Ensuring the right access is in place at the right time is a critical part of both onboarding and offboarding Arts employees and a key component of our shared responsibility for cybersecurity.
Effective access management helps protect sensitive information, reduces security risks, and ensures compliance with UBC policies. It’s just as important to grant system access when someone joins as it is to remove that access when they leave or change roles.
This guide brings together the essential steps for managing digital access across commonly used tools within UBC Arts.
Since administrators and managers play an essential role in safeguarding Arts systems, this guide is designed to support you in creating smooth, secure transitions for employees throughout the employee lifecycle.
Onboarding
Hardware
✅ Buy a new computer for your new employee and register the computer in the Arts inventory or acquire an existing computer from your unit.
✅ Bring the new employee to the Arts ISIT Help Desk (Buchanan C113) to set up their computer.
Campus-Wide Login (CWL)
A CWL is required before any further IT access setup can be completed.
✅ Confirm with the new employee that they have activated their CWL.
Faculty & Staff Email (FASmail)
FASmail access is automatically controlled by an employee’s Workday appointment. When an employee’s Workday appointment starts, their FASmail account will be activated.
As part of implementing Microsoft 365 university-wide, UBC has recently migrated our enterprise email services from on-premises to the cloud platform, Microsoft Exchange Online.
✅ If applicable, add the new employee to a shared/generic FASmail account by including the account when you are completing ASC HR’s Access Request Form.
Mailing Lists
If your unit uses custom UBC Mailing Lists or Arts Mailing Lists, list owners are required to add new employees to the appropriate lists.
✅ If applicable, add the new employee to your mailing list(s).
Arts Internal Resources (AIR)
✅ Confirm access level and request AIR role:
For AIR sites with automated access (most AIR sites), the new employee will automatically have “Subscriber” access based on their appointment. If you would like them to have more advanced access, such as an ”Editor” or “Administrator” role, please include that when you are completing ASC HR’s Access Request Form.
For AIR sites with manual access (less common), please include the new employee’s access/role as either a “Subscriber”, “Editor”, or “Administrator” when you are completing ASC HR’s Access Request Form.
✅ Edit AIR groups by adding the new employee to the “User List” and update group(s) for the new employee.
Microsoft Teams
You can add new employees to Microsoft Teams 24 hours after they have set up their UBC email.
✅ Add the new employee to the unit’s MS Team by right-clicking on the MS Team > Add Member > Search by their name > Add.
✅ If applicable, add the new employee to your “File Repository” channel.
✅ If applicable, add the new employee to any relevant private channels.
Microsoft SharePoint
If your unit stores shared files in Microsoft SharePoint and if the new employee was added to the “File Repository” MS Teams channel, the employee will have automatic access to all shared folders and files. However, if they need access to specific private folders or files in MS SharePoint, they will need to be manually added.
✅ If applicable, add the new employee to relevant restricted folders by right clicking the folder you wish to add them to > Manage access > Click on the + icon on the top right corner > Search by their names > Grant access.
TeamShare
If your unit stores shared files in TeamShare, employees will have to be manually added.
✅ If applicable, add the new employee to your unit’s TeamShare by including specific folder access when you are completing ASC HR’s Access Request Form.
Zoom
✅ Confirm with the new employee that they have emailed UBC IT Audiovisual (av.helpdesk@ubc.ca) with their UBC email address and Faculty / School / Department to request a Zoom license.
Role-Specific Tools
Some roles require manual access to other tools, such as Arts CMS, Arts Tableau, Canvas, Workday Student, etc.
✅ If applicable, add the new employee to role-specific tools by including the details when you are completing ASC HR’s Access Request Form
Offboarding
Hardware
✅ Ask your employee to store any work files on your unit’s shared folder (e.g., TeamShare, Microsoft SharePoint).
✅ Bring the computer to Arts ISIT to securely wipe the hard drive.
✅ If the computer is still useable, your unit can safely store it for future use; however, if the computer is old, Arts ISIT can recycle it for you.
Campus-Wide Login (CWL)
Since standard CWL accounts are for students, staff, and faculty who have active employee or student ID numbers, if they do not have an active appointment at UBC, their CWL will automatically deactivate.
Faculty & Staff Email (FASmail)
FASmail access is automatically controlled by an employee’s Workday appointment. When an employee’s Workday appointment ends, their FASmail account will be deactivated.
✅ If applicable, remove the employee from any shared/generic FASmail accounts by contacting Arts ISIT.
✅ If applicable, request a temporary automatic reply message to be setup to state alternative contacts for inquiries by contacting UBC IT.
Arts Mailing Lists
If your unit uses custom UBC Mailing Lists or Arts Mailing Lists, list owners are required to remove the employee from the appropriate lists.
✅ If applicable, remove the employee from your mailing list(s).
Arts Internal Resources (AIR)
✅ Remove the employee from AIR by contacting Arts ISIT.
✅ Remove the employee from any AIR groups they were in.
Microsoft Teams
✅ Remove the employee from your unit’s MS Team by right-clicking on the MS Team > Manage Team > Members > Delete member.
Microsoft SharePoint
If your unit stores shared files in MS SharePoint and if the employee was removed from your MS Teams, they will no longer have access to shared folders and files. However, if they were manually given access to specific folders and files in MS SharePoint, they will need to be manually removed.
✅ MS Team channel owners can remove access to restricted folders by right clicking the folder you wish to remove the person from > Manage access > Update access of the person selected.
TeamShare
If your unit stores shared files in TeamShare, the employee will have to be manually removed.
✅ Remove the employee from your unit’s TeamShare by contacting Arts ISIT.
Zoom
When an employee’s Workday appointment ends, their FASmail account will be deactivated and therefore will no longer have a UBC Zoom license.
Role-Specific Tools
Some roles require manual access to other tools, such as Arts CMS, Arts Tableau, Canvas, Workday Student, etc.
✅ Remove the employee from role-specific tools by contacting Arts ISIT.
