Prerequisite
OCR will need to provide you with a username, encrypted username, and encrypted password before you can connect Envoy to OCR. You will not be able to connect using unencrypted credentials. You must obtain these encrypted credentials from OCR.
OCR is provided by Descartes and your company will need to have a Descartes OCR account in order to use this integration.
How does this integration work?
The OCR integration screens Envoy invitees and visitors against the OCR EASE Watch List. When a visitor is invited or signs in with Envoy, the integration will check them against government and non-government most current restricted, denied, or prohibited party lists to ensure no business transactions occur with an entity that is prohibited by law.
Envoy logs into OCR as the SBU you specify, so we utilize the lists and settings you specify for that SBU in OCR.
In Envoy, you can configure which visitor types should be screened and who should be notified if there's a match. Visitors who are matched via the dataset will not be able to enter your workplace and will require review by your team. Learn more about Security settings for Visitors.
How visitors experience screening
Visitors will have no way of knowing whether they are being screened or have matched a restricted party. The iPad kiosk will inform the visitor that their responses are being reviewed.
What happens when there is a match?
When a visitor returns a match through the Identity Screening app, Envoy notifies the administrators you’ve designated to receive alerts. These people will receive alerts through the preferred notification channels set in their profile.
Here’s what the alerts will look like:
Using OCR with Approval workflows
Approval workflows are currently Early Access only; skip to Enabling the OCR integration.
OCR can run as a distinct step in an approval workflow policy. Learn more about using screeners with policies.
Policies work slightly differently than standard invite or entry screening. In order to use OCR with a policy:
You must install the integration at every location. Install OCR at each location that uses the policy. Integrations are installed by location, so you'll need to install it at each location one by one. If OCR is missing at a site using the policy, admins will receive a warning when saving.
Refer to the History log for results. When OCR runs as part of a policy, the standard visitor screening status (under Access Control) shows that the screener did not run. This is expected. The screener did run, and the policy log has the details on any match.
Remove the screener from any pre-existing visitor configurations. Since this screener will occur in the policy, you can remove the location-level sign-in flow from the integration. This is step 2.2 shown below. If you have sign-in flows that won't use a policy that includes OCR, be sure to leave it on!
Enabling the OCR integration
Step 1: Connect
Go to Integrations > All Integrations in the Envoy dashboard.
Search for OCR and click Install on the corresponding result.
Click Authorize to confirm permissions.
On the Connect step, enter the encrypted username and password provided to you by OCR, as well as the API endpoint for your OCR instance (should end with
/webservices/dpss), plaintext username for the Envoy user, and the SBU code for the Envoy user:
Once filled out, click Next Step.
Step 2: Configuration
Once your Envoy account is connected to OCR, you can define how Envoy uses OCR to screen visitors.
Under Alert personnel, define which employees receive notifications for flagged entries and/or invites.
Choose the Visitor types to check against the watch list. You can add all of the sign-in flows at your location, if needed.
For the Address Field, decide whether to collect the visitor's City or Full Address.
Decide what the OCR-added sign-in field will be called. The defaults are City and Address, respectively. This sign-in field will be automatically added to any applicable visitor types.
Click Complete Setup to save.