Enterprise-Grade Identity Synchronization

Process only what changed with watermark-based change detection — uSNChanged for Active Directory, configurable delta columns for SQL Server, and SHA-256 file hash for CSV/TXT files.

Seamlessly sync identities in both directions with conflict resolution and authoritative source management.

Define attribute mappings, transformations, and business rules with a safe transform engine — no eval, no arbitrary code execution.

Complete audit trails with before/after values, run history per connector, and a UI-based audit viewer for all identity changes.

Every audit row is hash-chained with SHA-256 — a single broken link signals post-hoc tampering. Chain integrity verification surfaces the exact row a rogue admin would have to forge to hide their tracks.

Data Subject Access Requests and right-to-erasure are handled by dedicated Admin API endpoints. Erasure events ship through the chained audit trail so the act-of-erasure is itself non-repudiable evidence — exactly what GDPR Article 17 and SOC 2 Privacy auditors ask for.

Connector credentials never live on disk in plaintext. Choose the secret store that fits your environment — DPAPI on the host, Azure Key Vault for Azure-native deployments, HashiCorp Vault for non-Azure shops — chosen on the Settings → Secrets page of the Admin Portal.

Five forwarding paths cover every common SIEM. Splunk, QRadar, ArcSight, Sentinel, Graylog — pick the transport your collector already speaks instead of building a custom pipeline.

Documented STRIDE threat model, SOC 2 Trust Service Criteria mapping, ISO 27001:2022 Annex A gap analysis, and an incident-response runbook structured around NIST SP 800-61 — answers the auditor questions before they ask.

Run the Admin portal under Windows Integrated Authentication for domain-joined deployments, Entra ID MSAL for cloud-native, or both at once — each request is routed by the credential type the browser presents.

Privileged checkout, rotation, and tamper-evident audit built into the platform you already deploy for synchronization. Stop buying PAM as a second product.

Owner-managed Active Directory and Entra ID groups. Users create groups within policy, others request to join, owners approve, and the mesh provisions the result through the connectors you already run.

Analyze a Microsoft Identity Manager export before you commit. The analyzer gives a verdict with reasons, proposes connectors and flows with evidence, and saves the plan as a migration project in the Admin Portal.

Act the moment an object enters or leaves a Composer group, a group whose members are set by a rule. A workflow can add it to another group, set attributes, send an email, or tell another system with a signed webhook. You build it in a visual designer.

Optional help in the console. Get suggested sync rules for a connector, and a plain-language explanation when a run fails or a connector drifts. It uses your own AI account and never acts on its own.

Set up every connector on one full page: a list of sections on the left, a check mark on each finished section, and Test connection in the footer. Build your own connector on the same SDK the bundled connectors use. Download it from the console, and your connector can describe its own settings so the editor draws a proper form for them.

Step in on a single account without touching the rest. Isolate freezes one account while you investigate. Disconnect unlinks an account from the wrong person, or from someone who has left.

Make the console look like yours. Set the product name, logo and colours once, and everyone in your organization sees them. With nothing saved, the console looks exactly as shipped.

Know that every sync was complete. Identity Mesh compares what it holds with what the last full import saw, and with a fresh count taken from the source system itself.

One Windows event log for the whole product. When something looks wrong, open Event Viewer and see every warning and error in one place, labelled with the component that raised it.