IDAM - Identity and Access Management - May 2027

Audience

AEMO Australian Energy Market Operator provides this information as a service targeting business analysts, IT staff, and Participant Administrators.

The primary audience is any external organisation accessing the AEMO services including:

• Registered Participants Energy Rules Terms
• Non-registered Participants
• Non-market participants
• Potential Participants
• Service Providers

Contents

Summary

This document outlines the Identity Identities refer to entities that are recognised and authenticated within a system or organisation. and Access Management (IDAM) Release scheduled for May 2027 by the Australian Energy The unit must be a generator for the service type: ‘energy’. Loads cannot bid for mandatory restrictions capacity. Market Operator AEMO (AEMO), detailing changes to participant systems, timelines, and processes for transitioning to a new unified IDAM platform.

• Release schedule Energy Rules Terms and version: The IDAM Release version 0.01 is scheduled for pre-production on 1 March 2027 and production on 2 May 2027, with no rule changes effective at publication.
• Audience and purpose: Targeted at business analysts, IT staff, and participant administrators, the document provides technical guidance for participants accessing AEMO services under National Gas or Electricity Rules The National Gas or Electricity rules..
• IDAM project goals: The project aims to unify identity and access management, enhance cybersecurity, introduce multi-factor authentication, identity federation, self-service capabilities, and role-based access, improving security and user experience.
• Key IDAM concepts: IDAM covers identity management (human and non-human), entitlement management, data sharing, authentication, authorization, consent management, self-service, segregation of duties, deprovisioning, governance, logging, and lifecycle management.
• Terminology mapping: The document maps terms from previous systems (URM User Rights Management; see the Guide to URM on AEMO's website., SAM System Access Management. SAM is used by Participant Administrators to set up Participant Member access to AEMO's Application Portal. It does not require access to AEMO's private data network, MarketNet.) to IDAM terminology, clarifying roles such as Participant Administrator Participant Administrator, is a privileged user, who is employed by the respective Registered Participant organisation and has the authority to manage the AEMO-provisioned identity and access control system, for their own organisations users wanting to get access to AEMO's system and resources., Organisation Administrator An admin user who is authorised to manage the access and entitlements for all person and non-person identities within that organisation to AEMO services. This role includes overseeing association of those identities with one or more of the Participant IDs within the organisation., and types of identities including human and service accounts.
• AEMO portal updates: The IDAM platform will be integrated into AEMO portals, enabling organization and participant administrators to create and onboard users, enforce email verification, secure passwords, and multi-factor authentication, with legacysupport during transition.
• Data sharing Each participant ID can share their data with other participant IDs, subject to an authorised request. Implementing data sharing means the full Data Interchange data set (including private data) for the requesting participant ID is made available to another participant's sets of folders in the EMMS file server, as nominated in the request. The sharing of data is for both pre-production and production. A data sharing requirement may emerge, for example, due to a merger with, takeover of, or sale of another registered participant. The requirement may be to use one company's IT system to manage access, and process the data for two or more participant IDs using just one participant IDs set of folders in the EMMS file server. The Data Interchange web application in the Markets Portal provides the status of any data sharing agreements you have implemented. enhancements: The release introduces flexible data sharing agreements allowing participants to delegate access to service providerswho can manage users and roles on their behalf, with further design details forthcoming.
• Transition and migration: The transition involves moving existing users from the legacy User A user is a person who uses the system, either through UI (interactive) or by Batch processing (batch). To use the system each user must be associated with a participant ID and a Role. The Role assigned to the user determines the menu options and interfaces the user can access, and what actions (privileges) the user can complete. Rights Management system to the new IDAM platform on 2 May 2027, followed by an industry migration phase where participants migrate users to the target state, including preparation, cutover, and post-cutover activities.
• Participant responsibilities: Participants must identify service accounts, confirm organizational hierarchies, designate administrators, whitelist email domains, and clean up inactive users in production to comply with the release.