Banner-Driven IT Onboarding for Staff, Faculty, & Students

Yes. Ellucian Banner can act as the authoritative source for identity, and Aquera reads it through Ellucian Ethos Integration to create, update, and disable accounts in any directory you run. Banner already holds the record that decides who belongs to the institution and in what role (student, applicant, faculty, staff, or affiliate), so it is the natural system of record. Aquera resolves that record into one identity per person and applies policy to decide the account, organizational unit, groups, and licenses.

Yes. Aquera provides a prebuilt Ellucian Banner connector that provisions campus identities into Okta, on-premises Active Directory, Microsoft Entra ID, and any other directory. It reads Banner exclusively through Ellucian Ethos Integration, and it provisions into any directory rather than a fixed list of three. Aquera is also listed on the Microsoft commercial marketplace for Ellucian Banner synchronization with Active Directory and Entra ID.

Yes. Ethos Integration is a prerequisite, because Aquera reads Banner exclusively through Ethos and does not connect to the Banner database directly. Ethos must be licensed and enabled, and the API key permissioned for the resources your populations require. We confirm that resource set during scoping, and if Ethos is not in place, we will tell you on the first call.

Yes, and it extends further than those two. One Banner read and one policy model can feed Okta, Entra ID, Active Directory, Google Workspace, and an LDAP directory simultaneously, which matters because every directory in the estate has to agree. Maintaining two separate scripts against the same Banner data is where institutions most often find the directories drifting apart.

Yes, and hybrid is the most common higher-education topology. In a hybrid estate the account must be born in the correct on-premises organizational unit and then flow to the cloud through directory synchronization. Aquera writes to the on-premises directory with correct placement and attributes so the cloud object arrives correct, rather than being repaired after the fact.

Any directory. Okta, on-premises Active Directory, and Microsoft Entra ID are the most common in higher education and are where most institutions start. The same engine also provisions Google Workspace, AD LDS, JumpCloud, and any LDAP or SCIM directory, so hybrid and multi-directory estates need no second integration.

Aquera reads the available resources from your Ethos tenant and pins the version of each resource your institution actually runs. This matters because Ethos resources are versioned individually and requested through the Accept header, and those versions differ by resource and by institution. A hard-coded Accept header is the single most common reason a homegrown Banner integration breaks at the next upgrade.

Drift is any difference between what policy says access should be and what the directory actually grants: an account that outlived its Banner record, a group membership added by hand, a license never reclaimed. It is detected by reading each directory back and comparing it against Banner, which is precisely what push-only scripts never do. Detected drift can be reported for review or corrected automatically.

A person who is both a student and an employee is correlated into a single identity that carries both roles, and the entitlement set is the union of what each role grants. This is a common failure of script-based provisioning, which typically runs a student job and an employee job independently and produces two accounts for the same person, with two licenses, two mailboxes, and two things to remember to disable.

Near-immediately. Change-driven synchronization means the disable action follows the Banner change rather than waiting for a nightly cycle, so removal happens as the record changes rather than hours or days later. The gap between a separation and the account actually closing is the number auditors and cyber-insurance questionnaires ask about most, and it is the clearest before-and-after measure of a provisioning project.

Because the connector already exists, the first population is typically live in weeks rather than quarters. Timeline is driven far more by institutional factors than by technical ones: how many populations are in scope, whether naming and placement rules are documented or held in someone's head, how long vendor security review takes, and how quickly test data can be agreed. Institutions that start by writing down their existing rules move noticeably faster.

Pricing depends on the populations in scope, the directories targeted, and whether the Aquera SCIM Gateway is added for downstream applications, so there is no single list price to quote. Talk to Aquera for a scoped estimate based on your environment.