AI assistance

Operator runbook for the optional AI features in the IdentityMesh console: suggested sync rules for a connector, and plain-language explanations of failed runs and drifted connectors, and help translating Microsoft Identity Manager (MIM) policy during a migration. IdentityMesh sends a request to an AI provider you configure, with your own key, only when an operator clicks a button.

Nothing in this runbook is on by default. With AI assistance left off, IdentityMesh makes no outbound call to any AI provider.

Where it lives

Console → Settings → AI assistance tab. The tab is visible to anyone holding the roles.read permission. Changing the settings needs roles.write.

What it does

Every feature is advisory. The AI never changes a rule, retries a run or pauses a schedule by itself. You read the answer and decide.

Enterprise, off by default

AI assistance requires an Enterprise license. On any other license the tab explains that the feature is not included, and no AI request can be made. Even on Enterprise it stays off until an administrator completes the setup below.

Choosing a provider

You bring your own account. IdentityMesh supports two providers.

Claude (Anthropic)

Create an API key at console.anthropic.com and paste it into the key field. Pick a model:

Azure OpenAI

Enter your Azure OpenAI endpoint, your deployment name and the api-version (the default is 2024-10-21). Copy the key from the Azure portal.

Setting it up

Work down the AI assistance tab in this order:

1. Save. Turn the master Enabled switch on, choose the provider and model, enter the key, then click Save. The Enabled switch must be on at this first Save. IdentityMesh saves the settings, then the key. The key is stored in the configured secret provider and is never shown again. Saving a new key resets the test result.
2. Test provider. IdentityMesh makes one small request to the provider and reports success or the provider’s reason for refusing. Only a test of the saved settings with the saved key unlocks the agreement.
3. Tick the agreement. The checkbox is available only after a successful test. See the next section.
4. Switch the features on. In the Features card, switch on the features you want (suggested rules, explanations, and Translate MIM policy in the migration analyzer). They unlock after the agreement is accepted. Then click Save again.

Unticking the agreement, or switching AI off, stops every AI call at once.

Changing the provider, or pointing Azure OpenAI at a different host, withdraws the agreement, switches every feature off and deletes the stored key. Enter the key again, test, and accept the agreement for the new destination. Changing only the model, deployment or api-version keeps the agreement and asks for a new test.

Outbound hosts to allow

Calls go straight from the IdentityMesh API host to the provider. IdentityMesh never proxies them through another service. Allow outbound HTTPS from the API host to:

The IdentityMesh Engine and relay agents make no AI calls.

The data agreement

Before any feature works, an administrator must tick this agreement on the AI assistance tab. The text, verbatim:

I understand and agree that, when an operator uses an AI feature, IdentityMesh will send the configured provider: connector and mesh schema (attribute and object type names), counts, run history and log entries (which can include user names and distinguished names), and up to five sample values per attribute taken from the management space and from the mesh objects it links to. Passwords, secrets and the audit chain are never sent. Each request is written to the admin audit log.

What that means in practice:

• Schema. Names of connectors, object types and attributes.
• Counts. How many rows, adds, updates and errors.
• Run history and log lines. These can contain user names and distinguished names.
• Sample values. Up to five values per attribute, taken from the management space and from the linked mesh objects. Attributes marked sensitive are named only; their values are not sent.
• Never sent. Passwords, secrets, connector credentials and the audit chain.

If the agreement text changes in a later release, an administrator must tick it again before AI calls resume.

The agreement has a newer version that also names MIM policy content: set names and filters, policy rule names and attribute lists, workflow names, activity expressions and email templates. When the agreement version changes, every AI feature stops until an administrator re-accepts it, and the Translate MIM policy in the migration analyzer switch cannot be turned on until then. Re-accepting is a normal tick of the checkbox on the AI assistance tab.

Suggested sync rules

Open a connector in edit mode and choose Suggested rules in the rail, or click Suggest sync rules on the What next card. You need rules.write, and the connector needs at least one import first, because proposals are built from the rows it has imported.

Each proposal shows:

• the rule in the IdentityMesh transform language,
• a preview computed by IdentityMesh’s own transform engine on real imported rows, so you see actual results rather than the AI’s claim about them.

For each proposal choose Accept, Edit or Dismiss. Nothing is saved until you accept. Accept the remaining N becomes available only after you have read to the end of the list. Each accepted rule is audited as proposed by AI.

Explaining failed runs and drift

Click Explain on a failed run, or Explain drift on a drifted connector. You need runs.read. The answer shows:

• what happened,
• the evidence lines it rests on, taken from the run’s log lines and its run history, so you can check the claim,
• next steps as buttons: open the connection, retry the run (needs sync.execute), pause this connector’s schedules (needs schedules.write), open schedules, open rules.

A thumbs up or thumbs down records whether the explanation helped. Every click asks the provider again, so a second click can produce a different answer.

If a request fails, the console says why in one sentence, for example that the provider rejected the key, that the feature is off, or that there was nothing to explain.

Translating MIM policy

In the MIM migration workspace, the Service policy step lists the sets and policy rules (with their workflows) found in your MIM export and proposes an IdentityMesh equivalent for each. The parser does this on its own, with no AI call. The verdicts and the rest of the step are described on the MIM migration page, at /features/mim-migration.

The third AI switch, Translate MIM policy in the migration analyzer, adds one button: Translate with AI. You need schema.write. It fills only the items the parser could not resolve:

• attribute names that do not map one to one,
• expressions,
• names for the new objects.

What the AI never does:

• It does not decide what a set or rule means. Anything the parser can translate exactly is not sent to the model.
• It does not approximate. Negated or date-relative criteria, hand-picked set members, approvals, authentication gates and validations, delete actions, reference traversal such as the manager’s email, custom activities and request-scoped rules are reported as not translatable, never guessed.
• It never receives sample values for this feature. It sees only the policy content named in the agreement.

Every fill is checked against your live mesh and the rules language before you see it, so an attribute that does not exist or an expression that does not parse never reaches the proposal. You can edit any fill before accepting.

Accepting creates the object disabled, through the same create paths an operator uses by hand. Review it, then enable it yourself.

Every AI request and every acceptance is written to the admin audit log, with the same manifest of names and counts and a hash of what was sent.

What is audited

Every action is written to the admin audit log:

MIM policy translation requests and acceptances are audited in the same way.

An audit entry for a request holds a manifest: the attribute names and counts that were sent, and a SHA-256 of what was sent. It never holds sample values.

Cost

Usage is billed to your provider account; one request per click; nothing runs on a schedule. IdentityMesh does not add a charge.

Turning it off

Any one of these stops AI calls immediately:

• switch Enabled off,
• untick the agreement,
• clear the key: Settings → AI assistance → key → Clear key.

Rules you accepted stay in place. They are ordinary rules and no longer depend on the AI feature.

Upgrade note

The installer’s database step runs Deploy_All.sql, which adds the settings storage AI assistance needs. No separate step is required.