Halden Foods onboarding

Owner: Clara Rossi · Account: Ana Ruiz · Started: 26 October · Go-live: to agree at kickoff (we will propose the first sites in January)

Follows the Customer onboarding guide. What's special about Halden is below each step.

Status on Wed 28 Oct

Step	Status	Notes
1. Organisation and region	Done Tue 27 Oct	See below
2. Administrators	In progress	Two accounts invited; MFA required at first sign-in
3. Kickoff call	Booked Tue 3 Nov 10:00	Ingrid, Joost, Halden's IT lead; Ana, Clara, Tom
4. Sites (14)	Waiting on Halden	Site list template sent 28 Oct
5. People import (about 2,000)	Not started	After the sites
6. Site managers as approvers	Not started	One per site, from the site list
7. Single sign-on	Not started	Depends on ACM-293's date
8. Training and go-live	Not started

1. Organisation and region

Created on Tue 27 Oct at 14:10, a few hours after ACM-296 went out. The onboarding wizard now has a region step with nothing chosen, and Finish stays disabled until someone picks one. Clara picked the EU.

• Organisation settings shows Halden's administrators "Data kept in: EU (Frankfurt)", with backups and notices in the same region.
• Mira checked the organisation's region in the deployment settings the same afternoon.
• Any later change of region is written to the audit log with who did it and why. Nobody should ever need to.

2. Administrators

Halden asked for two administrators to start, both from IT. MFA is required for every administrator; once Halden signs in with Entra ID, their own MFA covers it.

4. Sites

Fourteen sites in Norway and the Netherlands. A site counts as a depot: it has a site manager who approves its people, and single sign-on is switched per site. We will use the Depot import file rather than create 14 sites by hand. Template sent to Joost to pass to IT.

5. People

Halden has no SCIM from us. Their HR system exports a spreadsheet; we import it with a dry run first (Preparing a people import file). Ask for Entra ID UPNs as the email column from the start, so nobody is refused at their first single sign-on, as nine people were at Kelderby.

7. Single sign-on

Entra ID, site by site with the single sign-on checklist. If ACM-293 has shipped by then, every tested site switches in one go, and people keep their passwords for 14 days after their site switches.

Things Halden will ask about

• The sign-in log: administrators read it in the portal; it keeps 90 days today. Twelve months for auditors is ACM-324, being shaped. Don't promise a date.
• Idle sign-out on shared PCs: not built. Don't promise a date.
• Where notices come from: our EU mail account. Halden's people may see the same sender name as before; only the account changed.
• Support access: a named few in support, from inside the EU, through a logged and approved request. See Support access to customer data.