DAF ICAM Application Enablement Process
DAF ICAM Assisted Enablement
Assisted Enablement is the repeatable process that moves an application from preparation and assessment through discovery, integration, user acceptance testing (UAT), production enablement and closeout, with a dedicated Pod of DAF ICAM engineers and a single Engagement Manager supporting it throughout.
What is Assisted Enablement?
Assisted Enablement is a structured, high-touch engagement for applications that are not compliant with modern authentication protocols like Security Assertion Markup Language (SAML) or OpenID Connect (OIDC) or otherwise cannot use the Wingman Onboarding Tool to enable DAF ICAM support.
Each application is supported by a Pod: a cross-functional team with the technical resources needed to assess, integrate, test and move the application into production. Pod resources are assigned based on the application's ICAM needs, complexity and level of effort (LOE), so the timeline depends on what the assessment finds.
Your Engagement Manager is the consistent point of coordination throughout. Engineers and subject-matter experts (SMEs) perform the technical work, while program leadership provides oversight, prioritization and escalation when needed.
The enablement lifecycle
Every application is managed against one lifecycle: Plan & Prepare, Assessment, Assign Pod, Discovery, Build/Connect, UAT and Go-Live.
Enablement begins when the application owner completes the DAF ICAM Registration Form and questionnaire. Plan & Prepare and Assessment are intentionally iterative: if assessment identifies missing or unclear information, the application returns to Plan & Prepare for clarification without being treated as a failed stage.
| Stage | Purpose | Lead | Minimum exit condition |
|---|---|---|---|
| Plan & Prepare | Establish the engagement, identify and document customer and application points of contact (POCs), collect intake information, and set up the application's Resource/Knowledge Management location for the Migration Team. | Triage & Assessment; the Engagement Manager coordinates | Required intake is sufficiently complete; the application owner and customer and technical POCs are documented; current contact information and engagement resources are stored where the assigned Migration Team can access them. |
| Assessment | Determine needs, applicable ICAM services, complexity, LOE, dependencies, and Pod and resource needs. | Triage & Assessment | IdP, IGA and AAP applicability recorded; gaps dispositioned; routing recommendation ready. |
| Assign Pod | Assign a Standard or White Glove Pod and establish technical and customer contacts. | Program assignment authority; the Engagement Manager coordinates | Pod and resources identified and contacts connected. |
| Discovery | Define detailed technical requirements, current and future state, integration approach, dependencies and test needs. | Pod, with SME support | Applicable service requirements are sufficiently defined for implementation. |
| Build/Connect | Configure, engineer, integrate and technically validate the applicable ICAM services and application-side changes. | Pod, with SME support | Technical work and prerequisites are ready for UAT; open deficiencies are understood. |
| UAT | Execute customer validation, document results, and remediate and retest deficiencies. | Test Group | Required UAT passes or an approved disposition exists; Go-Live readiness confirmed. |
| Go-Live | Promote and activate the production solution, verify operation, transition to Operations & Support (O&S), and close enablement. | O&S and Release, as applicable | Production operation verified; turnover and closeout completed. |
Activities in each stage
These are the detailed activities within the lifecycle. They are not separate statuses: your application's status is always reported as one of the lifecycle stages.
| Activity | Lifecycle stage | Purpose |
|---|---|---|
| 1. Intake | Plan & Prepare | Receive intake, establish the basic application profile, and capture customer and application POCs. |
| 2. Survey / Questionnaire | Plan & Prepare | Collect and validate onboarding, access, authentication, provisioning and stakeholder information. |
| 3. Discovery Inputs | Assessment | Review requirements and identify areas requiring deeper technical discovery. |
| 4. As-Is Analysis | Assessment | Understand the current authentication, authorization, provisioning, access and integration state. |
| 5. To-Be Design | Assessment | Define the intended ICAM-enabled future state at the level needed for routing and technical discovery. |
| 6. Gap Analysis | Assessment | Identify gaps between the current and target state and the required remediation and dependencies. |
| 7. LOE / Path Determination | Assessment | Determine complexity, LOE, applicable services, and the Standard or White Glove path. |
| 8. Readiness / Pod Assignment Gate | Assign Pod | Confirm readiness and assign the appropriate Pod and resources. |
| 9. Engineering | Discovery and Build/Connect | Refine the technical design and begin service-specific engineering. |
| 10. Build & Integration | Build/Connect | Implement the integration and application-side changes in the applicable environment. |
| 11. UAT | UAT | Execute customer acceptance testing and resolve and retest deficiencies. |
| 12. Production / Go-Live | Go-Live | Promote and activate the solution, verify initial operation, monitor production stability, transition support, and complete closeout. |
White Glove and Standard Pods
White Glove Pods (1-3)
A higher-touch, multidisciplinary delivery model for applications with greater complexity, customization, priority or coordination needs.
Standard Pods (4-5)
The core Migration, Okta and SailPoint engineering capabilities for applications following the structured onboarding model.
Additional capabilities may be provided through Shared Resources or other support teams when required. Both Pod models follow the same lifecycle and handoff process.
| Characteristic | White Glove Pod | Standard Pod |
|---|---|---|
| Application profile | Higher complexity or LOE, customization, or coordination needs. | Standard, repeatable integration path. |
| Engagement model | Higher-touch, cross-functional support. | Standardized engagement. |
| Resources | Cross-functional delivery roles assigned based on need; may be more dedicated or embedded. | Core Migration, Okta and SailPoint engineering roles. |
| Shared resources | May use Technical SMEs, Cybersecurity, the Enablement Team, Shared Resources and other specialized support as needed. | Uses Shared Resources or other supporting teams for Triage/Assessment, Test/UAT, Middleware, Security & Release, SMEs and other specialized needs as required. |
| Lifecycle | Plan & Prepare and Assessment, then Assign Pod, Discovery, Build/Connect, UAT and Go-Live. | The same lifecycle. |
| Phase gates and records | The same controlled handoffs and records; additional approvals or artifacts may apply depending on LOE. | Standard controlled handoffs and records. |
IdP, IGA and AAP workstreams
Each applicable service, Identity Provider (IdP) with Okta, Identity Governance and Administration (IGA) with SailPoint, and Automated Account Provisioning (AAP), follows the same high-level progression and may progress independently. A service that does not apply is marked Not Required (N/R); that is an applicability result, not a stage.
| Service stage | IdP / Okta | IGA / SailPoint | AAP |
|---|---|---|---|
| Assess | Determine the authentication and IdP need; identify SAML or OIDC, CAC/MFA, claims and attribute considerations. | Determine the IGA need; identify account, role, entitlement, approval, provisioning and governance needs. | Determine AAP applicability; identify provisioning and attribute needs, target systems, interfaces and dependencies. |
| Discover | Define authentication flows, endpoints, certificates, claims, attributes, groups and integration dependencies. | Define the source or connector, schema, correlation, aggregation, provisioning, roles, entitlements, approvals and certification needs. | Define the connector or interface approach, schemas, mappings, provisioning and deprovisioning rules, and dependencies. |
| Configure/Build | Configure the Okta application, policies, claim and attribute mappings, certificates and integration settings. | Configure the SailPoint source or connector, schema, correlation, roles, policies, workflows and provisioning lifecycle functions. | Configure or build the connector or interface, attribute mappings, and provisioning and deprovisioning logic. |
| UAT | The customer validates the required authentication and application-access scenarios. | The customer validates the applicable access-request, approval, provisioning and governance scenarios. | The customer validates the applicable provisioning, attribute and lifecycle scenarios. |
| Go-Live | Promote and activate the production configuration and verify authentication. | Promote and activate the production IGA configuration and verify operational behavior. | Promote and activate the production AAP integration and verify operational behavior. |
| Validate/Closeout | Monitor production authentication flows, token and claim behavior, and errors; complete the IdP handoff and closeout. | Monitor production provisioning and governance behavior and applicable certifications; complete the IGA handoff and closeout. | Monitor production provisioning, error handling and synchronization stability; complete the AAP handoff and closeout. |
Stage handoffs
A stage advances based on demonstrated readiness. These are the minimum criteria for each handoff.
| Transition | Minimum handoff criteria |
|---|---|
| Plan & Prepare and Assessment | Required intake available; application owner, technical and customer POCs identified; known gaps documented; current contact information and engagement resources stored where the assigned Migration Team can access them. |
| Assessment to Assign Pod | IdP, IGA and AAP applicability identified; LOE and complexity assessed; dependencies documented; routing recommendation ready. |
| Assign Pod to Discovery | Pod and resources identified; customer and Pod POCs connected; actions and dependencies transferred. |
| Discovery to Build/Connect | Technical requirements and integration approach defined; service requirements captured; test needs understood; blockers identified. |
| Build/Connect to UAT | Configurations and integrations technically validated; application-side prerequisites complete; UAT cases, data and environment ready; deficiencies dispositioned. |
| UAT to Go-Live | Required UAT completed; failures remediated and retested, or dispositioned; production and release prerequisites satisfied. |
| Go-Live to Closeout | Production solution verified; operational owner identified; turnover complete; remaining actions documented; records and evidence retained. |
How your status is tracked
Status tracking answers two questions: where is the application overall, and where is each applicable ICAM service? The Engagement Manager coordinates and records status; the team responsible for the work validates whether its technical, testing or operational stage is complete.
- Overall application status: Plan & Prepare, Assessment, Assign Pod, Discovery, Build/Connect, UAT or Go-Live.
- IdP, IGA and AAP status: N/R, Assess, Discover, Configure/Build, UAT, Go-Live or Validate/Closeout. The services do not have to be at the same stage; each reflects its actual progress.
- Condition: On Track, Blocked, On Hold/GIH or Deferred. These are conditions, not stages: the application stays in its current stage and the condition explains why it is not progressing.
- Blocker, action owner, due date and next step: what is preventing or constraining progress, who owns the next action, when it is expected, and what must happen next.
- Readiness, not assumption: a stage does not advance until its exit criteria are met, and a status the responsible team has not yet validated is recorded as pending confirmation.
Definition of Ready and Definition of Done
Ready: before technical Discovery begins
- Intake and questionnaire are sufficiently complete.
- The application owner and technical and customer POCs are identified.
- IdP, IGA and AAP applicability is identified or marked N/R.
- Major dependencies and known blockers are documented.
- LOE, complexity, and the Standard or White Glove Pod need are assessed.
- The Pod and resources are assigned and customer participation expectations are understood.
- Discovery requirements and backlog preparation have begun, as applicable, for the assigned Pod and Business Analyst.
Done: before enablement closeout
- Applicable IdP, IGA and AAP production functionality is verified.
- Required UAT is complete and its results and evidence are retained.
- Go-Live activities are complete.
- Remaining deficiencies and actions are closed or formally dispositioned.
- Operational ownership and O&S turnover are complete.
- Required documentation and evidence are stored, and the customer and application owner are informed of the transition.
Roles and Responsibilities
At the start of each engagement, the Engagement Manager shares a Migration Team overview identifying the team members assigned to your application, their roles, how they support it, and their contact information. Team composition reflects the Pod and supporting resources assigned.
Customer Application Team
Provides application requirements and technical information, completes the required application-side configuration and actions, participates in UAT, verifies production operation, and accepts or assumes the applicable operational responsibilities after enablement.
Engagement Manager
Your consistent coordination point throughout the lifecycle. Maintains visibility of status, actions, dependencies, blockers, owners, next steps and handoffs, and coordinates communication between your team and the DAF ICAM teams.
| Role | Process function |
|---|---|
| Program Manager / Deputy PM | Program governance, prioritization, escalation, and program-level resource and decision support. |
| Migration Execution Manager | Oversight of application enablement and migration execution across engagements and Pods, including cross-engagement coordination, execution consistency, resource coordination and escalation. |
| Engagement Manager | Customer-facing coordination point throughout the lifecycle. Captures and maintains customer and application POCs and engagement resources for the Migration Team, and tracks status, actions, dependencies, blockers, owners, next steps and handoffs. |
| Triage/Assessment Analyst | Reviews intake and questionnaire information, coordinates clarification of gaps, assesses applicable ICAM services, supports LOE and complexity analysis, evaluates readiness, and recommends the Pod, resources and routing. |
| Business Analyst | Elicits and refines requirements, converts Discovery outcomes into backlog items and user stories, refines acceptance criteria, and supports sprint planning, backlog traceability and UAT remediation work. |
| Migration Engineer | Application migration and integration engineering, including technical Discovery, implementation, connectivity, and test and production integration activities. |
| Okta Engineer | IdP and authentication integration, including SAML and OIDC, CAC/MFA, claim and attribute mappings, certificates, policies, configuration and authentication validation. |
| SailPoint Engineer | IGA integration, including source and connector configuration, schema, aggregation, correlation, provisioning and deprovisioning, roles, entitlements, workflows, certifications and governance capabilities. |
| Middleware Engineer | Middleware, API, connectivity, routing, transformation, and connector or integration support when the application solution requires it. |
| Test Engineer / UAT Support | Test planning, UAT readiness and coordination, test execution, results and deficiency tracking, retesting, and required test evidence. |
| Security & Release Lead | Security and release readiness, change and release coordination, production promotion, and release documentation and evidence. |
| Technical SME Group | Specialized technical consultation and escalation across designated areas, including Okta, SailPoint and automation. |
| Enablement Team | Cross-cutting enablement support, including integration, Test/QA, custom tooling, business analysis, training and related process support. |
| Operations & Support (O&S) Team | Post-enablement operations, service desk activities, operational transition, and ongoing Okta, SailPoint, cloud and related ICAM operational support. |
| Cybersecurity Team | Cybersecurity, vulnerability, risk, ISSM and security-review, and security-assurance support as the application or integration requires. |
| Shared Resources | On-demand technical, engineering, testing, security and release, and other specialized resources that supplement Pod capabilities. |
| Field Liaison Officers (FLOs) | Field and customer liaison for assigned locations, facilitating communication between supported organizations and the ICAM program. |
Support
For support with the DAF ICAM Enablement process, please email aflcmc.hnid.daficamenablement@us.af.mil.
Content last reviewed 27 October 2026. Next review due 25 January 2027.