Higher Ed Enterprise Model: Identity and access management mapped to HERM v3.2.0Identity and access management functions (from the features offered by the major vendors), the HERM business capabilities they realise with their parent capabilities, and the Example State University sample applications (fictional) assigned to each function with coverage, role and feature count. Exported from hied-ea.netlify.app.IAM functions and featuresIdentity and access management: functions and features offered by the major vendors, mapped to HERM.This siteIAM 1.1 Connect authoritative sourcesIdentity Sources and Correlation. 10 features: SIS identity feed; HR identity feed; ERP and sponsored-person feed; Manual guest and sponsored identity entry; Scheduled and event-driven source sync; Source attribute mapping10This siteIAM 1.2 Match and correlate identitiesIdentity Sources and Correlation. 6 features: Rule-based identity matching; Fuzzy and weighted matching; Match review queue; Identity merge and unmerge; Account correlation to identity; Orphan and uncorrelated account detection6This siteIAM 1.3 Assign identifiers and credentials of recordIdentity Sources and Correlation. 5 features: Unique identifier issuance; Username and NetID generation; Email address assignment; Identifier reservation and non-reuse; Preferred and chosen name handling5This siteIAM 2.1 Maintain affiliationsAffiliations and Lifecycle Events. 6 features: Multiple concurrent affiliations; Primary affiliation calculation; Affiliation effective dating; Affiliation grace periods; Lifecycle state model; Identity history6This siteIAM 2.2 Process joiner, mover and leaver eventsAffiliations and Lifecycle Events. 7 features: Joiner event handling; Mover event handling; Leaver event handling; Rehire and re-enrollment handling; Immediate termination; Deceased and FERPA-hold handling7This siteIAM 3.1 Provision accountsProvisioning and Deprovisioning. 9 features: Directory account provisioning; Cloud application provisioning; Attribute-driven birthright access; Just-in-time provisioning; Attribute push and update; Provisioning approval hold9This siteIAM 3.2 Deprovision accountsProvisioning and Deprovisioning. 7 features: Account disable; Staged deprovisioning; Entitlement removal; Session and token revocation on leave; Data retention handoff; Alumni account conversion7This siteIAM 3.3 Control provisioning operationsProvisioning and Deprovisioning. 6 features: Provisioning preview; Provisioning retry and error queue; Provisioning safety thresholds; Target reconciliation; Password and secret provisioning; Provisioning dependency sequencing6This siteIAM 4.1 Federate applicationsSingle Sign-On and Federation. 9 features: SAML 2.0 identity provider; OpenID Connect and OAuth 2.0 provider; CAS and legacy protocol support; Application catalog of preintegrated apps; Attribute release policy; Consent for attribute release9This siteIAM 4.2 Participate in research and education federationsSingle Sign-On and Federation. 4 features: InCommon and eduGAIN metadata consumption; Federation entity category support; eduPerson and SCHAC attribute schema; External identity provider sign-in4This siteIAM 4.3 Manage sessionsSingle Sign-On and Federation. 4 features: Central session lifetime policy; Session revocation; Branded sign-in experience; Application launcher portal4This siteIAM 5.1 Manage passwordsCredentials and Multi-Factor Authentication. 4 features: Password policy; Breached password screening; Password synchronization; Account lockout and throttling4This siteIAM 5.2 Enroll and verify factorsCredentials and Multi-Factor Authentication. 9 features: Push notification factor; Number matching and verified push; One-time passcode factors; FIDO2 security keys and platform authenticators; Factor enrollment workflow; Factor policy by group and application9This siteIAM 5.3 Strengthen account recoveryCredentials and Multi-Factor Authentication. 3 features: Identity proofing at enrollment; Recovery factor policy; Help desk identity verification3This siteIAM 6.1 Evaluate sign-in riskAdaptive and Passwordless Authentication. 6 features: Contextual access policy; Risk-based step-up authentication; Impossible travel and anomaly detection; Known bad IP and anonymizer blocking; Continuous access evaluation; Identity threat signal sharing6This siteIAM 6.2 Establish device trustAdaptive and Passwordless Authentication. 4 features: Device posture check; Managed device detection; Device registry; Endpoint management integration4This siteIAM 6.3 Remove passwordsAdaptive and Passwordless Authentication. 4 features: Passkey sign-in; Passwordless push or biometric sign-in; Certificate-based authentication; Phishing-resistant MFA enforcement4This siteIAM 7.1 Maintain directoryGroups and Directory. 4 features: Central person directory; Directory privacy controls; LDAP directory service; Organizational hierarchy4This siteIAM 7.2 Manage groupsGroups and Directory. 7 features: Static groups; Rule-based dynamic groups; Course and section groups; Nested groups; Group ownership and self-managed groups; Group expiration and renewal7This siteIAM 8.1 Model rolesRoles and Access Policy. 8 features: Business roles; Entitlement catalog; Role assignment rules; Role mining; Role lifecycle and versioning; AI-recommended access8This siteIAM 8.2 Enforce access policyRoles and Access Policy. 5 features: Application assignment by group or role; Attribute-based access policy; Fine-grained authorization service; Separation-of-duties policies; SoD violation detection and mitigation5This siteIAM 9.1 Govern privileged accessPrivileged and Non-Human Access. 4 features: Separate administrator accounts; Just-in-time privileged elevation; Privileged role alerts; Privileged access management integration4This siteIAM 9.2 Govern non-human identitiesPrivileged and Non-Human Access. 4 features: Service account inventory; Application and API client registration; Secret and certificate expiry tracking; AI agent identity governance4This siteIAM 10.1 Request accessAccess Requests. 4 features: Access request catalog; Request on behalf of others; Request justification and end date; Request status tracking4This siteIAM 10.2 Approve accessAccess Requests. 6 features: Configurable approval workflow; Approval delegation and escalation; Policy check at request time; Approval from chat and email; Ticketing system fulfillment; Approval exception management6This siteIAM 11.1 Run certification campaignsAccess Certification. 8 features: Manager access reviews; Application owner reviews; Entitlement and role owner reviews; Privileged access reviews; Guest and sponsored access reviews; Campaign scheduling and scoping8This siteIAM 11.2 Support reviewer decisionsAccess Certification. 6 features: Reviewer decision context; Bulk approve and revoke; Automatic revocation of rejected access; Reviewer reminders and escalation; AI-assisted review recommendations; Certification evidence report6This siteIAM 12.1 Activate and recover accountsPerson Self-Service. 5 features: Account claiming and activation; Self-service password reset; Self-service account unlock; Self-service MFA device management; Self-service password change5This siteIAM 12.2 Manage profile and preferencesPerson Self-Service. 6 features: Profile view and update; Recovery contact management; Directory privacy preference; Sign-in activity view; Connected application consent review; Personal access and expiration view6This siteIAM 13.1 Support peopleDelegated Administration. 5 features: Help desk identity lookup; Assisted password and MFA reset; Scoped administrative roles; Sponsor portal for guests; Departmental account administration5This siteIAM 14.1 Capture eventsLogging and Audit. 6 features: Authentication event log; Administrative change log; Provisioning and lifecycle log; Access request and review log; Tamper-evident log retention; Cross-system transaction correlation6This siteIAM 14.2 Investigate and proveLogging and Audit. 5 features: Event search and filtering; Who-has-access reporting; Access history for a person; Compliance report templates; Identity data quality reports5This siteIAM 15.1 Detect threatsIdentity Security Monitoring. 5 features: Compromised account detection; Automated threat response; Identity posture assessment; Dormant account detection; Identity threat detection and response analytics5This siteIAM 16.1 Connect systemsIntegration. 7 features: Connector library; SCIM 2.0 client and server; Generic connectors; On-premises agent; Hybrid directory synchronization; RADIUS and VPN integration7This siteIAM 16.2 Extend and automateIntegration. 5 features: Management REST APIs; Event hooks and webhooks; Workflow automation designer; Log streaming to SIEM; Service desk integration5This siteIAM 17.1 Secure the serviceSecurity and Configuration. 7 features: Administrator MFA and least privilege; Encryption in transit and at rest; Signing key and certificate management; Data residency options; Security certifications; Accessibility of end-user pages7This siteIAM 17.2 Manage configurationSecurity and Configuration. 4 features: Separate test and production tenants; Configuration as code; Configuration change promotion; Localization4This siteIAM 18.1 Operate the serviceOperations and Exit. 6 features: High availability and published SLA; Outage fallback authentication; Health monitoring and alerts; Rate limits and capacity for peak periods; Licensing by population; Operational ownership and documentation6This siteIAM 18.2 Exit and portabilityOperations and Exit. 6 features: Full identity data export; Policy and configuration export; Log export at exit; Factor and credential migration support; Contractual data deletion; Coexistence and cutover support6This siteIdentity & Access ManagementIdentity & Access Management manages information about people and things, instantiates and enforces organisational business rules and policy regarding entitlements to systems and services, and mediates access requests and identity verification.BC139HERM BRM v3.2.0Data ManagementData Management plans, creates or acquires, stores, uses, archives, and disposes of data.BC143HERM BRM v3.2.0Information GovernanceInformation Governance defines the roles and responsibilities, decision rights and controls, and processes used to manage information assets.BC136HERM BRM v3.2.0Communications ManagementCommunications Management delivers and responds to broadcast and conversational communications.BC220HERM BRM v3.2.0Delivery, Service, & SupportDelivery, Service, & Support provides and supports an institution with the information and communication technology services it requires.BC204HERM BRM v3.2.0Records ManagementRecords Management provides the systematic control and governance of an institution's records and associated information.BC145HERM BRM v3.2.0Alumni ManagementAlumni Management enables and delivers ongoing services, continuing engagement, and relationship management to alumni.BC037HERM BRM v3.2.0Asset ManagementAsset Management undertakes the lifecycle management of physical assets.BC197HERM BRM v3.2.0Information Security ManagementInformation Security Management protects the confidentiality, integrity, and availability of information in an institution's care.BC138HERM BRM v3.2.0Build, Acquisition, & ImplementationBuild, Acquisition, & Implementation provides the basis for introducing and integrating new or changed technology solutions and services.BC203HERM BRM v3.2.0Organisational DesignOrganisational Design defines the structures, roles, and practices of an institution.BC172HERM BRM v3.2.0EnrolmentEnrolment manages the formal registration of students in curriculum components.BC021HERM BRM v3.2.0Advanced AnalyticsAdvanced Analytics produces insights and information assets using sophisticated analysis techniques on diverse data sets.BC144HERM BRM v3.2.0Compliance ManagementCompliance Management ensures an institution operates within the bounds of prescribed rules and obligations.BC170HERM BRM v3.2.0Customer Experience ManagementCustomer Experience Management is the practice of designing, tracking, and reacting to interactions between customers and an institution.BC217HERM BRM v3.2.0Business Continuity ManagementBusiness Continuity Management develops, tests, and maintains an institution's business continuity plans.BC161HERM BRM v3.2.0Contract ManagementContract Management manages the development, negotiation, execution, and review of institution contracts.BC156HERM BRM v3.2.0Identity registryMatches people from Banner, assigns NetIDs, tracks affiliations and drives joiner, mover and leaver events.HomegrownIn-houseTolerateExample State University (sample)IAMBanner StudentThe core student system: the system of record for the learner, curriculum, registration, academic history and the student ledger.Vendor coreEllucianMaintainExample State University (sample)SIS, Student app, Instr. planning, Advising, LMS, Library, Curriculum, Admissions CRM, Advancement, Housing, IAM, ConductBanner HR & PayrollPosition budgets and labor distribution feed the ledger from payroll.Vendor moduleEllucianMaintainExample State University (sample)Finance, HRM, Research admin, Instr. planning, IAMSpreadsheets & emailOffice-held spreadsheets, shared mailboxes and paper forms filling gaps between systems.ManualVarious officesRetireExample State University (sample)SIS, Finance, HRM, Research admin, Student app, Instr. planning, Advising, Reporting, LMS, Library, Curriculum, Admissions CRM, Advancement, Housing, IAM, ConductOktaSingle sign-on, multi-factor authentication and identity proofing.Third-partyOktaInvestExample State University (sample)SIS, Finance, HRM, Research admin, Student app, Instr. planning, Advising, Reporting, LMS, Library, Curriculum, Admissions CRM, Advancement, Housing, IAM, ConductMicrosoft Entra IDThe Microsoft 365 tenant: mailboxes, hybrid directory sync and admin role controls.Third-partyMicrosoftMaintainExample State University (sample)IAMActive DirectoryOn-premises directory, LDAP and admin accounts for Windows and legacy apps.Third-partyMicrosoftTolerateExample State University (sample)IAMServiceNowAccess request catalog, approvals, manual fulfillment tasks and help desk lookups.Third-partyServiceNowMaintainExample State University (sample)IAMApereo CASLegacy CAS sign-in for older campus applications, being moved to Okta.Third-partyApereo (open source)RetireExample State University (sample)IAMInCommon FederationResearch and education federation metadata for library and research services.Third-partyInternet2MaintainExample State University (sample)IAMCisco DuoMFA for VPN, servers and remote desktop, and backup factors.Third-partyCiscoMaintainExample State University (sample)IAMMicrosoft IntuneDevice registry and compliance signals used in sign-in policy.Vendor moduleMicrosoftInvestExample State University (sample)IAMInternet2 GrouperGroups, course and section groups and delegated group management.Third-partyInternet2MaintainExample State University (sample)IAMSailPoint Identity Security CloudFunded for access certifications, role modeling and separation-of-duties checks; not yet live.Third-partySailPointInvestExample State University (sample)IAMSplunkSecurity log store and search for sign-in and provisioning events.Third-partyCiscoMaintainExample State University (sample)IAMLegal AffairsLegal Affairs manages and advises an institution on legal matters.BC155HERM BRM v3.2.0Governance, Risk, & ComplianceGovernance, Risk, & Compliance performs governance, risk management, and compliance activities.BC160HERM BRM v3.2.0Business Capability ManagementBusiness Capability Management designs, configures, and lifecycle-manages an institution's business capabilities.BC206HERM BRM v3.2.0Information ManagementInformation Management describes, organises, distributes, and governs information.BC135HERM BRM v3.2.0Student EnrolmentStudent Enrolment enables students to enrol in curriculum components.BC019HERM BRM v3.2.0Human Resource ManagementHuman Resource Management encompasses strategic and operational activities related to the institution's workforce.BC171HERM BRM v3.2.0Information & Communication Technology ManagementInformation & Communication Technology Management plans, builds, and runs an institution's technology services and solutions.BC201HERM BRM v3.2.0Financial ManagementFinancial Management oversees, plans and controls all aspects of an institution's finances.BC184HERM BRM v3.2.0Advancement ManagementAdvancement Management develops investment and philanthropy in support of the institution's mission.BC232HERM BRM v3.2.0Engagement & Relationship ManagementEngagement & Relationship Management develops and sustains connections between an institution and its constituent individuals, stakeholders, and groups.BC238HERM BRM v3.2.0fullsystem of record10fullcontributes1fullcontributes1workaroundsystem of record1fullsystem of record5workaroundsystem of record3fullcontributes2fullsystem of record5fullcontributes1fullcontributes1fullsystem of record6fullsystem of record5fullsystem of record5workaroundsystem of record2fullsystem of record7fullcontributes1workaroundsystem of record1fullsystem of record2fullsystem of record1fullsystem of record5workaroundsystem of record2partialsystem of record1fullsystem of record6workaroundsystem of record1fullsystem of record8fullsystem of record1fullsystem of record4fullcontributes3partialsystem of record1fullsystem of record4fullsystem of record4fullcontributes1fullsystem of record8fullcontributes3workaroundsystem of record1workaroundsystem of record1partialsystem of record2partialsystem of record1fullsystem of record5partialsystem of record1fullsystem of record4fullsystem of record4partialsystem of record3partialsystem of record1fullsystem of record2fullsystem of record2partialsystem of record2fullcontributes1fullsystem of record7fullsystem of record6fullcontributes1partialsystem of record4workaroundsystem of record1plannedsystem of record3fullsystem of record2workaroundsystem of record3plannedcontributes2fullsystem of record1fullsystem of record3workaroundsystem of record1workaroundsystem of record3fullsystem of record1fullsystem of record4fullsystem of record5workaroundsystem of record2workaroundsystem of record7plannedsystem of record8workaroundsystem of record6plannedcontributes5fullsystem of record1fullsystem of record5partialsystem of record5partialsystem of record1fullsystem of record1partialsystem of record3partialsystem of record1partialsystem of record1fullsystem of record3fullsystem of record5partialsystem of record1partialsystem of record2workaroundsystem of record3partialcontributes1partialsystem of record1partialsystem of record4partialsystem of record3workaroundsystem of record1fullsystem of record4fullsystem of record1fullcontributes1fullsystem of record2fullsystem of record5fullcontributes1partialsystem of record1fullsystem of record7workaroundcontributes1fullsystem of record3workaroundsystem of record1fullsystem of record4partialsystem of record1workaroundsystem of record2partialsystem of record4workaroundsystem of record2HERM codeTypeVendorLifecycleEcosystemsCoverageRoleFeaturesSource