> For the complete documentation index, see [llms.txt](https://docs.aohwv.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.aohwv.dev/core-concepts/connectors-and-sync.md). # Connectors and Sync How identity data moves: in from systems of record, and back out to systems that enforce access. ## Source systems A **source system** is where identity data already lives upstream: a SQL database, REST API, payroll provider, CSV export. It defines how to connect and what fields or tables are available; it does not decide what to pull or where data goes. Source systems produce [accounts](/core-concepts/the-identity-graph.md). ## Target systems A **target system** is where AOH Sync writes identity data downstream: Entra ID today, with Okta, AWS IAM, and SCIM endpoints planned. It defines credentials and setup for pushing changes; it holds no mappings. Target systems are where [users](/core-concepts/the-identity-graph.md) come from. ## Connectors A **connector** is the bridge between a source and a target. It defines the work: what to pull, how to transform it (attribute mappings), how to detect [machine identities](/core-concepts/machine-identities.md), and where to push the result. The decisions live in the connector; the systems on either end are just endpoints. You can repoint a connector, reuse a source across connectors, or change a mapping without touching connection details. Connectors are organized by direction: * **Identity ingestion** pulls people in from sources to build the graph. * **Account import** brings in source records as accounts. * **Outbound** provisions changes out to target systems. ## Sync vs provisioning * **Sync** pulls data *in*. AOH Sync reads source and target systems and updates the graph to reflect reality. Entra is synced via delta queries, so only changes come over. * **Provisioning** pushes data *out*. AOH Sync writes the identity picture to a target so access matches intent. ## SCIM **SCIM** (System for Cross-domain Identity Management) is the protocol AOH Sync uses to bulk-push users and groups to targets that speak it. AOH Sync builds the SCIM bulk requests from your connector's mappings. ## Scheduling Sync and provisioning also run on schedules defined as cron jobs, each with a trigger, next run time, status, and a history of past runs you can inspect. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.aohwv.dev/core-concepts/connectors-and-sync.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.