Identities, Accounts & Users
An Identity is AOH Sync's unified record for a single real person — regardless of how many systems they appear in.
Why identities exist
Most organizations have the same person spread across multiple systems: an HR record in a payroll system, a profile in Active Directory, and perhaps an entry in a contractor portal. Without a normalized view, you have no single answer to "who is this person, and what should their Entra account look like?"
AOH Sync solves this by creating one Identity per person and linking every system record to it. You see one canonical view of each person; AOH Sync resolves conflicts between sources automatically.
Each row in the Identities screen is a single Identity. The Sources and Accounts columns show how many systems contributed data to that person.
Users vs. Accounts
Not every record attached to an Identity is the same kind of thing. AOH Sync distinguishes two:
Comes from
Target system (Entra ID)
Source system (HR, payroll, SaaS, CSV)
Can log in
Yes
No
Role
Controls access
Provides attributes
Linked to
One Identity
One Identity
A User is an authentication-capable record from a target system such as Entra ID — it is what a person logs in with and what controls SSO and downstream access. An Account is a data record from a source system (an HR row, a payroll record) that describes a person but cannot log in. Both link back to exactly one Identity.
What an Identity contains
An Identity aggregates four types of information:
Users
The person's login-capable records in your Target Systems — controls access
Accounts
Data records from your Source Systems — provides attributes
Machine Identities
Non-human accounts (service accounts, shared mailboxes, bots) associated with this Identity
Attributes
Individual data fields (name, job title, department, etc.) drawn from one or more sources
Every Identity carries a status — derived from its linked records, not set by hand. A person whose only login account is disabled is not active just because a stale source record lists them as current.
How records attach (join keys)
AOH Sync matches incoming users and accounts to an Identity using configurable join keys — shared values such as a user principal name or employee ID. When multiple keys could match, a priority order decides which one wins. A record that matches nothing becomes an Orphaned Account and surfaces for review.
How attributes are resolved
When the same attribute (for example, job title) arrives from two different sources, AOH Sync applies a priority to decide which value to use. You set the priority order for each Connector in your attribute mapping configuration. The source with the highest priority for that field wins; lower-priority sources fill in any fields the higher-priority source did not supply.
Each attribute record tracks:
Which source supplied it — so you can trace every value back to its origin.
When it was last updated — so you can see how fresh the data is.
Its priority — the rank used to resolve conflicts with other sources.
You can override the default priority on a per-attribute basis in your Connector's Field Mappings. This lets you, for example, trust your HR system for legal name but your directory for email address.
Machine Identities
A Machine Identity is a non-human account — a service account, a shared mailbox, an integration bot — that is associated with an Identity for accountability purposes. Machine Identities carry a classification, an owner, and a risk score so your security team can track them alongside human identities.
Related
Last updated