LEA Administrators

The ability to see the "My Students" tab in the Rapid Identity Portal under Profiles view, is based on whether the employee who logs into the IAM Service has one of the designated "Teacher Job Codes".  Job Codes are setup by the NCDPI and are assigned to an employee through their payroll system and stored in the UID system.  Below are the job codes (sometimes referred to as object codes), that allow an employee to see the My Students tab.  An employee with this tab would be able to use it to help reset passwords for any of their students that are assigned to them (typically as the primary teacher for a class) within PowerSchool.

Job Codes:

If you see "The request is invalid" message (shown below), it's likely because you either used the "back button" to try to get to the login page, or you "bookmarked" the Login Screen (where you enter your Username) which won't work. 

To get to the IAM Service (to access your applications or change/reset your password for example), go to my.ncedcloud.org.  Bookmark the page where you see your Applications. Then in the future, when you click on the bookmark you created for the Applications page, it will take you to the Logon page and then transfer you to NCEdCloud. If you try to go directly to the login screen by bookmarking it, the IAM Service won't know where to send you after you login (e.g. the RapidIdentity Portal, PowerSchool, etc.).  That's why you get an error.

Contract employees who are not in a PSU's payroll system (which is how most employees have records created or updated in the Staff UID System), can get an account in the NCEdCloud IAM Service by creating their records directly in the Staff UID System.  Information about the UID System can be found on the NCDPI Site.  The process for adding Non-PSU Employees to the UID System can be found under - Acquiring Staff IDs for Non‐Payroll Staff.

If Contract employees will need to access PowerSchool, they'll need to be added to your PowerSchool instance.  Make sure their UID number is in the StatePrid field in PowerSchool, as that field is matched when a user logs in using the NCEdCloud IAM Service.

No. As of July 2015 the NCEdCloud IAM Service was integrated with all Home Base applications and is no longer an Opt-In Service (you need to access Home Base / statewide applications through the NCEdCloud portal). The Single Sign-On (SSO) feature of the NCEdCloud IAM Service enables users to log into the portal one time, and then access any of the Home Base applications or any other applications/resources that have been integrated with the IAM Service for your PSU, without needing to login again.

Non- Home Base Target Applications will continue to be opt-in for PSUs, and if you wish to have these integrated with the NCEdCloud for your PSU you can find out what's available on the Target Applications page.

There are three main criteria for challenge questions:  

• 5 of the 10 questions listed must be answered

• The answers must be 3 or more characters

• Answers can not be repeated among questions

In addition, the answers are not case-sensitive.

If a question is not answered it will be ignored in the password recovery process. For example, if you initially answer only 5 of the questions then you will be challenged with 2 of those 5 question. If you initially answer 6 questions then you will be challenged with 2 of those 6. You will never be asked a question that you did not answer during setup.

Frequently, employees that transfer from another PSU are not updated in their former payroll system (and consequently in the Staff UID system), in a timely manner.  If you find the profile of one of your users still lists their former PSU, you will need to contact them (usually payroll, but a peer may be able to work with you) and have them update their data (to "inactive" for the former PSU).

Contacts for PSUs can be found in the NC EDDIE system on the NCDPI website at:       https://www.dpi.nc.gov/districts-schools/district-operations/financial-and-business-services/eddie

Steps to be taken:

• The employee's payroll record at the former PSU needs to be marked "Inactive".
• The record needs to be uploaded to the Staff UID System, which will mark the UID record at the former district as "Inactive".
• The following business day the old data will no longer be pulled into the IAM Service and "old" information should disappear from the user's IAM Service Profile.

If you have trouble getting the issue resolved directly, you may submit a ticket with Identity Automation (see Escalating Support on the LEA Administrators page), and they will work with NC DPI to get things resolved.

The default username for both staff and students is the numeric (up to 10 digits) state UID.  However, we have also implemented an enhancement to allow PSUs to opt-in to using an "Alias ID". This can be the user's email address (staff and/or students), or if the PSU provides a nightly file upload, a "local ID", usually the local username used in Active Directory or another directory.

LEA Administrators interested in using an Alias ID to login should check out the Alias ID page under Opt-In Features. (It's also linked above).

Users (both staff and students) can login to the NCEdCloud IAM Service without an email address in their account data, however, there may be drawbacks.

1. Some internal messaging (in the IAM Service) requires an email to operate - e.g. forgot my password

2. Some Target Applications expect to receive an email address when users login.  If it's not present in the source data (e.g. PowerSchool, LINQ HR, HRMS), and therefore not updated in the IAM Service, then the user won't be able to login to the application or some functionality may be limited.

3. If a PSU wants to opt-in to Alias ID (and use an email address rather than the numeric UID to login), any user without an email address in the IAM Service wouldn't be able to take advantage of that feature.

Users are not able to edit their profiles to add/change their email address in the IAM Service. Email address is populated from the nightly source data. Email address for students always comes from their Student System record.  Employee email address is prioritized in the following order: PowerSchool records, LINQ HR, and lastly HRMS.  The nightly data feed uses the first email address it finds for an employee in that specific order.  If a teacher has an email address in PowerSchool AND in HRMS, only the address in PowerSchool will be captured and sent in the nightly updates to NCEdCloud.

It is recommend that PSUs populate email addresses for all their users, as some target applications require the email address for user accounts.  Without having email associated with the provisioned/rostered user account, functionality of those target applications could be significantly impacted.

Unfortunately, we have been having intermittent issues with employee emails not populating NCEdCloud accounts for several years now. While we have been able to repair and improve certain parts of this process, it still is not functioning reliably.

Employee emails entered in the NC SIS (PowerSchool) will populate into NCEdCloud correctly. There are rarely any issues with this process.

Employee emails entered in LINQ or HRMS will not reliably populate NCEdCloud accounts. This data may or may not be populated in its entirety across a PSU, and it may or may not be consistent each day.

Lastly, If the PSU opts in to using Alias ID with email addresses, those users without an email address will only be able to use their UID as their Username when logging into the NCEdCloud IAM Service.

Employee email address is obtained by searching data files from 2 or 3 source systems, in a specific/priority order. The process starts by checking PowerSchool, then LINQ HR (if used by the LEA), and lastly HRMS. The process stops the first time it finds an email populated for the user.  If HR updates HRMS and the employee has a new record added to the PSU's PowerSchool instance, there may be a mismatch between the two - however, the email in PowerSchool is the one that will appear in the NCEdCloud data.

In addition, a CRITICAL requirement for passing an employee's email address to the IAM Service is that the user's "school identifier" in the source data (3-digits identifying the school, or 6-digits with the LEA code + the school code), must match the "schoolID" in the UID system.  In PowerSchool this is the "homeschool" field, in LINQ HR it is the LINQ schoolID, and in HRMS it is the HRMS schoolID field.  In each scenario, the school identifier found in PowerSchool, LINQ HR, or HRMS, MUST match the schoolID in the user's active UID record.  If the user is listed in PowerSchool with an email address and the correct homeschool code (e.g. 123), but is listed in UID with the System Office code (000), then the records won't match and the email for that user will NOT be populated in the IAM Service.  This would be a reason why an employee is missing email in the NCEdCloud IAM Service.

When troubleshooting why a staff member's email is not populated in the NCEdCloud IAM Service, make sure to confirm that the school code is carried in the fields mentioned above and has the SAME value as the schoolID in the UID system.

The Manage LEA Employees tab or the Manage LEA Students tab (on the left) under the People View in the IAM Service relies on a "Search" function. You need to enter some criteria to select the users you want to lookup. The easiest search is to enter an asterisk * wildcard in the search window and click the Search button. This will only return the first 1000 matching records, however, which is the limit of any query.  You can also look for all users beginning with the letter P by entering P + asterisk (P*) in the search window, and clicking Search.

To apply filter(s) your search, click on the box for Advanced Search Mode and then "Open LDAP Builder", and enter more specific criteria there. Start with the first filter, then click on the operator (e.g. =), and lastly enter the value or combination of letters and wildcards (e.g. ms*@* ). Click the mouse in an area "outside" of the filter box, and click on Update at the bottom. When you return to the list view, the filter string should show in the search box (with the magnifying glass symbol).  Click on the magnifying glass to execute the search and you should see a list of users that match your search string. 

When searching on Last Name it is always helpful to enter a trailing asterisk * wildcard to make sure you retrieve users whose last name may be followed by a generational qualifier such as Jr., III, etc.

There are two general cases in which you may want to query your user data. The first is to obtain answers to questions about your data. The second is to perform actions on the results of a data query. An example is resetting students' passwords to their IAM "default passwords".

The Tech Director/CTO for a PSU should be the first person to claim their account (e.g. for new Charter Schools) and request the LEA Administrator Role.  

The first request from a PSU for the LEA Administrator role will be vetted by NCDPI support staff prior to granting the role.  Once granted, an LEA Administrator may approve future Requests, as well as have access to administrative functions in the IAM Service for their PSU's employees and students.  They will also be granted access to the LEA Administrator website where more protected content is available.

Other employees who request a privileged role will cause an email to be sent to all LEA Administrators for their PSU, notifying them that a request is waiting for their approval.  An LEA Administrator (the first one to act on the approval), can then go to Requests and check under Tasks -> Approvals for any outstanding requests and either Approve or Deny the request.

If your PSU has employees who were using accounts in the IAM Service, but the accounts are no longer there, the first place to check is typically the payroll system (Charter Schools may need to check with your management company). This occasionally happens with 10 and 11 month employees when their work/job Start Dates are not present or not in the upcoming school year in the payroll system.

The payroll system is the authoritative data source for the Staff UID system, and identifies which staff members to make active in your PSU.  Active user accounts in the Staff UID system have their data sent to the IAM Service nightly (as an active record). Click here to view the IAM Service source data workflow, to see how staff and student data makes its way into the IAM Service.

If your payroll system does not show employees as “active” at the time the CEDARS UID extract is sent to the Staff UID system, they will be marked inactive in the Staff UID system. Inactive UID staff data is not sent to the NCEdCloud IAM Service in the nightly updates, and if a user record does not show up, their existing IAM Service account will be marked as inactive and disabled.  At that point, it will not be visible in the NCEdCloud IAM Service and the user will not be able to login. The account is still there, but until the user record is marked as Active in the UID system and picked up in the nightly feed from DPI, the account will remain “missing”.

For LINQ customers, if your current payroll practice is to end jobs for your 10, 10.5, or 11 month staff, you must either create them a new job with a future start date or update their existing job record with a new Start and End date in order to keep them active within the IAM Service. Any employee that has no Active or Future job start date within payroll, will be sent as Inactive in the CEDARS UID Export.

Web browser tabs or windows (in Chrome, Edge, Safari, Firefox, etc.) opened in “private” or “incognito” mode, will prevent session information from being shared between other tabs/windows. As a result there is no "memory" of logins done within other tabs, therefore, accessing NCEdCloud IAM applications in a new private tab or window would require another login. 

Private or Incognito mode should be disabled when using your browser for NCEdCloud Target Applications (e.g. PowerSchool, Amplify, Destiny, etc), to take advantage of Single Sign-0n.

If your PSU has purchased ADDITIONAL Amplify coverage for students in grades 5-6, you can Submit the Amplify Request Form to add the icon to your PSU for Grades 5 and/or 6.  Once enabled, the icon will be presented to ALL students in the grades selected, as we cannot currently manage school-level icons for the entire state.  Note: This form must be filled out and submitted by a PSU staff member with the "LEA Administrator role" in the NCEdCloud.

LEA Administrators and Data Managers in the PSUs have asked: "Which PowerSchool field is matched against the NCEdCloud Username (State UID for employees or students) when a user logs into PowerSchool?" 

The UID number is the unique identifier for NCEdCloud IAM Service accounts, and it is stored within PowerSchool as follows:

• employees => SIF_StatePrid
• student => State_studentnumber

*Please note that on some screens, SIF_StatePrid may show up as StatePrId (it is the same thing), so 

for employees:  SIF_StatePrid <=> StatePrID <=> UID

*Also note, if you see Student_number on the screen, it is the same number as the state_studentnumber, so 

for students: Student_number <=> state_studentnumber <=> UID

Using the Request process, employees are able to request the LEA Administrator, LEA Data Auditor, LEA Help Desk, LEA Student Help Desk, School Help Desk, or School Student Help Desk roles. Employees needing one of these roles should choose the Request view from the dropdown at the top of the page (where "Applications" is usually displayed), and request the appropriate role.

The LEA Administrator for the PSU determines whether of not to Grant or Deny the request, and may follow up with the employee to determine their need.

Note: Anyone with the LEA Administrator role automatically has all the privileges that an LEA Data Auditor, LEA Help Desk and LEA Student Help Desk, etc., therefore, it is not necessary for an LEA Administrator to also have other roles.

More information on Privileged Roles can be found on the Privileged Roles page on ncedcloud.mcnc.org (also under the Resources dropdown).

Any user, including new teachers, must have a UID in order to appear in the IAM Service. UIDs are obtained through the UID process.  Please see the summary and detailed explanations below...

UID Summary: 

As soon as an employee is hired with a future start date, they are eligible to receive a UID and subsequently receive access to systems for professional development and other tasks.Some payroll systems (e.g. LINQ) have taken this into consideration and include new hires with a future start date in the UID export for the current fiscal year. However, if your payroll system does not include new employees with a future start date in the UID export file, we recommend that you reach out to your vendor and request that they address this issue as soon as possible. In the meantime, you can add these new employees to the Staff UID system manually using the “Add Staff” feature available to authorized users.

The “Add Staff” feature in the Staff UID System provides a staff member with a UID, makes them active at the correct location(s), and provisions the new staff member’s account to applicable downstream systems (NCEdCloud, PowerSchool, etc.), outside of the payroll file export process. Documentation for the steps to add a staff member to the Staff UID System using this feature can be found at https://www.dpi.nc.gov/data-reports/common-education-data-analysis-and-reporting-system-cedars/staff-uid-system#training-materials. 

Once their start date occurs, they will be included in the UID export file and uploaded to the Staff UID System. Because they are already in the system, the employee record in the UID export will be identified as an exact match.

• Source Data Requirements

• UID Support & Training

• Charter Schools should also look here: Charter School Information

• Individual applications have their own timeouts - they're application dependent

• The NCEdCloud IAM Service RapidIdentity Portal:

  • Login Screen inactivity timeout (you go to the login screen but don't login) = 5 minutes

    • If timed-out there, close the unused login window/tab, open a new window/tab and start over (DON'T use the Back arrow/button)

  • Once in the NCEdCloud portal, the inactivity timeout = 8 Hours

• The SAML assertion timeout is valid for 5 minutes (the assertion itself)

  • Individual Applications can have a different timeout for their session(s).  If it is > 5 minutes and that timeout occurs, they will check the SAML assertion and then handle it however they're configured.

• In general, it is best that users completely close their browser sessions (Chrome, Safari, Firefox, etc.) when they are done

  • One example is Google Apps. If Google Apps is integrated with the IAM Service and a user logs in, they stay logged in until they close the browser, which could be days or weeks.

For primary student accounts (grades PK-5), PSUs will always need to directly distribute the student account usernames (student number or Alias ID) and passwords - either default passwords or reset/changed passwords (see the Teachers page). There is no claim account process (or challenge questions) for primary students.  PSUs also have the option to use NCEdCloud Badges (QR Codes) or pictographs for primary students.

For secondary student accounts (grade 6 and higher),  PSUs may optionally choose to have those students claim their own accounts, or may directly distribute the student usernames and default passwords the same as primary students.  To claim their  account, a secondary student will need their pupil number, grade, birthday in YYYYMMDD format, and PSU (LEA) code.  To complete the account claiming process (or at the first login if usernames and passwords are provided to the students), a secondary student will need to answer at least 5 challenge response questions. (See: Student Account Claiming ).  Note: Student Badges and pictographs are not an option for secondary students.

* Also note that RapidIdentity Portal "operations" (e.g. change passwords), cannot be performed on a mix of Primary and Secondary students, as different password policies apply to each set of accounts.

Data processing at DPI extracts user data provided to the NCEdCloud IAM service beginning after normal school hours (usually 5:00 PM or later) Monday through Friday, and on Sunday evening, to pick up any changes entered over the weekend. Processing continues into the early morning on Monday through Saturday. If a user record in one of the source systems (PowerSchool, LINQ HR, one of the Payroll systems, etc.), is updated prior to that source system's evening cutoff time, then the data is provided to the IAM service the following morning. (Note that as not DPI processing occurs Saturday evening, updates are typically NOT provided to the IAM service on Sunday mornings).

For details on the source systems and cutoff times for various employee and student fields and SchoolNet roles please see:

NCEdCloud IAM Service Sources and Timing for Employee Data Fields

We understand that some PSUs may have concerns about teachers being able to set their students' passwords, however, due to the fact that the IAM Service is a solution for the entire state, it was not feasible to make the feature an option for those PSUs that wanted to implement it. However, please keep in mind that ALL password changes are audited within the service, so a record of any password transaction is captured along with who made the change.

The easiest way to search for accounts that have a missing or invalid email address is to: 

• Select the Manage LEA Employees or Manage LEA Students tab (under People)
• Check the Advanced Search box and "Open LDAP Builder" box
• Select "email" for the field, !* for the operator (does not equal), and enter *@*.* for the value

Then make sure to click "outside" of the filter box and check that the search string shows up at the top. Click on the Update button at the bottom, and when you're back at the search window, click on the magnifying glass at the end of the search box (the "search" symbol).

The equation: email  !=  *@*.*  translates as email NOT EQUAL to wildcard@wildcard.wildcard (where "wildcard" represented by an asterisk, can be ANY value)

This search will turn up all users with invalid email addresses, such as those missing: the principal name, the @, or the school domain (e.g. emailname@lea.nc.gov), or user accounts with NO EMAIL address.

You can also enter other filter values to narrow down your search, such as Campus Code = xxxxxx, or Last Name = Gre*

Privileged Roles (e.g. LEA Administrator, LEA Data Auditor, LEA Help Desk, LEA Student Help Desk, School Help Desk, and/or School Student Help Desk) can be revoked in either of two ways:

1. The user with the elevated privilege can self-revoke a role by using the same workflow process they used to originally request the role.

For example, after logging into the IAM Service:

• Click Requests (from the Applications drop down)
• My Entitlements (along the left side)
• Uncheck the role to be revoked
• Click the Request button at the bottom of the screen

The privileged role would be revoked immediately.

2. LEA Administrators at the PSU may request role removal by opening a Sales Force ticket with Identity Automation by: 

• Clicking on the Support Community for Identity Automation icon in Applications
• Going to the Customer Support Community: https://identityautomation.force.com/support/s or 
• By sending Email: support@identityautomation.com

NOTE:  While an LEA Administrator doesn't have the ability to *directly* remove another employee's elevated privileges, an LEA Administrator *does* have the ability to immediately disable an account if needed.  That process is described in the Training Videos (see the Applications tab -> Training ->  LEA Administrator Training -> "How do I disable someone's account?")

This process is NOT needed if an employee (or secondary student) has been using their account and simply transfers to another PSU.  They just log into their account as usual and if their records have been updated, they'll see applications for the new PSU.

If, however, a "new" user has trouble claiming their account (or doesn't remember their challenge questions and password), the account can be reset by following the steps below.

The complete process for restoring an account to unclaimed status is:

• Under "People" > Manage LEA Employees (or Students), enter the user's UID number and hit Return to retrieve the account
• Hover over the end of the record shown (or click the checkbox), and click on Details
• Click on "Edit Profile"
• Uncheck the "Disable Account Claiming" box
• "Save" the changes
• Click on the box at the left, to select the user record
• At the bottom of the page click on "Reset Challenge Responses" and confirm with "Yes"

The account should now be ready to "Claim".  Note: the user sets the password during the claim process, so there's no need to change or reset the password.  They will need your PSU's 3-digit LEA Code, their UID (which you can provide), and their birthdate.

This entire process must be followed to assure a complete reset to unclaimed status.

Changing Student Passwords

If a teacher needs to change a student's password, they will follow the same steps as above and then click on the "Change Password" button at the bottom of the screen.

In the Change Password box you will enter the New Password and then in the box below it, verify the new password. At this point you can either click Save and tell them the password to use going forward, or if you want to require that they change their password to something only they know, check the box for "User must change password at next login".  This will force them to enter a new password once they login. Then click on Save and note any confirmation messages.

LEA Administrators have the ability to regenerate the DEFAULT passwords for their students:

• for the entire PSU
• by School (Campus Code), or
• by Grade
  • for the entire PSU or
  • within a single School

See Regeneration of Student Default Passwords.

The workflow Request that changes the Default Password also has the ability to Optionally change the students' login password to the new value, and also force students to change their passwords when they first log in.