Why Identity Mesh
Three decisions most identity teams are facing right now, and where we land on each.
We would rather you choose us for the right reasons than for a slide. So each section below says what the alternative does well, what Identity Mesh does differently, and where we say no.
Decision one
What replaces the identity platform you run today
Most estates run an identity manager that is older than the people operating it. Every vendor's answer is the same: move to our cloud suite and re-model from scratch. Identity Mesh is built the other way round. It is designed to migrate identity platforms into it, automatically wherever a connector can carry the flow, and to tell you before you sign which parts cannot.
Microsoft Identity Manager is first, because it runs a great deal of on-premises provisioning and Microsoft's extended support for it ends in 2029 with no on-premises successor. Its replacement, Entra ID Governance, is a cloud product for a different estate. The other platforms follow the same pattern.
Identity Mesh was founded by David Steadman: years in the identity community, a former member of the MIM product group at Microsoft, and co-author of the Microsoft Identity Manager 2016 Handbook. That is a long time watching customers pay for identity management twice, once for the product and once for the people to make it work, and then again for every knob and switch on the price list. The founding view is simple: the cloud does not solve everything, you should not have to pay through the nose for identity management, and the product is one price with the features in it, not a catalogue of modules.
Where the alternatives are strong
Staying put costs nothing new, the team knows the tooling, and MIM in particular is supported until 2029. Each vendor's cloud successor is the right answer for an estate whose applications and groups are already cloud-first, and it is the only path with that vendor's full weight behind it.
What Identity Mesh does differently
- Migration is a product feature, not a services engagement. The migration analyzer reads your platform's export, grades every agent and flow, and returns a verdict before any contract is signed. What ports automatically, ports automatically.
- MIM is the first platform the analyzer understands. Analyzers for the others follow the same pattern: read the export, grade the flows, port what the connectors can carry. Tell us which platform you run.
- Same shape as the sync engines you already know: connectors in place of management agents, projection rules in place of sync rules, and Composer for derived groups. Your team's mental model carries over.
- Self-service groups give the MIM Portal's owner-managed group workflow a home, including join approval, expiry, and dual control for high-impact groups.
- Watermark delta sync means a 50,000-object directory is processed by what changed, not re-read on every run.
Where we say no
Today the analyzer reads MIM exports only; other platforms are assessed by hand until their analyzer ships. Custom MIM ECMA2 agents do not port; they need a connector built with the Connector SDK. Okta is import-only today, and Workday writes back only preferred name and work email. Self-service groups and Entra group write-back are new in this release, so try them against a test directory before pointing them at production.
Decision two
Does the vault belong in the identity platform
The usual pattern is a governance suite plus a separate PAM vendor. Two products, two integrations, two audit trails, and a permissions model that has to be rebuilt in the second one.
Where the alternatives are strong
CyberArk and Delinea are deep PAM products: session isolation and recording, endpoint privilege management, discovery across the estate. If you need those, you need one of them.
What Identity Mesh does differently
- Vault is part of the same product: privileged checkout, blind or owner-provided rotation, and one-time credential links, for accounts the connectors already represent.
- A checked-out account can be used through IdentityMesh Connect, a small launcher on the operator's PC that opens a Remote Desktop session as the account straight from the portal. The password is never shown to anyone.
- Who may check an account out is derived from mesh group membership. There is no second permissions model to keep in step.
- Vault events join the same tamper-evident audit chain as sync and admin events, so one export answers the auditor.
- Rotation targets today: Active Directory, SQL Server logins, and Entra ID passwords through Graph.
Where we say no
No session proxying or recording, no endpoint privilege management, and no discovery beyond what a connector imports. If a PAM checklist needs those lines ticked, Vault is a complement to a PAM product, not a replacement.
Decision three
Should identity data leave the building
Most governance suites are SaaS, and for many estates that is fine. The question is a narrower one: may the full attribute set of every person, the passwords of every service account, and the audit trail of who changed what, live in a vendor's tenant? For HR data, regulated industries, defence, and anyone with a data-residency obligation, the answer is often no, and it is not a question the vendor can answer for you.
Where the alternatives are strong
Nothing to patch, nothing to back up, and a broad catalogue of SaaS application connectors that an on-premises product will not match. If your sources and targets are all cloud services already, the data has left the building regardless.
What Identity Mesh does differently
- The mesh is a database on your SQL Server. Every identity, every attribute, every link, every audit row. Back it up with the tools you already use.
- Connectors run inside your network. A remote or firewalled site gets a relay agent so the connector sits next to the system it talks to, and only the changes travel.
- Secrets are encrypted and bound to the host that wrote them, or held in HashiCorp Vault or Azure Key Vault. Password attributes are redacted at rest, in the API, and in the portal.
- Administrators sign in with Windows integrated authentication against your own Active Directory. Air-gapped deployment is supported.
- The audit chain stays in your database and forwards to your SIEM. Subject-access and erasure requests are handled by a runbook you run, not a ticket you raise with a vendor.
Where we say no
Windows Server and SQL Server only, and you run the backups, the patching and the certificate renewals. The runbooks tell you how, but they do not do it for you. There is no hosted edition, and the SaaS application catalogue is smaller: LDAP and SCIM connectors are still coming.
Side by side
Competitor columns describe product categories in general terms. Check them against your own quotes; we will help you model the comparison.
| Criterion | Identity Mesh | Stay on MIM | Entra ID Governance | Governance suite + PAM vendor |
|---|---|---|---|---|
| Deployment | Your Windows servers, your SQL Server. Identity data never leaves the network. | On-premises, same shape. Extended support ends in 2029, with no successor from Microsoft for on-premises sync. | Cloud service. On-premises AD reached through Entra Connect; other on-premises sources need custom work. | Usually SaaS. Identity data and secrets live in the vendor cloud. |
| Sync model | Bidirectional connectors, watermark delta sync, projection rules and Composer. The MIM mental model without the MIM tooling. | Management agents, sync rules, run profiles. Full imports are the norm; deltas depend on the agent. | Cloud-first. Provisioning flows out to SaaS apps; on-premises writeback is limited to specific attributes. | Connector catalogues aimed at SaaS apps. On-premises AD and SQL are supported but rarely the centre of gravity. |
| Migration path | Analyzer reads the platform export and returns a verdict per agent and flow before you sign. Automatic port where the connector capability exists. MIM first; other platforms follow the same pattern. | Nothing to move. Nothing gained, and the 2029 deadline stays. | Re-model from scratch. MIM flows do not port. | Re-model from scratch, usually with a services engagement. |
| Privileged vault | Included. Checkout, rotation for AD, SQL Server and Entra ID, scopes derived from mesh group membership, one audit chain. | None. | None. Privileged Identity Management covers Entra roles, not credentials for on-premises accounts. | A second vendor. SailPoint and Omada integrate with CyberArk or Delinea rather than shipping a vault. |
| Self-service groups | Owner-managed AD and Entra groups with join approval, dual control for high-impact groups, expiry and restore. New in this release. | The MIM Portal. Familiar, and the reason many customers cannot leave. | Entra group self-service for cloud groups. On-premises groups require writeback. | Access requests through the suite portal, provisioned into the directory afterwards. |
| Audit | Tamper-evident hash chain across sync, admin, group and vault events. Before and after values. SIEM forwarding built in. | Run history and the Portal request log. No chain. | Entra audit logs, retained per licence. | Suite audit for what the suite did. The vault, if any, keeps its own. |
| Pricing | One published price per identity with connectors, Vault, transforms, audit and SIEM in it. No per-module add-ons; tiers scale by size and support. Free 30-day Starter. | Bundled with older Windows Server CALs. The cost is the people who still know it. | Per user per month on top of the Entra tier. Governance features sit in the higher add-on. | By quote. Modules and connectors are often priced separately, and the PAM vendor bills again. |
Decide on evidence
Send us a MIM export and get the analyzer's verdict back. Or tell us what you are connecting and we will say plainly whether Identity Mesh does it today.