This article describes the eADM integration with Altinn 3 access management for Norwegian municipalities, covering the benefits, the reports generated at each synchronisation, and the technical setup process.
Overview
eADM connects to Altinn's access management and gives the municipality control over who holds rights in Altinn on behalf of the municipality and all underlying entities. The integration mirrors Altinn rights into eADM, so they are administered the same way as other target systems in eADM.
The integration supports both Altinn Access packages and Altinn Single services, which appear as two separate access systems (collections) in the eADM interface. This gives the municipality full overview, automatic revocation on termination, complete history, and ongoing reporting — without manual administration in Altinn.
Benefits From Day One
Once the integration is in production and rights are mirrored into eADM, the municipality gets the following.
Full overview
Complete overview of who has access in Altinn on behalf of the municipality and all its underlying entities — including people who have left, or who were never employed by the municipality. Altinn access appears as two access systems in the eADM interface (Access packages and Single services).
Automatic revocation
When an employee is registered as terminated in the payroll or HR system, eADM automatically withdraws the access rights delegated to that person in Altinn. No one needs to remember to do this manually, and the risk of forgotten access rights is removed.
Full history
All changes to rights are recorded in eADM's history. The history can be linked to message flows for automatic notification to managers, subject-matter owners, and administrators when changes occur.
Reporting
Each synchronisation generates four reports that give a full overview of the rights assigned in Altinn for the municipality. The reports can be used for further analysis and deviation handling.
Reports Generated at Each Synchronisation
Each synchronisation produces four CSV reports per organisation, named with the organisation number, "Altinn", a run ID, and the report type. The reports distinguish between rights that eADM can remove automatically and rights that cannot be removed, and whether a right can be matched against a known person or employee in eADM.
|
Report |
Content |
|---|---|
|
Removable, matched |
Rights eADM can withdraw automatically and manually, and that are matched against a known user in eADM. |
|
Removable, unmatched |
Rights that cannot be matched against a known user (for example, external or terminated people). This report can form the basis for access clean-up elsewhere in Altinn. |
|
Non-removable, matched |
Rights that cannot be removed automatically, but are matched against a known user. |
|
Non-removable, unmatched |
Rights that can neither be removed automatically nor matched against a known user — candidates for manual review. This report can form the basis for cleaning up access in other systems that grant access to Altinn, for example Brønnøysundregistrene. |
The unmatched and non-removable reports are particularly useful for clean-up. They point to access that belongs to people outside the organisation, or that has been delegated in ways that require manual handling.
Benefits Once the Data Foundation Matures
Once the integration has collected sufficient, good-quality data over time, the municipality can adopt more advanced functionality.
Full control
Altinn access can be assigned and removed directly in eADM, on the same basis as other access systems. As with other systems, assignment can be delegated all the way down to manager level.
Full automation
Based on the data collected, eADM can use machine learning and human oversight to suggest rules that automatically assign the rights employees need.
Comparison: With and Without the Integration
|
Function / attribute |
With eADM–Altinn integration |
Manual administration in Altinn |
|---|---|---|
|
Overview of all Altinn access |
Yes – consolidated in eADM |
Partial / manual |
|
Captures terminated and external people |
Yes |
No |
|
Automatic revocation on termination |
Yes |
No |
|
History of rights changes |
Yes |
Limited |
|
Notification to managers / subject-matter owners |
Yes (message flow) |
No |
|
Periodic reporting |
Yes – 4 reports per synchronisation |
Manual extraction |
|
Assignment delegated to manager level |
Yes (once mature) |
No |
|
Rule-based / automatic assignment |
Yes (once mature) |
No |
|
Requires manual maintenance in Altinn |
No |
Yes |
Technical Setup and Implementation
Setup and implementation take place in four steps. Identum expects the integration to be ready for use within 7 days after the municipality has granted the necessary access.
Implementation steps
-
Order the Altinn integration. The municipality orders the integration for eADM.
-
Assign the Access manager role to eADM in Altinn. The municipality assigns the eADM system the Access manager role in Altinn, so eADM can read and administer rights on behalf of the municipality.
-
Identum configures the integration. Identum sets up the integration in eADM and runs it in production.
-
Go live. The municipality is notified when the integration is ready, when the reports are available for download, and when Altinn rights are mirrored in eADM.
How Altinn appears in eADM
After setup, Altinn appears as two collections under Rights → Collections in eADM:
-
Altinn Access packages — standardised access packages (for example Audit, Business tax, VAT, Accounting and financial reporting, Customs), with properties attached to each right.
-
Altinn Single services — individual rights delegated in Altinn (for example, access to publish content on a specific service).
On each user, assigned Altinn rights appear under the Rights tab, with source tagging that shows which Altinn harvest and which organisation (organisation number) the right originates from. This makes it clear which entities under the municipality the person has access to.
Prerequisites and division of responsibility
Municipality's tasks:
-
Order the Altinn integration.
-
Assign eADM the Access manager role in Altinn.
-
Give the go-ahead for production go-live.
Identum's tasks:
-
Configure the integration in eADM.
-
Run the integration in production and verify that rights are mirrored correctly.
-
Notify the municipality when the solution is ready for use, and assist with interpreting the reports.
Next Steps
To get started, or with questions about the setup, contact your Identum contact person, or raise a request via identum.no/support.