceptions.
As with any feature implementation, communications are absolutely required. Telling people to go to a website to have their account created automatically and then submit a request is not as easy as it sounds. So, a simple communications plan will go a long way. Finally, reports are your friend for this. You will need a dashboard that tracks open requests, tracks people in this temporary holding group, and deactivated users. This will help you troubleshoot failures, and maintain a level of service and continuity with the Workfront offering. Dale Whitchurch Arthrex Inc