Industry migration
Overview
Following NEIDAM Go-Live/Cutover, organisations will progressively transition their users from existing access arrangements to the new NEIDAM identity and access-management arrangements.
Industry Migration is planned to commence from July 2027, following stabilisation and pilot activities, and continue through to May 2028. Organisations will be able to choose their migration approach and will nominate their preference timing within the migration window.
There are three Industry Migration approaches:
- Federation
- Bulk Provisioning
- Progressive Migration
Choosing your Industry Migration Approach
Different organisations will have different access arrangements, technical environments and migration requirements.
NEIDAM therefore provides three migration approaches, depending on suitability for each organisation.
Federation
Your organisation manages access using its own Identity Provider
Federation enables an organisation to manage the provisioning of access and use its own trusted Identity Provider (IdP) for authentication.
When Federation is enabled during Industry Migration, legacy identities will be disabled and replaced with identities provisioned by the organisation through its Identity Provider.
Organisations choosing Federation will need to coordinate with AEMO to establish the necessary Federation arrangements.
Bulk Provisioning
Move a defined group of users and roles together
Bulk Provisioning allows organisations to replace legacy identities with a set of new identities specified by the organisation.
Administrators upload a file containing:
- the identities to be created
- the roles to be assigned
Progressive Migration
Users progressively transition when they next log in
Progressive Migration provides a self-service approach for users transitioning to the new role-based solution.
Once Progressive Migration is activated for the relevant users, they will be redirected to the enrolment workflow the next time they log in.
Which migration approach is right for my organisation?
The appropriate Industry Migration approach will depend on your organisation's circumstances and access arrangements.
When considering the available approaches, organisations should review how each option would operate within their environment and the activities required to prepare for migration.
AEMO will provide supporting guidance for the available migration approaches as Industry Migration planning progresses.
When will my organisation migrate?
Industry Migration is planned to run from July 2027 to May 2028. In planning the final industry migration schedule, AEMO will endeavour to accommodate your organisation’s preferred migration window while also considering volume and available support.
| Timing | Transition activity | What this means |
|---|---|---|
| 2 May 2027 | NEIDAM Go-Live/Cutover | NEIDAM goes live. This is separate from Industry Migration. |
| Following go-live | Stabilisation and pilots | Stabilisation and pilot activities take place before broader Industry Migration begins. |
| From July 2027 | Industry Migration commences | Organisations progressively begin transitioning users to the new NEIDAM access arrangements. |
| July 2027 - May 2028 | Industry Migration window | Organisations migrate within this period using their selected migration approach and timing. |
| May 2028 | Industry Migration completed | The Industry Migration period concludes. Legacy user accounts that have not migrated will be disabled. |
Separating administrator and business access
NEIDAM will allow organisations to separate administrative activities from business activities.
This is known as Segregation of Duties (SoD) and is intended to reduce the risks associated with one user performing both administrative and business functions.
After Industry Migration, organisations will initially be established with full Segregation of Duties. Under this setting, Organisation Administrators and Participant Administrators cannot also hold business-user roles.
Your organisation's options:
| Setting | What it means |
|---|---|
| Full Segregation of Duties | Administrative and business roles remain separate. Organisation Administrators and Participant Administrators cannot hold business-user roles. |
| Partial Segregation of Duties | Segregation of Duties remains enforced for Organisation Administrators. Participant Administrators can hold both administrative and business-user roles. |
| No Segregation of Duties | Organisation Administrators and Participant Administrators can hold administrative and business-user roles. |
The Organisation Administrator can select the applicable setting for the organisation. Where an organisation partially or completely removes Segregation of Duties, the Organisation Administrator will need to acknowledge and accept the associated risks on behalf of the organisation. The selected setting applies across all Participant IDs under that System Access Organisation.
Where Segregation of Duties is not fully enforced, an Organisation Administrator or Participant Administrator may be assigned both administrative and business roles. This arrangement is referred to as a dual persona.
The user can switch between:
- Administrative access - for administration activities
- Business access - for business transactions
The two sets of privileges cannot be used simultaneously. When switching from a business persona to an administrative persona, the user will be required to re-authenticate.
Multi-Factor Authentication
As part of the uplift to existing security and access controls, Multi-Factor Authentication (MFA) will be used to provide an additional layer of security when accessing AEMO services. MFA authentication controls will apply after Industry Migration.
MFA authentication will be required each time a user logs in to the Markets and Application portals.
Supported MFA Methods
AEMO supports the following MFA methods:
- Passkey
- Push notification
- Authenticator app (TOTP)
- SMS one-time password (OTP)
- Email one-time password (OTP)
User Registration with MFA
During the user registration process, non-federated users will be asked to set up at least one MFA method. AEMO recommends setting up multiple MFA methods to ensure continued connection to AEMO systems. (An MFA step-by-step guide will be made available).
For federated users, authentication, including MFA, will be managed through their organisation’s trusted Identity Provider.
Email domains (whitelisting)
As part of System Access Organisation (SAO) establishment, each organisation will need to nominate an organisational email domain, which will be used as the initial entry in the Organisation's email domain whitelist.
The organisational email domain must be under the full control of the SAO. The email domain used for the OA must adhere to this initial whitelist entry. Once the OA has been created, they will be able to maintain the whitelist in External IDAM and add more organisational email domains as required. This helps ensure that user accounts are associated with the right organisation and that access is only established for users with an approved organisation email domain.