Get off
MIM.

What you get

A working IdentityIQ site that does what your MIM does, so you can retire MIM.

Not a pile of documentation about your MIM. Not a greenfield rebuild that happens to sit near it. We build the package and we do the creation into the new site. You are not handed a zip and wished well.

Migrating MIM is a discovery problem before it is an engineering problem. The configuration is spread across a synchronization service, a policy service, a portal, and compiled .NET assemblies nobody has opened in years. Most of the cost, and nearly all of the risk, is in finding out what the current system actually does before anyone can rebuild or replace it. That is the part we automated.

Is it perfect? No. What it is: you are off a product with a support end date, running a system that does what MIM was doing.

Watch it work

The role conversion, running end to end. MIM security groups, distribution groups, and criteria based sets becoming SailPoint business roles and IT roles.

Watch the demonstration, 29 min

What the demonstration covers:

• Dynamic groups, not just static ones. Most MIM groups are built from criteria and sets rather than fixed membership lists. Those are the hard ones, and they are what the conversion is built around.
• The model difference. In MIM, group membership is the product of set criteria and policy, and nothing expresses why somebody has access. IdentityIQ splits that: IT roles carry the entitlement and hold the distinguished name of the AD group, business roles carry the meaning and are what a manager or a certification campaign actually sees.
• XPath becoming SailPoint selectors, including the awkward cases: attribute renames, case sensitivity, and the reversed logic between the Active Directory userAccountControl flag and the IdentityIQ disabled flag.
• Verification against Active Directory. Group membership produced through IdentityIQ roles is compared against what MIM actually produced.

A full migration walkthrough is in production.

What this takes from you

Less than you would expect, and we would rather you know before the call than after.

Your people, for a working session. A few hours with whoever actually knows your joiner, mover and leaver process. This is the only part nobody can do for you, and it is the part that decides whether the result behaves correctly.

Answers to a guided wizard. It scales with your environment. Microsoft's own Contoso Pilot estate produces ten screens and 46 questions, covering scope, correlation and join, joiner, mover, leaver and workflows. Each question arrives prepopulated from your own reports, with the evidence behind it and a confidence score, because MIM spreads one lifecycle event across several policy rules and workflows and consolidating them is a design decision, not a lookup.

Your MIM configuration, exported by your team. The MIM Configuration Documenter sync and service reports, your portal sets and groups, and your connector configuration. Microsoft's own tool, run by your people, on your network.

Your rules-extension source, if you still have it. Most estates do not. The developers left and the project files went with them. We decompile your assemblies, recover the logic, and translate it like any other input. Your own code, from your own binaries, recovered at your direction.

Nothing leaves your network before there is an agreement. When it does, reports are processed in memory and never stored, nothing is written to disk, and nothing is logged.

That is the whole demand on your team, and it is measured in days.

What comes across

Email templates and the workflows attached to them move together, which matters more than it sounds. Notifications are usually where a migration quietly loses behavior.

The part that refuses to guess

Every piece of MIM logic is either translated faithfully or left as a clearly marked scaffold with the reason recorded. Nothing is approximated.

A subtly wrong attribute rule produces a wrong username or a wrong distinguished name that looks entirely correct in the output and surfaces weeks later in production. So the expression translator supports 70 of the 87 MIM Workflow Activity Library functions and refuses the other 17 on purpose, each with a message explaining why. The .NET translator parses C# with a real grammar specifically so it can detect and decline what it cannot honor.

A scaffold is an honest deliverable. Confidently wrong identity logic is not.

Parsers where it matters, AI where it helps

The translation is done by parsers, not by pattern matching and not by a language model, so the same input always produces the same output. That covers expressions, .NET rules extensions, the groups to roles conversion, and the system documentation.

AI is used in one place, the lifecycle design wizard, where the work is a design conversation rather than a translation.

Parsers where a wrong answer is a wrong distinguished name in production. AI where the work is a design conversation. Never the other way around.

We prove it matches before you switch off MIM

The worry is never really whether the configuration moves. It is whether the new system produces the same answers as the old one.

We run MIM and IdentityIQ side by side. During the parallel run MIM is the only system provisioning to downstream systems. IdentityIQ aggregates, evaluates, and produces the provisioning it would send, but nothing it generates reaches a connected system until you cut over. Parallel running is how you get off MIM, not a period where two systems write to the same targets.

While both are live, Active Directory group membership is verified as unchanged: the groups a user ends up in through IdentityIQ roles are checked against the groups MIM put them in. Connector output is compared too, so what IdentityIQ would send to each connected system is measured against what MIM actually sends, and a difference surfaces in parallel running rather than in production.

MIM stays up, still provisioning, until that comparison satisfies you. You decommission it because you have evidence, not because a project plan says the cutover date arrived.

Fixed fee

We quote a fixed fee, because the scope is not a matter of opinion. It is whatever your MIM does today, moved. That boundary is what makes a fixed price honest.

This is a migration, not a redesign. If you want IdentityIQ to do something MIM never did, that is a different project. It is billed hourly, it extends the schedule, and we will tell you plainly which one you are asking for before you sign anything.

Get off MIM first. Improve second. Trying to do both at once is how these projects turn into years.

What this does not do

Stated plainly, because the honest list is what makes the rest credible.

• It does not replace a consultant. It removes the discovery and transcription work so the engagement is spent on design decisions.
• It does not invent schedules, approvals or portal forms. Where MIM and IdentityIQ genuinely differ, you get a worklist, not fabricated XML.
• It does not decide your lifecycle for you. Every consolidation decision goes in front of a human.
• It does not produce a perfect site on day one. Some complexity gets hand-finished. That is what we are for.

Who we are

Azure IAM, LLC is an independent identity consulting firm. Identity architecture for corporate, defense, intelligence and education.

Our company puts decades of experience implementing small to large scale identity management systems at the disposal of our customers. We architect, design, and implement secured identity systems for the public and private sectors, the states, and the federal government. Our solutions span on-premises data centers to the cloud.

Why the focus on users? The user identity is the new perimeter. It is the asset to secure and protect against password spray, social engineering, phishing, impersonation, and other sophisticated attacks.

Top Secret cleared, SCI Poly. Former Microsoft consultants. SailPoint IdentityIQ, MIM and FIM, Entra ID, and Okta certified.

The MIM deployments we replace took years to build. We are the consultants who built systems like them.

Beyond the migration

Migration is not only MIM. We have moved organizations off Okta to Entra ID, and the same discipline applies: know what the current system actually does, prove the new one matches, then switch off the old one.

The rest of what we do:

• Entra ID architecture, and Entra Connect synchronization design
• Conditional access, MFA, and self-service password reset
• Passwordless with FIDO2 keys, Windows Hello for Business, and Authenticator
• Moving applications from NTLM, LDAP and Kerberos to OpenID Connect and OAuth 2.0
• AD FS to Entra federation
• Azure Key Vault, and security architecture review