Identity Automation Quote Phase 3 - May 11, 2026 - DCSD Board Meeting Archive

Quote
Quote Number: Q-34317
Identity Automation LP Date Generated: 3/19/2026
7102 N. Sam Houston Pkwy. W. Ste 100 Expiration Date: 4/16/2026
Houston, TX, 77064

Prepared For: Contact Information:
DeKalb County School District Customer Contact: Kermit Belcher
1701 Mountain Industrial Blvd. kermit_belcher@dekalbschoolsga.org
Stone Mountain, GA 30083
IA Account Rep: Nick Mennecke
nmennecke@idauto.net

Annual Subscription Cost

Product Quantity Unit Price Sale Price Total
2025 Authentication K-12 Education Qualified 6,500 $30.25 $16.34 $106,210.00
User - Annual Subscription RID-C-AUTH12
Annual Subscription Cost TOTAL: $106,210.00

One-Time Cost

Product Quantity Unit Price Sale Price Total
Professional Services - Services Engineer (per 40 $250.00 $250.00 $10,000.00
hour) SVC-S-SVCENG
One-Time Cost TOTAL: $10,000.00

Grand Total: $116,210.00

*Sales Tax not included. Will be added at time of invoicing, if applicable.*

PAYMENT TERMS
• All invoices are due within 30 days of invoice date.
• Subscription fees for software products, hosting services, and support are billed for and begin on the Effective Date of
this proposal.
• All One-time fees listed as Installation, Configuration, Setup Fees, Conversion Services, or Retainer Services are billed
in advance.
• Professional Services are billed based on the project progress getting to 50% stage and then to 100% completion,
unless the effort is under 2 weeks (80hours), in which case they will be billed in advance.
• Milestone based professional services are billed as each milestone is achieved.
• Service Units are billed up front and expire after a year.

ANNUAL RENEWAL
Subscription Term shall automatically renew for an additional 1-year term unless either party gives the other written notice
of non-renewal at least 90 days prior to the end of the relevant Subscription Term.

Initial term of this Order Form (Term): 36 Months

To execute on this quote please provide a purchase order. Purchase orders can be sent to
orders@identityautomation.com.
Project Description

PROJECT INTRODUCTION
• Team Identification
• Stakeholder identification
• Roles & Responsibilities
• Scope of Work (SOW)
• Communications plan
• Project Plan with associated tasks & milestones

INFRASTRUCTURE CREATION
Identity Automation may have steps a customer must take before Identity Automation can begin our
work. These will be clearly defined in the SOW.

ASSESS, DESIGN & BUILD
Collaborative and iterative process between Identity Automation and Customer Stakeholders in order
to meet the requirements identified in the SOW. These tasks are detailed below.

USER ACCEPTANCE TESTING (UAT)
Customer stakeholder(s) to test each of the use cases defined in the approved design document.
This signifies Identity Automation has completed its work and delivered the solution as defined in the
SOW. Identity Automation will close the Project.

POST UAT SUPPORT
The Identity Automation team will provide 30 days of post-UAT support for issues during customer
deployment which fall within the SOW. This support timetable begins the day after successful UAT.

DEPLOY SOLUTION
Customer deploys solution
Scope of Work
RapidIdentity – Phase 3 Project Scope | DeKalb County School District

Phase 3 Project Scope
RapidIdentity Platform Expansion
Prepared for: DeKalb County School District

1. Scope Summary
Following successful Phase 1 and Phase 2 implementations of RapidIdentity, DeKalb County
School District would like to continue expanding the platform. Phase 3 is organized around
three primary initiatives:
● Authentication Enablement — Creation and configuration of desired authentication
policies for Staff and Students, including a passwordless pictograph authentication
experience for Students.
● Provisioning Updates — RapidIdentity provisioning will be updated so that Students use
a dedicated email domain (e.g., stu.dekalbschools.org), with corresponding updates
across Active Directory, Google, and Microsoft 365.
● Microsoft 365 Student Domain Federation — Configuration of the new student domain in
M365 and federation with RapidIdentity to support the new authentication policy.

2. Scope of Work

2.1 Authentication Enablement
Identity Automation will assist DeKalb County School District with the creation and
configuration of desired RapidIdentity authentication policies for both Staff and Students.
Authentication policies define how users verify their identity when accessing systems through
RapidIdentity.
Key activities include:
● Review and documentation of current authentication requirements for Staff and
Students.
● Design and configuration of authentication policies within RapidIdentity to meet
documented requirements.
● Configuration of pictograph authentication for Students, enabling a passwordless login
experience within RapidIdentity.
● Testing and validation of authentication policies for both user populations prior to
production rollout.

2.2 Provisioning Updates
RapidIdentity provisioning will be updated to assign Students a dedicated email domain,
separate from the Staff domain. For example: stu.dekalbschools.org. This separation enables
distinct authentication policies and routing between user types.
Updates will be applied across the following target systems:

Confidential
RapidIdentity – Phase 3 Project Scope | DeKalb County School District

● Active Directory
○ Update mail attribute to new student domain.
○ Update userPrincipalName (UPN) to new student domain.
● Google
○ Update primaryEmail to new student domain.
● Microsoft 365
○ Update mail attribute to new student domain.
○ Update userPrincipalName (UPN) to new student domain.

2.3 Microsoft 365 Student Domain Federation
To take advantage of the RapidIdentity authentication policy for Students, the new student
domain must be registered and configured in Microsoft 365 and then federated with
RapidIdentity.
Key activities include:
● DeKalb County School District will add and verify the new student domain in the
Microsoft 365 admin center (customer responsibility).
● Students will be migrated to the new domain by updating their UPN in Active Directory
and Microsoft 365.
● Identity Automation will provide consultation on PowerShell commands to federate the
new domain with RapidIdentity following domain verification and UPN migration.
Note: Domain registration and DNS configuration in Microsoft 365 are customer responsibilities. Identity
Automation will provide guidance for the PowerShell commands required for the federation step.

3. Success and Acceptance Criteria

3.1 Authentication Enablement
● Authentication policies for Staff and Students are configured and active in RapidIdentity.
● Students can successfully authenticate using the pictograph (passwordless) method.
● Staff authentication policies function as designed and documented.
● DeKalb County School District confirms successful end-to-end testing prior to sign-off.

3.2 Provisioning Updates
● Student accounts across Active Directory, Google, and Microsoft 365 are updated to the
new domain.
● Staff accounts are unaffected by the student domain change.
● No data loss or attribute corruption occurs during domain migration.
● Provisioning jobs reflect the new domain for all new and existing Student accounts.

3.3 Microsoft 365 Student Domain Federation
● The new student domain is verified in Microsoft 365 and federated with RapidIdentity.
● Students can authenticate to Microsoft 365 using the RapidIdentity authentication policy.
● PowerShell federation commands execute successfully and federation is confirmed.

3.4 General

Confidential
RapidIdentity – Phase 3 Project Scope | DeKalb County School District

● All deliverables reviewed and accepted by DeKalb County School District’s
designated project stakeholder(s).
● Knowledge transfer completed for all implemented components.
● No critical or high-severity defects remain open at project closure.

4. Risks
The following risks have been identified. Each will be revisited and refined during project kick-off
and the design phase.

Risk Likelihood Impact Mitigation
Student UPN migration in Medium High Plan migration during a
M365 causes disruption to scheduled maintenance
active sessions or dependent window. Communicate to
services stakeholders in advance.
Test with a pilot group
before full rollout.
New student domain DNS or Medium Medium Confirm domain registration
M365 verification delays block and DNS access with
federation DeKalb County School
District IT at kickoff. Identify
responsible owner for DNS
changes.
Pictograph authentication not Low Medium Validate browser/device
supported on all student compatibility during design
devices or browsers phase. Identify fallback
authentication method if
needed.
Customer approval/decision Medium Medium Establish named
delays extend project timeline stakeholders and decision
timelines at kick-off. Build
review windows into the
project schedule.

5. Hours Breakdown
The following table summarizes estimated professional services hours for all in-scope
deliverables.

Deliverable Description Hours
Authentication Enablement Policy design, 16
configuration, and
testing for Staff and

Confidential
RapidIdentity – Phase 3 Project Scope | DeKalb County School District

Students; pictograph
authentication setup
Provisioning Updates Domain attribute 16
updates across Active
Directory, Google, and
Microsoft 365
M365 Student Domain Federation Federation 8
configuration;
PowerShell command
delivery and validation
Total Hours 40
Total Defined Professional Services Hours: 40 hours

6. Assumptions
The following assumptions govern the delivery of this engagement. Any deviation from these
conditions may result in a change order, adjusted timeline, or additional cost.

6.1 Scope Limitations
● This scope of work covers the deliverables explicitly described herein. Any additional
functionality will require a change order.
● Writing back to the HRMS or SIS is not included unless explicitly stated in the scope of
work.
● Any items or functionality not included in this Statement of Work are outside project
scope and would require a separate SOW or change order, incurring additional costs.

6.2 Access and Timeliness
● The customer will provide timely access to all devices, facilities, systems/applications,
and services necessary to complete the tasks in this scope of work. Failure to provide
timely access will result in a change order and resetting of project timelines and
anticipated go-live date.

6.3 Data Requirements
● Uniquely identifiable information must be populated within all applications in scope.
● All use cases, unless otherwise specified, will be built within production systems.
Building in development or test environments is not supported under this scope and
would require a change order.

6.4 Customer Responsibilities
● Domain registration, DNS configuration, and Microsoft 365 domain verification are the
sole responsibility of DeKalb County School District.

Confidential
RapidIdentity – Phase 3 Project Scope | DeKalb County School District

● Identity Automation engineers do not provide consulting or advice on DirSync, Azure AD
Connect, or Entra ID. It is recommended to consult with a Microsoft engineer prior to
disabling any of these tools.

6.5 Acceptance Testing
● Customers will perform acceptance testing in advance of production rollout.
● Test cases will be written and provided by Identity Automation staff prior to completion.
Successful completion of these test cases constitutes project completion.
● Test users and groups MUST be provided prior to any testing. Failure to provide these
may result in project timeline delays and inaccurate test results.

6.6 Project Continuity and Delays
● Projects are designed to be executed continuously through to completion and production
deployment once started.
● Any delay in project deployment may result in the reassignment of the Identity
Automation engineer and potential rescheduling. Engineer availability requires a
minimum of 30 days notice before an engineer can be rescheduled back onto the
customer project.
● Any project delays may introduce risk to originally agreed-upon go-live dates, including
start of school.

Confidential

Agenda Item