Identity and Access Management

MNIT provides and supports Minnesota’s Enterprise Identity and Access Management (MNEIAM) application. MNEIAM is used every day by Minnesota residents to provide appropriate and secure access to state systems and data. This allows a single sign-on access where it is warranted, while helping to protect sensitive data and prevent unauthorized access.

MNEIAM is used by agencies specifically to provision, secure, and authenticate identities, and authorize access to resources and/or performance of actions for members of the public and partners, not for state employees. Identity and Access Management (IAM) activities related to state employees is embedded in the state services and systems where it occurs.

Service Offerings

MN Enterprise Identity and Access Management (MNEIAM)

There are two types of MNEIAM packages described in the table below. Agencies should select the appropriate MNEIAM package for with each application based on the identity and access management requirements of that application.

Comparison table

MNEIAM Basic Package

(Suitable for applications that require at least 2-4 of the features below)

MNEIAM Advanced Package

(Suitable for applications that require all of the features below)

Authentication
Multi Factor Authentication
Risk based authentication and threat detection
User management
Self Service (Access Changes, Password reset)
Role Based Provisioning
Support for application owner
Federated Authentication
Single Sign On
Authorization (Coarse and fine grained)
Social Login
Initial Identity Proofing (Integration capability) upon account creation
Reporting Capabilities
Automated Access Request, Approval
High Availability
Disaster Recovery
Testing: Test application changes twice per year (additional cost/test afterwards)

Authentication
Multi Factor authentication
Risk based authentication and threat detection
User management
Self Service (Access Changes, Password reset)
Role Based Provisioning
Support for Application Owner
Federated Authentication
Single Sign On
Authorization (Coarse and fine grained)
Social Login
Initial Identity Proofing (Integration capability) upon account creation (based on application needs, additional identity proofing services can be provided for additional cost)
Enhanced Reporting Capabilities (IE: On Demand)
Automated Access Request, Approval
Custom Reporting (Risk, SOD violations)
Advanced Identity Analytics
Role mining and modeling
High Availability
Disaster Recovery
Testing: Quarterly Testing (additional cost/test afterwards)

Both MNEIAM Packages (Basic and Advanced) include the following:

MNEIAM Platform Hardware, Software and Support

Provide a SaaS (cloud-based) IAM solution
- Cloud solution comprised of SailPoint (SP), Non-Employee Risk Management (NERM), Identity Now (IDN), Azure B2C and Azure B2B (Business to Commercial and Business to Business respectively)
Provides MNEIAM configured to provide high availability/uptime and support multiple agency integration.
Monitor MNEIAM infrastructure environment for availability and performance issues.
Coordinate and support connectivity to storage.
Provide sample code for integrations used by agency applications staff.
Proactively communicate with agencies advising of vender maintenance and update schedules on IAM SharePoint portal.
Troubleshoot and resolve MNEIAM system issues, including coordinating with the MNEIAM vendors as needed.

Agency/User Support

Provide MNEIAM orientation/training to agency security staff.
Tier 2 and Tier 3 support for agency application staff. Agencies are responsible for providing Tier 1 user support (e.g., unlocking accounts, creating accounts, assisting with password resets, resetting disabled accounts, etc.).
Provide job aids and troubleshooting documentation to assist agencies in providing Tier 1 user support.

Setup and Integration

Configure Authentication.
LDAP and Active Directory connectors.
Delegated administration (for all platforms).
Library of connectors out-of-the-box and configurable.
Identity repository for partners and residents.
API based repository access.
Data migration and integration.
- Integration for complex situations that go beyond the capability/capacity of the MNIT team may be charged based on hourly professional services rates.

MNEIAM Professional Services

Details

Service Level Objectives
Service Notes
- The IAM Service does not include:
  - Website creation
  - Website data beyond authentication.
- Application must be capable of SCIM/REST calls for provisioning and de-provisioning.
- Agency staff may enter requests into the Feature Enhancement Request (in IAM SharePoint) Portal to communicate needs for additional future IAM functionality.
Customer Responsibilities
- Follow MNIT policies and standards for securing their applications.
- Implement the latest IAM industry standards within the agency’s application.
- Completion of application onboarding questionnaire to describe requirements.
- Any changes in integration implementation required for better performance or improved user experience including any required code modification.
- Provide Tier 1 IAM user support.