Hello,
QUESTIONS
The tenancy admin users and the general users provisioned from the client’s Entra ID
currently reside in the default domain. The general users are being provisioned to the Fusion instance.
To manage user privileges appropriately, we plan to move the general users
from the default domain to another domain, while keeping the tenancy admin users in the default domain.
1. How can this be implemented without impacting user privileges in Fusion?
2. Are there any best practices for this approach?
There is a concern that existing users in Fusion might be removed during this process.
Will this happen? If so, how can we mitigate or prevent it?
BACKGROUND
To implement SSO login (via Entra ID) in the Fusion environment,
we have completed the integration of Entra ID with Fusion.
As a result, user provisioning currently works as follows:
1. Users are provisioned from Entra ID to the default domain in OCI.
2. Users are then provisioned from the default OCI domain to the Fusion environment.
WHAT TO BE DONE
We now need to change the OCI domain where users from Entra ID are stored,
from the default domain to another domain (Domain A).
Could you please advise on the steps required to achieve this?
The steps I have assumed are:
1. Remove the configuration for provisioning users from the default OCI domain to the Fusion environment.
2. Remove the configuration for provisioning users from Entra ID to the default OCI domain.
3. Configure provisioning from Domain A in OCI to the Fusion environment.
4. Configure provisioning from Entra ID to Domain A in OCI.
5. Request the client to update the mapping between Entra ID and OCI from [Entra ID → Default Domain] to [Entra ID → Domain A].
Thank you in advance,
Best regards,
Mu