Hi Jules,



The Entra Governance options have expanded considerably and are looking more like viable replacements for many MIM tasks, assuming the organisation is also moving generally towards Entra ID. In particular, Entra now has lifecycle features and more flexible APIs - so in theory you could be shifting MIM MA code into Logic Apps, populating Entra via API and then syncing back to on-prem AD if you still need that presence. The big downside is that some of the features are hidden behind a new expensive licensing tier.  Our back-of-a-napkin roadmap for MIM and AADC is along those lines, depending a lot on how much things would cost.



The only product I've seen that works either alongside or as a cloud replacement specifically for MIM is Software IDM's Identity Panel suite - again, potentially costly, but maybe not when compared to additional MS licensing. And likely still cheaper to implement than one of the big IAM platforms.



Regards,

Tim

____________________________________

Tim Purkiss

Platform Owner: Identity and Access Management

Information Services Division

UCL



E: [log in to unmask]



-----Original Message-----

From: Discussion for MS IDM tools liks ILM and FIM <[log in to unmask]> On Behalf Of Jules Andreae

Sent: Tuesday, January 2, 2024 4:13 PM

To: [log in to unmask]

Subject: Where are we all in regards to MIM and its EOL



⚠ Caution: External sender





Afternoon All and a happy new year to all,



It has been a while since the last discussion on the future of MIM discussions in this list and I am sure for some institutions much will have changed.



Despite 2029 still being a good while away, the current state of a heavily deprecated MIM (https://learn.microsoft.com/en-us/microsoft-identity-manager/microsoft-identity-manager-2016-deprecated-features) and lack of a like for like functional replacement means we are considering our full range of options for the daunting task of its full replacement. Varying from functionality based replacements, to a full reconsideration of our identity ecosystem and lifecycle, in what is a more and more cloud first world. The latter option being a massive undertaking, with a hefty associated risk from the scale of replacement of this core infrastructure and associated processes.



I would be interested to hear from others in the list. Are you still awaiting updates from Microsoft on getting the tooling feature more on par? Have you started your MIM replacement journey? If so I would be very interested in what direction you have gone, and how that journey has gone / is going.



From our perspective:



Until now. we have been waiting to see what happens from Microsoft, with the delayed EOL giving us much needed breathing room to complete other aspects of cloud migrations and associated development work. While in this state we have split our identity based workflows for new processes. Utilising cloud first approaches for cloud service workflows. Which has mainly been utilising Azure, with most work going into Runbooks alongside logic apps, utilising PowerApps when a user front end is required. As such not adding onto our MIM workflows and complexity. As an organization we did not implement MIM portal, these azure workflows allows us to really demonstrate the benefit of the user first approach. Empowering users through PowerApps which have business logic embedded in the associated workflows.



Our first workflow implemented via this process was management of exchange corporate/shared mailboxes. Previously the process was managed by our support teams, with only minimal automation on deletion, mailbox owners now have full control over the lifecycle (creation, renewal, access management, closure, etc.) - helping to improve the experience for our users and free up staff time for other tasks. These have been great experiences to give context to our goals and requirements when replacing MIM, both in times of the scale / impact of improvements we could make, but also the time of effort they can require.



from,

Jules



Julian A Andreae | Infrastructure Development Engineer (Identity and Cloud) Server Infrastructure Development Team, Information Services, University of Kent



########################################################################



To unsubscribe from the MICROSOFT-IDENTITY list, click the following link:

https://www.jiscmail.ac.uk/cgi-bin/WA-JISC.exe?SUBED1=MICROSOFT-IDENTITY&A=1



This message was issued to members of http://www.jiscmail.ac.uk/MICROSOFT-IDENTITY, a mailing list hosted by http://www.jiscmail.ac.uk/, terms & conditions are available at https://www.jiscmail.ac.uk/policyandsecurity/



########################################################################



To unsubscribe from the MICROSOFT-IDENTITY list, click the following link:

https://www.jiscmail.ac.uk/cgi-bin/WA-JISC.exe?SUBED1=MICROSOFT-IDENTITY&A=1



This message was issued to members of www.jiscmail.ac.uk/MICROSOFT-IDENTITY, a mailing list hosted by www.jiscmail.ac.uk, terms & conditions are available at https://www.jiscmail.ac.uk/policyandsecurity/