Agenda Item
b. Approval of Identity Automation RapidIdentity Lifecycle Management Renewal and Expansion (Not to Exceed $401,435) ~ Updated 5.8.2026
Summary: Presented by: Dr. Kermit Belcher, Chief Information Officer, Division of Information and Instructional Technology
Request: It is requested that the DeKalb County Board of Education approve the renewal and continued implementation of the RapidIdentity Lifecycle Management solution with Identity Automation, including core subscription services and Phase 2 and Phase 3 expansion services, for an amount not to exceed $401,435.
Why: The purpose of this agenda item is to support the Division of Information and Instructional Technology (DIIT) in maintaining and expanding a secure, scalable identity and access management platform that supports districtwide operations. RapidIdentity serves as the district’s enterprise solution for identity lifecycle management, enabling automated provisioning, access control, and system integration across critical instructional and business systems.
The current identity provisioning process previously relied on custom, staff-developed scripts, creating risks related to continuity, scalability, and security. The implementation of RapidIdentity has established a centralized, automated approach to identity management. Renewal of the core platform ensures continuity of these services, while Phases 2 and 3 expand functionality to further enhance automation, strengthen cybersecurity, and improve system integrations.
Details: Identity Automation’s RapidIdentity Lifecycle Management solution provides an automated, centralized approach to managing user identities throughout their lifecycle. The renewal maintains existing identity management services, while Phase 2 and Phase 3 introduce additional integrations, workflow automation, and enhanced authentication capabilities aligned with district operational and instructional needs.
The proposed renewal and expansion scope have been reviewed and validated through Statements of Work, supporting quotes, and stakeholder communications. All services, hours, and deliverables are aligned with documented expectations and support continued modernization of identity and access management across the district.
Key Services Provided:
Core Renewal - Identity Lifecycle Management Platform $227,225
The core renewal maintains districtwide identity lifecycle management through automated account provisioning and role-based access, with continued integration across systems such as MUNIS, Active Directory, Google, and Microsoft 365, while providing secure authentication, vendor support, and ongoing platform maintenance.
Phase 2 - Platform Expansion $58,000
Phase 2 expands RapidIdentity by establishing MUNIS as the authoritative source for staff data, integrating Incident IQ for workflow automation, and implementing nine (9) automated lifecycle workflows for onboarding, role changes, and offboarding. It also introduces a provisioning pipeline connecting Frontline, RapidIdentity, and Canvas, while enhancing automated provisioning and deprovisioning across district systems to reduce manual effort and improve accuracy.
Phase 3 - Authentication & Student Domain Enablement $116,210
Phase 3 enhances student identity services by implementing advanced authentication capabilities, including passwordless pictograph authentication, while enabling student domain provisioning across Active Directory, Google, and Microsoft 365. This phase also establishes Microsoft 365 federation with RapidIdentity to streamline access and authentication, ensuring alignment with district security standards and age-appropriate access controls.
Financial impact: General 100.1000.553200.00011.7600.9990.0308.070.0000
Contact: Dr. Kermit Belcher, Chief Information Officer, Division of Information and Instructional Technology, 678.676.1274
Effective: Upon Board Approval
Status: Pending Approval by the Office of Legal Affairs
RapidIdentity – Phase 3 Project Scope | DeKalb County School District
Phase 3 Project Scope
RapidIdentity Platform Expansion
Prepared for: DeKalb County School District
1. Scope Summary
Following successful Phase 1 and Phase 2 implementations of RapidIdentity, DeKalb County
School District would like to continue expanding the platform. Phase 3 is organized around
three primary initiatives:
● Authentication Enablement — Creation and configuration of desired authentication
policies for Staff and Students, including a passwordless pictograph authentication
experience for Students.
● Provisioning Updates — RapidIdentity provisioning will be updated so that Students use
a dedicated email domain (e.g., stu.dekalbschools.org), with corresponding updates
across Active Directory, Google, and Microsoft 365.
● Microsoft 365 Student Domain Federation — Configuration of the new student domain in
M365 and federation with RapidIdentity to support the new authentication policy.
2. Scope of Work
2.1 Authentication Enablement
Identity Automation will assist DeKalb County School District with the creation and
configuration of desired RapidIdentity authentication policies for both Staff and Students.
Authentication policies define how users verify their identity when accessing systems through
RapidIdentity.
Key activities include:
● Review and documentation of current authentication requirements for Staff and
Students.
● Design and configuration of authentication policies within RapidIdentity to meet
documented requirements.
● Configuration of pictograph authentication for Students, enabling a passwordless login
experience within RapidIdentity.
● Testing and validation of authentication policies for both user populations prior to
production rollout.
2.2 Provisioning Updates
RapidIdentity provisioning will be updated to assign Students a dedicated email domain,
separate from the Staff domain. For example: stu.dekalbschools.org. This separation enables
distinct authentication policies and routing between user types.
Updates will be applied across the following target systems:
Confidential
RapidIdentity – Phase 3 Project Scope | DeKalb County School District
● Active Directory
○ Update mail attribute to new student domain.
○ Update userPrincipalName (UPN) to new student domain.
● Google
○ Update primaryEmail to new student domain.
● Microsoft 365
○ Update mail attribute to new student domain.
○ Update userPrincipalName (UPN) to new student domain.
2.3 Microsoft 365 Student Domain Federation
To take advantage of the RapidIdentity authentication policy for Students, the new student
domain must be registered and configured in Microsoft 365 and then federated with
RapidIdentity.
Key activities include:
● DeKalb County School District will add and verify the new student domain in the
Microsoft 365 admin center (customer responsibility).
● Students will be migrated to the new domain by updating their UPN in Active Directory
and Microsoft 365.
● Identity Automation will provide consultation on PowerShell commands to federate the
new domain with RapidIdentity following domain verification and UPN migration.
Note: Domain registration and DNS configuration in Microsoft 365 are customer responsibilities. Identity
Automation will provide guidance for the PowerShell commands required for the federation step.
3. Success and Acceptance Criteria
3.1 Authentication Enablement
● Authentication policies for Staff and Students are configured and active in RapidIdentity.
● Students can successfully authenticate using the pictograph (passwordless) method.
● Staff authentication policies function as designed and documented.
● DeKalb County School District confirms successful end-to-end testing prior to sign-off.
3.2 Provisioning Updates
● Student accounts across Active Directory, Google, and Microsoft 365 are updated to the
new domain.
● Staff accounts are unaffected by the student domain change.
● No data loss or attribute corruption occurs during domain migration.
● Provisioning jobs reflect the new domain for all new and existing Student accounts.
3.3 Microsoft 365 Student Domain Federation
● The new student domain is verified in Microsoft 365 and federated with RapidIdentity.
● Students can authenticate to Microsoft 365 using the RapidIdentity authentication policy.
● PowerShell federation commands execute successfully and federation is confirmed.
3.4 General
Confidential
RapidIdentity – Phase 3 Project Scope | DeKalb County School District
● All deliverables reviewed and accepted by DeKalb County School District’s
designated project stakeholder(s).
● Knowledge transfer completed for all implemented components.
● No critical or high-severity defects remain open at project closure.
4. Risks
The following risks have been identified. Each will be revisited and refined during project kick-off
and the design phase.
Risk Likelihood Impact Mitigation
Student UPN migration in Medium High Plan migration during a
M365 causes disruption to scheduled maintenance
active sessions or dependent window. Communicate to
services stakeholders in advance.
Test with a pilot group
before full rollout.
New student domain DNS or Medium Medium Confirm domain registration
M365 verification delays block and DNS access with
federation DeKalb County School
District IT at kickoff. Identify
responsible owner for DNS
changes.
Pictograph authentication not Low Medium Validate browser/device
supported on all student compatibility during design
devices or browsers phase. Identify fallback
authentication method if
needed.
Customer approval/decision Medium Medium Establish named
delays extend project timeline stakeholders and decision
timelines at kick-off. Build
review windows into the
project schedule.
5. Hours Breakdown
The following table summarizes estimated professional services hours for all in-scope
deliverables.
Deliverable Description Hours
Authentication Enablement Policy design, 16
configuration, and
testing for Staff and
Confidential
RapidIdentity – Phase 3 Project Scope | DeKalb County School District
Students; pictograph
authentication setup
Provisioning Updates Domain attribute 16
updates across Active
Directory, Google, and
Microsoft 365
M365 Student Domain Federation Federation 8
configuration;
PowerShell command
delivery and validation
Total Hours 40
Total Defined Professional Services Hours: 40 hours
6. Assumptions
The following assumptions govern the delivery of this engagement. Any deviation from these
conditions may result in a change order, adjusted timeline, or additional cost.
6.1 Scope Limitations
● This scope of work covers the deliverables explicitly described herein. Any additional
functionality will require a change order.
● Writing back to the HRMS or SIS is not included unless explicitly stated in the scope of
work.
● Any items or functionality not included in this Statement of Work are outside project
scope and would require a separate SOW or change order, incurring additional costs.
6.2 Access and Timeliness
● The customer will provide timely access to all devices, facilities, systems/applications,
and services necessary to complete the tasks in this scope of work. Failure to provide
timely access will result in a change order and resetting of project timelines and
anticipated go-live date.
6.3 Data Requirements
● Uniquely identifiable information must be populated within all applications in scope.
● All use cases, unless otherwise specified, will be built within production systems.
Building in development or test environments is not supported under this scope and
would require a change order.
6.4 Customer Responsibilities
● Domain registration, DNS configuration, and Microsoft 365 domain verification are the
sole responsibility of DeKalb County School District.
Confidential
RapidIdentity – Phase 3 Project Scope | DeKalb County School District
● Identity Automation engineers do not provide consulting or advice on DirSync, Azure AD
Connect, or Entra ID. It is recommended to consult with a Microsoft engineer prior to
disabling any of these tools.
6.5 Acceptance Testing
● Customers will perform acceptance testing in advance of production rollout.
● Test cases will be written and provided by Identity Automation staff prior to completion.
Successful completion of these test cases constitutes project completion.
● Test users and groups MUST be provided prior to any testing. Failure to provide these
may result in project timeline delays and inaccurate test results.
6.6 Project Continuity and Delays
● Projects are designed to be executed continuously through to completion and production
deployment once started.
● Any delay in project deployment may result in the reassignment of the Identity
Automation engineer and potential rescheduling. Engineer availability requires a
minimum of 30 days notice before an engineer can be rescheduled back onto the
customer project.
● Any project delays may introduce risk to originally agreed-upon go-live dates, including
start of school.
Confidential