Connect Your Entire
Identity Estate
IdentityFirst reads from your existing systems — no agents, no schema changes, no assessment-time writes. Start with 5 GA launch anchors, add 9 Beta controlled pilots where the scope fits, and use the wider Experimental estate only for roadmap and controlled validation.
- Read-only by default — no write access required
- Polly-backed retry and circuit-breaker on every connector
- Normalised to CanonicalIdentity model
- Supports push (webhook) and pull (scheduled) modes
- New connectors released every sprint
Public Connector Maturity
We do not sell raw connector count as maturity. The public launch story is depth-first: GA launch anchors first, Beta controlled pilots second, Experimental only by request.
Production-led launch path
These are the public launch anchors we are comfortable leading with for production assessments. They underpin the default MRI and early Core connector story.
- Safe default for launch-path commercial claims
- Explicitly called out in the public connector registry
- Used to support depth-first deployment messaging
- Read-only at the assessment boundary
Controlled pilots
Beta means controlled pilot, not blanket production-ready. These connectors have meaningful implementation progress, but we validate scope, permissions, and evidence depth with you before treating them as production-mature.
- Available for controlled pilots and scoped production validation
- Suitability depends on agreed evidence requirements
- Maturity is explicit; we do not hide connector limits
- Not a promise of broad SLA-backed production maturity
Early Adopter
Experimental connectors are available for roadmap-led validation and selected customer demand. They are not the default path for public proof, launch claims, or broad production commitments.
- Suitable for named roadmap and evaluation discussions
- Enabled only when the maturity tradeoff is understood
- Read-only by default at the assessment boundary
- Not sold as default production coverage
Connects to the vendors you already use
Microsoft
Amazon Web Services
Google Cloud
Okta
CrowdStrike
Splunk
Workday
SailPoint
ServiceNow
Datadog
Ping Identity
Jamf
GA Launch Anchors
These 5 connectors are the production-led launch core we use to support the public MRI story without inflating the broader estate.
AWS IAM
GA anchor CloudAWS IAM identities, roles, policies, and CloudTrail-linked authorization evidence.
GA launch anchor. Safe default for production-led assessment claims.
Google Workspace
GA anchor SaaSGoogle Workspace users, admin activity, OAuth application inventory, and identity exposure evidence.
GA launch anchor. Safe default for production-led assessment claims.
Microsoft Entra ID
GA anchor Cloud IdPMicrosoft Entra ID identities, groups, conditional access, and Azure authorization surface coverage.
GA launch anchor. Safe default for production-led assessment claims.
Okta
GA anchor FederationOkta users, groups, applications, MFA factors, and system-log-backed identity posture.
GA launch anchor. Safe default for production-led assessment claims.
ServiceNow
GA anchor ContextServiceNow context enrichment for identity, workflow, and supporting operational evidence.
GA launch anchor for context enrichment, not a replacement for a primary identity source.
Beta Controlled Pilots
The current public registry shows 9 Beta connectors. These are not sold as broadly production-ready; they are available for controlled pilots and scoped production validation.
Active Directory
Hybrid anchor for forest enumeration, privileged group analysis, and evidence-backed on-prem identity posture.
Controlled pilot. Use when hybrid Active Directory scope is agreed and validated in discovery.
CrowdStrike
Identity-adjacent security telemetry for controlled investigations and contextual reporting.
Beta controlled pilot. Coverage depends on the tenant’s licensed identity telemetry surface.
CyberArk PAS
Privileged account inventory, safe membership, and controlled pilot PAM evidence collection.
Beta controlled pilot. Validate evidence depth and operational fit before production governance claims.
GitHub
Repository, organization, and developer identity exposure for engineering-heavy environments.
Beta controlled pilot. Use when GitHub identity surface is in written scope.
Microsoft 365
Microsoft 365 identity-adjacent collaboration and admin evidence during controlled rollout.
Beta controlled pilot. Evidence depth varies by tenant permissions and agreed scope.
SAP SuccessFactors
SuccessFactors worker and lifecycle context in controlled rollout HR programmes.
Beta controlled pilot. Suitable for scoped validation, not default launch-path claims.
Salesforce
Salesforce tenant access, account hygiene, and identity-adjacent application exposure.
Beta controlled pilot. Validate object scope and evidence needs before relying on it.
Slack
Slack workspace membership and collaboration-admin posture for scoped identity reviews.
Beta controlled pilot. Controlled-use only while hardening and fixture coverage improve.
Workday
Authoritative HR identity signals and lifecycle context during controlled validation.
Beta controlled pilot. Use for scoped HR-source validation, not blanket production promises.
Beta connectors are controlled-use surfaces. We scope them with you before relying on them for production governance or stronger commercial commitments.
Discuss a Controlled PilotExperimental Estate
55 Experimental connectors remain available for roadmap and customer-demand validation. We surface a representative sample here instead of pretending the whole estate is launch-mature.
Don't see your system? We prioritise connector development based on customer demand and the depth-first launch programme.
Request a ConnectorHow the Connector Framework Works
All connectors share the same normalisation pipeline — data from every source flows through CanonicalIdentity before reaching any analysis engine.
1. Connect
Supply read-only credentials (API key, service principal, or service account). IdentityFirst never requires admin rights. Principle of least privilege enforced.
2. Normalise
The DataNormalisation engine maps each source record to the CanonicalIdentity model. Built-in rules handle name casing, email deduplication, and attribute trimming.
3. Graph
Normalised records flow into the TemporalIdentityGraph. Identities from multiple sources are correlated, deduped, and enriched with risk scores and drift signals.
Ready to Connect Your Identity Estate?
Book a 30-minute technical call. We'll confirm connector compatibility with your environment before you commit to anything.