Email Identity
Standard Proposal
Identity and Access Management
Subcommittee
December 12, 2013
Situation
• The @UCSF Exchange service provides email to
30,500 users across the UCSF enterprise
• Many separate email systems have been
consolidated into @UCSF, including the Medical
Center and School of Medicine
• @UCSF Exchange currently receives email for
140 distinct domains
• Some units adopted ‘@ucsf.edu’ primary
address when consolidated, but accounts are
still being provisioned for 73 email domains
• Rules for assigning a new individual to
appropriate domain are manually implemented
2
Consequences of Current Situation
• Delay in creation of new accounts
• Barrier to implementing automated processes
• Movement of individuals between units results
in additional email addresses (and confusion)
• Rollout of new services and integration with
cloud service providers become more
complicated and are often delayed
3
Target
• A uniform primary @ucsf.edu address for all
members of the UCSF community
• Continuous delivery of email sent to all
historical addresses in perpetuity
• Benefits
– Simpler experience for UCSF community
– Department or organization move does not affect
email address
– Simpler account provisioning logic, leading to faster
turnaround and opportunities for automation
– Single email namespace is aligned with most cloud
service integration requirements
4
Proposal
• New individuals joining the UCSF community
will receive a first.last@ucsf.edu primary
address
• The ‘mail enable’ web page used during account
provisioning will have alternate domain choices
removed
• Existing UCSF individuals using a primary
address not matching the new standard will
have:
– proxyAddress populated with their current address
– Primary address reset to first.last@ucsf.edu format
– UCSF Listserv memberships automatically updated
with new address
– Authoritative directory listings (CLS, SIS, E*Value)
automatically updated
5
User Impact
• Email sent to prior address and new address
will be delivered to single mail box – No Impact
• Loss of identity and ‘branding’ associated with
domain suffixes on outgoing mail – Impact
Variable
• Ability to send to external Listservs that restrict
input to validated addresses will be interrupted
until Listserv account is updated with new
address – Impact Moderate
• Business cards and other collateral with prior
address may need updating – Impact Low to
Moderate
6
User Impact
• Custom inbox rules built manually from email
addresses rather than the global address list
will need updating – Impact Low
• External correspondents may notice multiple
entries in their address book for UCSF staff –
Impact Low
• Users may forget that registrations on external
websites used their previous address – Impact
Variable
• Business processes that query AD for users
matching @department.ucsf.edu (sub-optimal
choice, but may exist) will no longer work –
Impact Unknown
7
Alternate Email Servers
• There is no requirement that members of the
UCSF community use the enterprise Exchange
server
• Small number of units continue to operate
independent email servers
• Options for provisioning / cloud integration for
this population
– Create first.last@ucsf.edu even when account is
provisioned for individual joining unit not on
Exchange
– The Exchange account might not be used, but
existence will facilitate integrations that need an
@ucsf.edu address
– Inform account owner that their @ucsf.edu address is
used for authenticating to these services
8
Alternate Email Domain Statistics
Domain
Accounts
ucsfmedicalcenter.org
9381
anesthesia.ucsf.edu
529
peds.ucsf.edu
481
obgyn.ucsf.edu
447
medsfgh.ucsf.edu
416
medicine.ucsf.edu
388
orthosurg.ucsf.edu
282
.
.
.
.
.
.
ccrc.ucsf.edu
1
chanoff.ucsf.edu
1
ebinet.ucsf.edu
1
clinlab.ucsfmedctr.org
1
uap.ucsf.edu
1
9
Visual Impact of Email Domain –
Outlook Web Access (OWA) on Mac
10
Visual Impact of Email Domain –
OWA on Windows
11
Visual Impact of Email Domain –
Outlook on Windows
12
Visual Impact of Email Domain – IOS
13
Integration Project Examples
• UCSF Box
– Box expected a single primary domain
– Two UCSF staff members spent significant portion of
month to resolve complication
– Initial Implementation Delayed
• Cisco Unified Communications
– Uniform Resource Identified (URI) must be
constructed for each individual
– Primary email address can’t be used, because UC
implementation overly complex if many domains
supported
– Ad hoc heuristics in development to pick ‘correct’
@ucsf.edu address from among multiple candidates
in proxyAddress field
14
UCSF Box Integration
15
Recommendation
• Request approval via IT Governance Process
• Define process for obtaining necessary
community input
• Identify resources and schedule for the
implementation of proposal
16