Duplicate people after the first single sign-on when the imported email differs from the Entra ID UPN
Description
Kelderby's first single sign-on weekend (OPS-51): nine people (Rotterdam 5, Antwerp 3, Ghent 1) got "No account for this sign-in". The import had their private or old email; Entra ID sent their Kelderby UPN, so sign-in found no person to match. No account is ever made at sign-in, so Kelderby's IT made each of them a new account on Saturday (SUP-1260). That gave nine second records, with their roles and waiting requests left on the old ones. It will happen again at the next 22 depots.
Proposal
- At first sign-in, when the email doesn't match, match on the employee number: Kelderby's import has one for everyone, and Entra ID can send it as a claim.
- Before a depot switches, compare the import's emails with the Entra ID UPNs and list the mismatches.
Part of Kelderby go-live hardening in Emargen.
Linked issues
- relates to OPS-51 Kelderby: switch Rotterdam, Antwerp and Ghent to single sign-on, Saturday 04:30 Done
- relates to SUP-1264 Kelderby: duplicate people after the first single sign-on weekend Done
- relates to OPS-52 Kelderby: switch Duisburg, Venlo, Liège and Breda to single sign-on, Saturday 04:30 To Do
Comments (3)
Matching on Kelderby's employee number at first sign-in when the email doesn't match: in Kelderby go-live hardening; the email/UPN comparison is its first slice. This stays open for the account team.
Kelderby sent the UPN export for Duisburg, Venlo, Liège and Breda. Matching it against the import before Saturday.
All nine merged with Merge duplicate people by 11:30 (SUP-1264).