Module 3: Identity and access management with ClearID
What PIAM adds above access control, how ClearID connects to Synergis and Entra ID, approval workflows and visitors.
- Explain what Physical Identity and Access Management (PIAM) adds above an access control system
- Describe how ClearID connects to Synergis and Entra ID
- Design approval workflows and visitor policies
3.1 PIAM in one paragraph
An access control system enforces access; a PIAM system decides who should have it. PIAM handles the identity lifecycle (joiner, mover, leaver), self-service requests, approvals by the people who own each space, policy-driven automatic access from attributes like department or role, visitor management, and periodic access reviews, all with an audit trail. Without PIAM, those decisions live in emails and spreadsheets and are executed by hand in the access control software.
3.2 What ClearID is and how it connects
Genetec ClearID is a cloud-based, self-service physical access management solution unified with Security Center Synergis. A ClearID plugin runs as a plugin role on a Security Center server (the Directory or an expansion server) and links Synergis to the ClearID cloud. Actions taken in ClearID are synchronized automatically to Synergis.
Data shared between Synergis and ClearID includes access rules, areas, cardholders, cardholder groups, credentials, schedules and visitors. When an area is created in ClearID and linked to a Security Center system, ClearID sends commands through the plugin to create it in Security Center.
3.3 Who does what in ClearID
| Role | Responsibility |
|---|---|
| Account administrator | Configures the ClearID account, sites, integrations |
| Site owner | Creates areas, configures visitor profiles for a site |
| Area owner / area manager | Defines area policies, approves or denies requests, reviews who has access |
| Role owner / role manager | Approves requests made on behalf of a role |
| Supervisor | Approves requests for their own reports |
| Identity (employee) | Requests access, invites visitors |
3.4 Access request workflows
Each area has an approval workflow and a visibility setting (public areas appear in the request catalogue; private ones are hidden).
| Workflow | Who approves |
|---|---|
| Automatic approval | Granted by a role-based policy, no human |
| Area manager or owner | The people responsible for the space |
| Role manager/owner or supervisor | The requester's management chain |
| Two-step | Role manager/owner or supervisor first, then area manager or owner |
3.5 Policy-based provisioning
Instead of approving each request, ClearID can assign access from identity attributes (for example, everyone whose department is Facilities at the Boston site gets the Mechanical Rooms area) and keep updating it as attributes change. This is attribute-based access control: when someone moves departments in Entra ID, their physical access follows without a ticket.
3.6 Visitor management
- Visit profiles per site define planned visits (invited ahead) and walk-in visits; walk-ins require at least one pre-authorized area.
- Invite permissions: everyone, or only certain roles, people with that primary site, or site owners. You can limit hosts to inviting guests only to areas they can access.
- Visit approval: none, supervisor, or custom approvers; an area chosen for the visit can trigger its own approval workflow.
- Visitors can receive instructions automatically, and a QR code credential and temporary access that are deactivated at automatic check-out.
- Optional site requirements such as ADA assistance can grant extra areas, e.g. an accessible door, only to visitors who need it.
3.7 Entra ID integration
ClearID synchronizes users and groups from Microsoft Entra ID through an app registration. You need the tenant ID, application (client) ID and a client secret, and the app needs Microsoft Graph application permissions: User.Read.All and Group.Read.All (or GroupMember.Read.All), with Application.Read.All optional for custom extension attributes.
Treat the client secret like a password and track its expiry date; an expired secret silently stops identity sync.
Common mistakes
- Making changes directly in Config Tool for entities ClearID manages, then wondering why they drift or get overwritten.
- No area owner assigned, so requests sit unapproved.
- Every area public, so employees request rooms they never need.
- Letting the Entra app secret expire.
- Using approvals for access that a clean attribute policy could grant automatically.
Check your understanding
1.What does a PIAM system add that an access control system does not?
2.Where does the ClearID plugin run?
3.Name the four ClearID area approval workflows.
4.Which Graph permissions are required for Entra ID sync?
5.What happens to a visitor's QR code at automatic check-out?