Azure IAM Maps MIM Sets And MPRs To SailPoint IdentityIQ Roles And Policies

Azure IAM, LLC explains how Microsoft Identity Manager sets, management policy rules, and groups map to SailPoint IdentityIQ populations, roles, and lifecycle workflows, which parts translate automatically, and which need a human decision before cutover.

Las Cruces, United States, October 9, 2026 /NewsNetwork/ -- Teams planning a move from Microsoft Identity Manager (MIM) to SailPoint IdentityIQ usually reach the same question once they open the MIM Portal: how do MIM's sets and management policy rules (MPRs) map to SailPoint's roles and policies? Azure IAM, LLC, an independent identity consulting firm, says the answer depends on what each set is actually doing, because MIM uses one construct for several jobs that IdentityIQ keeps separate. The firm documents its MIM to SailPoint method at https://azureiam.com/mim-to-sailpoint.

In MIM, a set is the "who" of every policy. A set defines a population with an XPath filter, and MPRs attach meaning to it: a request MPR grants a set of requestors the right to change attributes on a set of targets, and a set transition MPR fires workflows when an object enters or leaves a set. IdentityIQ has no MPR. It separates population definitions, lifecycle events, workflows, roles, and access rights into distinct objects, so a direct one for one copy is not possible.

Sets translate most cleanly. Azure IAM translates each set's XPath into an IdentityIQ filter and emits it as a population, stored as a GroupDefinition object, with the original XPath preserved in the description so reviewers can trace every population back to its MIM source. Two patterns are refused rather than guessed: sets that need a subquery and sets that compare MIM object identifiers. Those appear in the migration caveats for a deliberate rebuild.

Set transition MPRs become lifecycle logic. MIM commonly spreads one joiner, mover, or leaver event across several MPR and workflow pairs. Azure IAM classifies each pair as joiner, mover, leaver, or unclassified, records the evidence for the classification, and puts every pair in front of a human to confirm. Confirmed pairs for one event merge into a single consolidated IdentityIQ workflow. Leaver triggers are written to match a transition rather than a state, so an account that is already disabled is not processed a second time.

Groups are where roles come in. MIM group membership is usually the product of set criteria and policy, with no separate layer that explains why access exists. When group reporting is provided, Azure IAM produces a two tier role model. IT roles hold the entitlement, one per Active Directory group, and business roles carry the business meaning and confer the IT roles beneath them. Business roles are what managers and certification campaigns see, which is the layer that later supports access requests, access certifications, and role mining. A conversion report lists one row per group so nothing is converted without a record. Security groups, distribution groups, and criteria based groups are all included.

Request MPRs need the most judgment. A request MPR that lets the help desk reset a phone number, or lets managers edit their direct reports, is an authorization rule rather than a role. Azure IAM inventories these rules with their requestor sets, target sets, and attributes, then maps the intent to IdentityIQ capabilities, scopes, and lifecycle manager configuration during scoping. These rules are listed as decisions, not silent conversions.

Each connected system becomes a provisioning plan rule called from the lifecycle workflow, and the policy folder in the deliverable holds the populations, the policy rule map, and the portal worklist. Correctness is checked in a parallel run: MIM remains the only system provisioning to downstream systems while IdentityIQ aggregates, evaluates, and computes the provisioning it would send. The comparison covers Active Directory group membership and outbound provisioning and continues until the results match.

Microsoft's extended support for MIM 2016 SP2 runs through January 10, 2029. Organizations that host the MIM Portal on SharePoint Server 2019 already face an earlier problem, because SharePoint Server 2019 reached end of support on July 14, 2026.

Organizations still running MIM sets and MPRs can book a scoping call with Azure IAM at https://azureiam.com/contact to see which sets become populations, which groups become roles, and which policy rules need a decision before a fixed fee migration quote.

Contact Info:
Name: Robin Lilly
Email: Send Email
Organization: Azure IAM, LLC
Address: 2521 North Main Unit 1-276, Las Cruces, New Mexico 88001, United States
Website: https://azureiam.com

Source: NewsNetwork

Release ID: 89205746

In case of identifying any errors, concerns, or inconsistencies within the content shared in this press release that necessitate action or if you require assistance with a press release takedown, we strongly urge you to notify us promptly by contacting [email protected] (it is important to note that this email is the authorized channel for such matters, sending multiple emails to multiple addresses does not necessarily help expedite your request). Our expert team is committed to addressing your concerns within 8 hours by taking necessary actions diligently to rectify any identified issues or supporting you with the removal process. Delivering accurate and reliable information remains our top priority.