Fly Server must use an approved DoW enterprise identity, credential, and access management (ICAM) solution to uniquely identify and authenticate organizational users.

To ensure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system. This is typically accomplished via the use of a user store, which is either local (OS-based) or centralized (LDAP) in nature. However, DODI 8520.03 now requires that applications use an approved DoW enterprise (E-ICAM) solution whenever the ICAM solution addresses information system needs. Where the ICAM solution has been evaluated and found to not meet the needs of information system owners, information system owners must reevaluate decisions to use locally managed solutions and transition to DoW enterprise ICAM solutions to the maximum extent possible as the enterprise ICAM solutions mature. Satisfies: SRG-APP-000155, SRG-APP-000023, SRG-APP-000149, SRG-APP-000150, SRG-APP-000154, SRG-APP-000156, SRG-APP-000174, SRG-APP-000318, SRG-APP-000334, SRG-APP-000391, SRG-APP-000392, SRG-APP-000402, SRG-APP-000403, SRG-APP-000404, SRG-APP-000405, SRG-APP-000461, SRG-APP-000700, SRG-APP-000705, SRG-APP-000710, SRG-APP-000740, SRG-APP-000820, SRG-APP-000825, SRG-APP-000830, SRG-APP-000875, SRG-APP-000960, SRG-APP-000965, SRG-APP-000970, SRG-APP-000975, SRG-APP-000980, SRG-APP-000985, SRG-APP-000990, SRG-APP-000995, SRG-APP-001000, SRG-APP-000148, SRG-APP-000153, SRG-APP-000157, SRG-APP-000212, SRG-APP-000389, SRG-APP-000175, SRG-APP-000176, SRG-APP-000177, SRG-APP-000395, SRG-APP-000400, SRG-APP-000401, SRG-APP-001005, SRG-APP-001010, SRG-APP-001015, SRG-APP-001020, SRG-APP-001025

Fly Server must be integrated with Active Directory (AD) and Azure AD (AAD) for automated account management. Check the Fly Server Account Manager setting to verify AD Integration or AAD Integration is enabled: - Log on to Fly Server with an admin account. - On the Management >> Account Manager page, click "Authentication Manager". - Navigate to AD Integration or AAD Integration. - Verify the AD Integration or AAD Integration option is enabled. If the AD Integration or AAD Integration option is not enabled, this is a finding.

Configure the Fly Server Account Manager setting to ensure AD Integration or AAD Integration is enabled: - Log on to Fly Server with an admin account. - On the Management >> Account Manager page, click "Authentication Manager". - Navigate to AD Integration or AAD Integration. - Set the Action of AD Integration or AAD Integration to "Enable". - Add an AD domain after AD integration is enabled. - Save the setting. Add AD user/group or AAD user/group to Account Manager; realize automated mechanisms through AD or AAD account management functions.