Connectors and Sync

How identity data moves: in from systems of record, and back out to systems that enforce access.

Source systems

A source system is where identity data already lives upstream: a SQL database, REST API, payroll provider, CSV export. It defines how to connect and what fields or tables are available; it does not decide what to pull or where data goes. Source systems produce accounts.

Target systems

A target system is where AOH Sync writes identity data downstream: Entra ID today, with Okta, AWS IAM, and SCIM endpoints planned. It defines credentials and setup for pushing changes; it holds no mappings. Target systems are where users come from.

Connectors

A connector is the bridge between a source and a target. It defines the work: what to pull, how to transform it (attribute mappings), how to detect machine identities, and where to push the result. The decisions live in the connector; the systems on either end are just endpoints. You can repoint a connector, reuse a source across connectors, or change a mapping without touching connection details.

Connectors are organized by direction:

• Identity ingestion pulls people in from sources to build the graph.
• Account import brings in source records as accounts.
• Outbound provisions changes out to target systems.

Sync vs provisioning

• Sync pulls data in. AOH Sync reads source and target systems and updates the graph to reflect reality. Entra is synced via delta queries, so only changes come over.
• Provisioning pushes data out. AOH Sync writes the identity picture to a target so access matches intent.

SCIM

SCIM (System for Cross-domain Identity Management) is the protocol AOH Sync uses to bulk-push users and groups to targets that speak it. AOH Sync builds the SCIM bulk requests from your connector's mappings.

Scheduling

Sync and provisioning also run on schedules defined as cron jobs, each with a trigger, next run time, status, and a history of past runs you can inspect.