Overview: User Management & Research Support
1. Introduction & Regulatory Context
The myDRE ecosystem is fundamentally built as a cross-organizational collaboration platform. This architecture allows external researchers to securely cooperate within your organization's dedicated Workspaces, while your own internal personnel can be invited to collaborate within external environments. This flexible model operates in strict compliance with the Access Review Policy.
The following user-management principles support institutional duty-of-care and access-governance arrangements associated with ISO/IEC 27001 Annex A control A.05.15, GDPR Article 24(1), and NIS2 Directive Article 21(2)(i):
- Organizational User Management: An organization must be able to request blocking of myDRE usernames associated with its organizational email addresses through an authorized user-management process.
- Correspondence Email: The
@mydre.orgusername is a login identifier, not an email mailbox. Account communications are sent to the user's correspondence email address. Users may request a change to this address, provided the new address is verified and is not already associated with another myDRE account. - Account Management and Workspace Authorization: Account changes follow the verification and authorization process described in myDRE user management. Research Support can manage users belonging to its own organization; requests concerning other users are handled by anDREa Support. Correspondence email changes and account reactivation restrict the user's access in all associated workspaces. Workspace access must then be reviewed and restored separately by an authorized workspace role.
2. Specialized Lifecycle Procedures
2.1 The Right to be Forgotten & Account Deactivation and Retention
An individual's unique platform identifier follows a strict decommissioning lifecycle similar to a cellular telephone number:
- The Communication Analogy: A mobile number connects directly to an individual. Once disconnected, that connection is broken, but the number cannot be immediately reassigned without risking misdirected communications.
- The Cool-Down Mandate: Similarly, an assigned
@mydre.orgusername serves as an active identification and routing token. When a user account is disassociated, anDREa enforces a strict cool-down period before allowing that specific username to be recycled or assigned to a different individual. - Operational Execution: Deactivated usernames are systematically preserved within anDREa’s Microsoft Entra ID database in accordance with the timelines defined in our Retention & Destruction Policy, while identity decoupling is tracked inside the myDRE user management framework.
2.2 Organizational Offboarding and Users Outside SCIM
- SCIM Integration: anDREa strongly recommends using SCIM to submit supported user creation, modification, and lifecycle requests. For users managed through the configured integration, removal from the SCIM group, blocking of the source account, or deletion of the source account triggers a request to block the associated myDRE username. Requests are executed by anDREa Support in accordance with the applicable procedure.
- Users Outside the SCIM Group: Users may request a myDRE username using an organizational email address without being included in that organization's SCIM group. Research Support can obtain the My Employees CSV through myDRE Insights - Client Insights and compare it with the organization's SCIM group. Accounts outside the group must be assessed to determine whether they should be brought under SCIM management or handled through the applicable manual user-management process.
2.3 Request Processing, Verification, and Visibility
User-management requests can originate from Research Support, workspace invitations submitted by Accountables or Privileged Members, SCIM, or user self-service workflows. These requests are reviewed and executed by anDREa Support; submission does not immediately apply the requested change. Microsoft self-service password recovery is a separate route and does not require anDREa Support to execute the reset.
Research Support may request name or correspondence email changes, password resets, MFA resets, account deactivation, and account reactivation for users belonging to its own organization.
Users may request name and correspondence email changes through their profile settings. Users who cannot sign in may request a password or MFA reset through the Get help link on the myDRE login page.
Correspondence email changes require verification of the new address before anDREa Support executes the request. Password and MFA reset requests submitted through the myDRE request workflow require the user to follow the verification instructions sent to the correspondence email address already known to the system before anDREa Support executes the request.
A user who has lost access to their correspondence email address but can still access the myDRE portal may request an email change through profile settings and verify the new address. If the user cannot access the portal or complete the applicable verification, they must contact anDREa Support for assistance.
Research Support can view requests associated with its organization and workspace memberships belonging to its organization. Memberships in other organizations' workspaces are not visible to that Research Support team. Research Support can submit account-management requests only for users belonging to its own organization. Requests concerning users outside that scope are handled directly by anDREa Support through the applicable portal workflow or, where necessary, the ticketing system.
Account deactivation prevents sign-in to myDRE. Account reactivation restores the ability to sign in but does not automatically restore previous workspace permissions.
Once a correspondence email change or account reactivation request has been processed, the user's role is set to Restricted in all associated workspaces. Where the workspace has an active Accountable, that Accountable reviews continued authorization and reinstates the appropriate workspace role. Where the Accountable is Restricted and no active Accountable is available, the client organization's Research Support is responsible for reviewing and resolving the Accountable assignment. This includes appointing an Accountable where all workspace members are Restricted.
Restriction arising from an access review takes effect at the enforcement deadline defined in the Access Review Policy, rather than when an account-change request is processed.
3. User Story & Role-Based Action Matrix
The following matrix maps platform user stories to their required operational execution tracks across organizational roles:
| User Story / Scenario | anDREa Admin Role | Research Support (RS) | Accountable / Privileged Member | End-User Track |
|---|---|---|---|---|
User requires a new @mydre.org identity | Reviews and executes the account-creation request. | Submits a creation request through admin.mydre.org or the configured SCIM integration. | Requests creation of an account through the workspace invitation workflow in mydre.org, subject to applicable organizational authorization requirements. | Contacts support.mydre.org where assistance is required. |
| User forgot their username | Automated self-service retrieval path via web utility. | Refer user to retrieval path. | Refer user to retrieval path. | Accesses standard recovery tool at https://isms.andrea-cloud.com/forgot-username. |
| User needs password recovery or reset | Reviews and executes requests submitted through the myDRE workflow after user verification; Microsoft self-service recovery is handled separately. | Refers the user to Microsoft self-service recovery or submits a reset request for a user belonging to its own organization through `admin.mydre.org. | Refers the user to the available recovery route or appropriate support channel. | Uses Microsoft password reset where available, or selects Get help on the myDRE login page and completes the verification required for the support-executed reset. |
| New user needs assistance with initial access | Handles the request through the applicable account-verification and recovery procedure. | Refers the user to the recovery workflow or submits a support request where necessary. | Refers the user to the recovery workflow or appropriate support channel. | Uses Get help on the myDRE login page or contacts support if the account or correspondence email details are uncertain. |
| User requires an MFA reset | Reviews and executes the request after user verification. | Submits an MFA reset request for a user belonging to its own organization through admin.mydre.org. | Refers the user to the recovery workflow or appropriate support channel. | Selects Get help on the myDRE login page, requests an MFA reset, and follows the verification instructions sent to the registered correspondence email address. |
| User requests new hardware key or custom MFA | System administration configuration. | Refer user to profile management options. | Refer user to profile management options. | Configures credentials directly at https://myaccount.microsoft.com/?ref=MeControl. |
| User requests a correspondence email change* | Reviews and executes the request after verification of the new email address. | Submits a modification request for a user belonging to its own organization through the supported admin portal or SCIM workflow. | Reviews continued workspace authorization and restores access where permitted by the workspace role-management procedure. | Requests the change through profile settings and verifies the new email address. The new address must not already be associated with another myDRE account. |
| User requests a name change | Reviews and executes the request. | Submits a modification request for a user belonging to its own organization through the supported admin portal or SCIM workflow. | Refers the user to their profile settings or appropriate Research Support team. | Opens profile settings, selects Update info, edits the relevant name fields, and submits the request. |
| Immediate account blocking required | Security Officers execute immediate lockout via active phone escalations to +31 6 2125 3834 or +31 6 4812 1117. | Escalates to Security Officer immediately. | Escalates to Security Officer immediately. | N/A |
| Remove user from one or more Workspaces | Performs authorized support actions where required. | Follows the applicable RS workspace-management procedure or requests support assistance. | Removes workspace membership through the Users tab in mydre.org. | Uses self-removal or requests removal through the Users tab, where available. |
| User leaves an organization or loses access to its email address | Reviews and executes the applicable deactivation or correspondence email change request. | Determines the required organizational action and submits the appropriate portal or SCIM request for users within its management scope. | Reviews whether continued workspace access remains justified. | If still able to access myDRE, requests a correspondence email change through profile settings and verifies the new address. Otherwise, contacts anDREa Support for assistance. |
| Request platform account deactivation | Reviews and executes the request. Once deactivated, the user can no longer sign in to myDRE. | Submits a deactivation request for a user belonging to its own organization through admin.mydre.org or the applicable SCIM workflow. | Raises the request with the appropriate Research Support team or anDREa Support. | Contacts support to request deactivation where required. |
| Add user to a Workspace | Performs authorized support actions where required, including execution of account-creation requests for new invitees. | Follows the applicable RS workspace-management procedure or requests support assistance. | Manages workspace membership through the Users tab in mydre.org; the workspace invitation workflow can generate an account-creation request where needed. | Follows the applicable workspace-access process. |
| Request platform account reactivation* | Reviews and executes the request. Reactivation does not restore previous workspace permissions automatically. | Submits a reactivation request for a user belonging to its own organization through admin.mydre.org. | The active workspace Accountable reviews continued authorization and reinstates the appropriate role. If no active Accountable is available, Research Support resolves the Accountable assignment. | Contacts the appropriate Research Support team or anDREa Support to request reactivation. |
| Request erasure of platform user information | Handles the request under the Data Protection Policy, applicable client instructions, and Retention & Destruction Policy. | Supports verification and coordination where required. | Supports workspace-related coordination where required. | Submits an erasure request through myDRE Support Portal. |
* Workspace Restriction Following Account Changes: Once a correspondence email change or account reactivation request has been processed, the user's role is set to Restricted in all associated workspaces. Workspace permissions are not restored automatically. An active workspace Accountable reviews continued authorization and reinstates the appropriate role. If no active Accountable is available because the Accountable is Restricted, the client organization's Research Support reviews and resolves the Accountable assignment.
4. Automated Governance & Exception Controls
- Inactivity Gates: Users who fail to authenticate for a predefined period of months receive automated email notifications. If no action is taken, their access profile is automatically blocked.
- Account Verification Indicators: Users can view account status, workspace membership information, and required email-verification actions in their profile overview. Research Support can view the user-management information available within its organizational scope. Required verification and workspace authorization are handled through the applicable user-management and role-management procedures.
- Periodic Email Re-verification: In Development: Periodic prompts to verify continued access to the correspondence email address are planned. Email verification does not replace the assessment of continued organizational or workspace authorization.