-- Azure IAM, LLC, an identity and access management consultancy based in Las Cruces, New Mexico, has published details of how its Microsoft Identity Manager to SailPoint IdentityIQ migration service handles the most sensitive material in any identity estate: the credentials behind every connector. The short answer is that it never handles them at all. Service details are available at https://azureiam.com/mim-to-sailpoint
The overlooked risk in an identity migration
A MIM management agent connects to Active Directory, HR systems, databases, and cloud directories using service accounts that typically hold the broadest write access in the organization. In a conventional migration, those accounts get copied into spreadsheets, pasted into tickets, and carried on consultant laptops so a new platform can be wired up by hand. Every copy is a place for a secret to leak, and every copy outlives the project. For defense, government, and regulated customers, that sprawl is often a bigger audit finding than the aging platform being replaced.
Starting from a document that contains no secrets
Azure IAM's transformation begins with the MIM Configuration Documenter report, the standard export that captures every management agent, attribute flow, synchronization rule, set, workflow, and policy in the estate. By design, the Documenter never includes credentials. That makes it the safest possible input for a migration, because the consultant receives the complete logic of the system without receiving a single password, key, or certificate.
Placeholder tokens instead of passwords
Each management agent in the report becomes an IdentityIQ Application in the generated build. Where a connector needs a credential, the build carries a clearly named placeholder token in its place. The customer's own administrator supplies the real value inside IdentityIQ after import, in the environment where the secret already lives and under the controls that already govern it. The secret never crosses an email, a file share, or a vendor system, and the delivered archive can be reviewed, versioned, and audited without any risk of exposing one.
Credential decisions are never guessed
The translation is deterministic and refuses to invent what it cannot prove. Destructive actions and credential decisions require explicit human confirmation before they are written into the build. Lifecycle pairs are classified as joiner, mover, or leaver and placed in front of a person to confirm. Anything the tool cannot translate with certainty is delivered as a clearly marked scaffold with the reason recorded in a caveats file, rather than an approximation that might quietly grant or remove access.
Parallel runs that cannot reach production
Before cutover, MIM and IdentityIQ run side by side against the same sources. IdentityIQ aggregates, evaluates its roles and policies, and produces the provisioning it would send, but nothing it generates reaches a connected system until the customer cuts over. The comparison confirms that Active Directory group membership produced through IdentityIQ roles matches what MIM produced, so the new platform is proven correct before it is ever trusted with a live credential.
Why this matters for regulated estates
Defense, education, healthcare, and financial organizations running MIM face end of support pressure and compliance deadlines at the same time. A migration that keeps secrets inside the customer boundary, documents every translation decision, and prices the work as a fixed fee from documented scope removes three of the objections that usually stall these projects. Azure IAM has consulted on Entra ID, SailPoint IdentityIQ, Okta, and MIM environments since 2013 across corporate, defense, intelligence, and education sectors. More information is available at https://azureiam.com/
Azure IAM, LLC is not affiliated with, sponsored by, or endorsed by Microsoft Corporation or SailPoint Technologies.
Contact Info:
Name: Robin Lilly
Email: Send Email
Organization: Azure IAM, LLC
Address: 2521 North Main Unit 1-276, Las Cruces, New Mexico 88001, United States
Website: https://azureiam.com
Release ID: 89202534