DocumentationConnectors

Connectors

Identity Mesh supports a wide range of identity systems through pre-built connectors and extensible APIs. Connect to cloud services, on-premises directories, databases, and custom applications.

Available Connectors

Bidirectional: Active Directory, SQL, File.Entra ID: imports users, groups, and memberships; writes back groups with their members and owners.Workday: imports workers; writes back corrections to preferred name and work email only (no hiring, termination or provisioning).Import only today: Okta (write-back on the roadmap).Coming soon: LDAP, SCIM 2.0, generic REST.

You set up every connector, bundled or custom, in the full-page connector editor. It lists the sections for the connector's type on the left, marks each finished section with a check, and keeps Test connection in the footer. See the Admin Portal guide.

Active Directory

On-Premises

Connect to on-premises Active Directory domains

User and group synchronization

Organizational unit mapping

Password hash sync support

Protocols:

LDAPLDAPSKerberos

Microsoft Entra ID

CloudGroups write-back

Import users, groups, memberships, and on-premises sync properties from Microsoft Entra ID (formerly Azure AD). Create Security and Microsoft 365 groups and manage their members and owners through Microsoft Graph. User write-back is on the roadmap.

User lifecycle management

Group membership sync

Application assignments

Protocols:

Microsoft Graph APIOAuth 2.0

Okta

CloudImport only

Import users and groups from the Okta identity platform (read-only today)

User provisioning and deprovisioning

Group management

Application assignments

Protocols:

Okta APISCIM 2.0

Workday

CloudName/email write-back

Import workers from Workday HCM for HR-driven provisioning, and write corrected preferred names and work email addresses back to Workday

Employee hire/termination events

Organizational hierarchy sync

Job profile and role mapping

Protocols:

Workday Web ServicesREST API

LDAP

On-PremisesComing Soon

Generic LDAP directory connector

Standards-compliant LDAP v3

Custom schema support

Flexible DN mapping

Protocols:

LDAPLDAPS

SCIM 2.0

CloudComing Soon

Standard SCIM 2.0 protocol connector

User and group resources

Bulk operations support

Filtering and pagination

Protocols:

SCIM 2.0OAuth 2.0

SQL Database

On-Premises

Direct database connector for custom identity stores

Custom SQL query support

Multiple database engines

Stored procedure execution

Protocols:

MySQLPostgreSQLSQL ServerOracle

File (CSV/TXT)

On-Premises

Import identity data from CSV, TSV, and delimited text files

CSV, TSV, pipe-delimited, and custom separators

RFC 4180 compliant with text qualifier support

UNC path and file hash delta detection

Formats:

CSVTSVTXTUTF-8

REST API

CloudComing Soon

Generic REST API connector for custom integrations

Custom endpoint configuration

Flexible authentication methods

JSON/XML payload support

Protocols:

RESTOAuth 2.0API KeyBasic Auth

Configuration Examples

Active Directory

Connect to on-premises Active Directory using LDAPS protocol with service account credentials.

{
  "connectorType": "active-directory",
  "name": "Corporate AD",
  "config": {
    "domain": "corp.example.com",
    "ldapUrl": "ldaps://dc01.corp.example.com:636",
    "baseDn": "DC=corp,DC=example,DC=com",
    "bindDn": "CN=SyncService,OU=ServiceAccounts,DC=corp,DC=example,DC=com",
    "bindPassword": "${SECRET:ad_bind_password}",
    "searchFilter": "(&amp;(objectClass=user)(objectCategory=person))",
    "attributes": [
      "sAMAccountName",
      "userPrincipalName",
      "displayName",
      "mail",
      "memberOf"
    ],
    "enableDeltaSync": true,
    "syncIntervalMinutes": 15
  }
}

Prerequisites

• Service account with read permissions on target OUs
• LDAPS enabled on domain controllers (port 636)
• Network connectivity from Identity Mesh agent to DC
• Valid SSL certificate on domain controller

Microsoft Entra ID (Users import, groups write-back)

Sync with Microsoft Entra ID (Azure AD) using Microsoft Graph API with OAuth 2.0 authentication.

{
  "connectorType": "entra-id",
  "name": "Azure AD Production",
  "config": {
    "tenantId": "12345678-1234-1234-1234-123456789abc",
    "clientId": "87654321-4321-4321-4321-cba987654321",
    "clientSecret": "${SECRET:entra_client_secret}",
    "scopes": [
      "User.Read.All",
      "Group.Read.All",
      "Directory.Read.All"
    ],
    "filterGroups": [
      "All-Employees",
      "Contractors"
    ],
    "enableDeltaSync": true,
    "syncIntervalMinutes": 10
  }
}

Required API Permissions

• User.Read.All (Application permission)
• Group.Read.All (Application permission)
• Directory.Read.All (Application permission)
• Admin consent granted by Global Administrator

Membership setup

1. Create the connector.
2. Open Rules, expand the connector, click From Template, and apply Entra ID users and groups.
3. Run a full import.

Group membership then appears as member relationships on each group, which the vault and self-service group features read. Without the template the group's imported member list is never resolved into relationships, because cloud-only objects must anchor on the directory id and the inbound member flow must exist. In a hybrid tenant, users and groups that Entra Connect synchronises from Active Directory (onPremisesSyncEnabled) are joined to their AD-mastered mesh object on onPremisesSecurityIdentifier, then onPremisesSamAccountName, and are never anchored, renamed, or re-membered from the cloud; the connector always selects all three properties. See Sync Rule Templates for what the template creates.

Okta (Import only)

Integrate with Okta using API tokens for user and group synchronization.

{
  "connectorType": "okta",
  "name": "Okta Production",
  "config": {
    "domain": "example.okta.com",
    "apiToken": "${SECRET:okta_api_token}",
    "includeGroups": true,
    "includeAppAssignments": true,
    "filterExpression": "status eq \"ACTIVE\"",
    "enableDeltaSync": true,
    "syncIntervalMinutes": 10
  }
}

API Token Requirements

• Create API token in Okta Admin Console
• Token must have read permissions for Users and Groups
• Store token securely in Identity Mesh secrets
• Rotate tokens regularly per security policy

Membership setup

1. Create the connector.
2. Open Rules, expand the connector, click From Template, and apply Okta users and groups.
3. Run a full import.

File (CSV/TXT)

Import identity data from CSV or delimited text files exported from HR systems, spreadsheets, or third-party applications.

{
  "connectorType": "file",
  "name": "HR CSV Import",
  "config": {
    "FilePath": "\\\\fileserver\\shares\\hr-export\\employees.csv",
    "Delimiter": ",",
    "HasHeader": true,
    "Encoding": "UTF8",
    "ExternalIdColumn": "EmployeeId",
    "ObjectType": "User",
    "TextQualifier": "\"",
    "SkipEmptyLines": true,
    "ColumnsToLoad": [
      "EmployeeId",
      "FirstName",
      "LastName",
      "Email",
      "Department",
      "Title",
      "Manager"
    ]
  }
}

Supported Formats

• CSV (comma-separated), TSV (tab-separated), pipe-delimited
• Custom delimiters via the Delimiter setting
• UNC paths for network file shares (e.g., \\server\share\file.csv)
• Delta detection via SHA-256 file hash — unchanged files are skipped
• Export mode: overwrite or append rows back to the file

Deployment Models

Cloud Service Connectors

Connectors that run on your Identity Mesh sync engine and reach cloud services over their public APIs.

No agent installation required
Outbound HTTPS from the engine host; no inbound ports
OAuth 2.0 and API token authentication
Suitable for: Entra ID, Okta, Workday, SCIM

Agent-Based Connectors

Lightweight relay agents, installed by their own MSI on a host in your network, run the connector next to the on-premises system. See Relay Agent.

Secure outbound-only connections
No inbound firewall rules required
Local credential storage
Suitable for: Active Directory, LDAP, SQL

Testing Connections

After configuring a connector, test the connection to verify credentials and network connectivity. In the Admin Portal, open the connector under Connectors and click Test Connection. The test runs on the host that will run the connector (the sync engine, or the assigned relay agent) and the result is shown in the form:

Connection successful (ran on engine: IMSYNC01)

or, on failure, the error returned by the target system, for example:
Connection failed: The LDAP server is unavailable. (ran on relay: HQ-RELAY-01)

Authentication

Verifies credentials and permissions

Connectivity

Tests network access and latency

Data Access

Confirms ability to read identity data

Next Steps

Policy Rules

Learn how to create sync policies and transform data between connectors

Getting Started

Follow our step-by-step guide to set up your first sync

Request Demo

Schedule a demo to see connectors in action with your systems

Need a Custom Connector?

Build your own with the Connector SDK: one .NET class, two methods, deployed by copying a DLL. The SDK ships with IdentityMesh. Open Connectors in your IdentityMesh console and click Download Connector SDK to get the NuGet package, a complete sample connector with tests, and the licence, in a zip that builds offline with nothing but the .NET 10 SDK. From SDK 1.4, your connector can describe its own settings, and the connector editor draws a proper form for them instead of raw settings text. The runbook takes you from there to a running connector. Or ask us to build it for a proprietary system.

Custom Connector Runbook Contact Us