How is Autoprovisioning intended to work after Admin Console migration?

[Mylah]

I posted previously about issues our organization has been having with console migration. Unfortunately, those issues are still far from resolution. In the meantime (while we continue to try to work out the other issues), I anticipate another hurdle with autoprovisioning. We use autoprovisioning heavily in our instance and depend on it to allow requesters - people coming to Workfront for the first time who have no training in it - to be able to get in and fill out request forms. 

One post from another customer describes the functionality of autoprovisioning as working but less than ideal because of a new user having to navigate through several links to get to a request form (and can presumably get lost along the way).

However, last week, we were told by the rep assigned to our console migration that "autoprovisioning is not supposed to work". Does this mean that autoprovisioning is not supported once we've migrating (until Adobe rolls out some new feature called "zero touch" that the rep mentions in the messages here:? 

We are now confused as to what is the expected behavior of autoprovisioning post-migration. If we were to migrate tomorrow with our SSO intact (another issue unrelated to this post) and a new requester were to click a link directly to a request form, what - by design - should the user experience exactly? 

With so many issues to discuss with our migration, it's hard to get answers on this topic via our migration ticket, so I am turning to the Community, especially to those who have already migrated and depend on auto-provisioning to help provide clarity on expected behavior. 

At this point, if it's possible for anyone to provide a video of the actual user experience of a user attempting to get Autoprovisioned for Workfront on an instance already migrated to the console, that would be so helpful in allowing us to set our own users' expectations and train them properly. Thank you. 

[RAshley]

We haven't migrated yet but have been told that auto-provisioning will work provided that we go through the Enterprise Storage Migration beforehand.

Following this closely.

[user01245]

I've had the same questions, and it's why I've continually delayed our Admin Console migration.  One support rep mentioned an upcoming feature called a 'Product access automation rule'. This was supposed to be a URL that new users could visit that would create a new account, but I haven't heard anything about that in a couple of months.  

When we've talked to different levels of support reps, we've gotten different answers about what's possible. Hoping others can provide more insight, thank you!

[Lyndsy-Denk]

Autoprovisioning doesn't currently work.

There are half-workarounds, though. Here's how it works for us:

Keep in mind that our instance uses Azure SSO, so results may vary if you use a different approach to user logins.

With Azure, we're able to create a group. That group has SSO access to Workfront, therefore anyone in the group has access to Workfront. When an employee is added to the Workfront Azure group, it creates a record in Workfront with the lowest access level and the user can freely login. Ahead of our migration, IT populated this group with existing users. We had a relatively seamless transition. There were a few people who had login snafus (maybe a dozen out of nearly 2000 users), but I had a dedicated person in IT to help me monitor this for the first couple of weeks after our migration.

So how do we add users to the group? When we broached the idea of adding all company employees to this Azure group, IT basically laughed in my face. Instead we created a ticketing system to automate 90% of the process:

1. Someone submits a ticket. (The submitter can anyone: the user who needs access, their manager, a project owner who knows they'll need to communicate with the new user in a project, me, etc.)
2. That ticket automatically sends an approval request to the system admin (me).
3. The approver approves the request.
4. The system refreshes within the hour, which creates the Workfront record.

Yes, this was a big change, so preparing communications before, during, and after your migration is essential. Things I did to help with the transition:

• I posted instructions on our SharePoint site on how a new user can gain access to Workfront. If someone knocks on my virtual door in confusion that we no longer have autoprovisioning, I send those instructions (or submit the ticket on their behalf) and move on.
• I keep an ear out for any bulk needs. Recently we had a case in which we needed to add over 200 users just so they can access a request form. In that case, I submitted a spreadsheet to IT and they bulk loaded those users.
• Any users who are added to a proof will appear in my user list as an email address. I  audit the system every other week to submit the IT ticket to formally add them. I do this with a report that picks up new user entries within the last 3 weeks. I have a report with recurring tasks that prompt me to do this new user audit so I don't forget.

A year later, I still have people within my department who come to me confused, but it's fewer and fewer.

Exception: Our external users have their own email addresses and therefore don't log in with SSO. As system admin, I add them to the admin console by their email address. I follow up with an email to the external user with instructions on how to log in.

[Mylah]

Wow, @Lyndsy-Denk, that is quite the workaround. I hope things continue to get easier and hope - even more - that Adobe provides more support for autoprovisioning before we are forced to migrate over.

Thank you for the detailed description of your solution. We don't use Azure SSO, but I imagine we will have to do something rather involved like you are doing with our own SSO implementation.  (We also have external users who use e-mail/password login too. Luckily they are not requesters, so we've never had to autoprovision them.)

[RAshley]

The "giant group with the entire company in it" is our backup plan in case we can't get auto-provisioning to work. 

We really don't want to do this, as it would result in 20K+ people in every type-ahead user field, which makes them rather useless.