MIM PCNS To SailPoint: Moving AD Password Sync Without A Gap
Most Microsoft Identity Manager (MIM) to SailPoint IdentityIQ plans have a line for management agents, a line for workflows, and a line for the portal. Fewer have a line for password synchronization, and it is the feature users notice first when it breaks. Somewhere in the estate a mainframe, an LDAP directory, or a line of business database expects every Active Directory password change to arrive within seconds, and MIM has been delivering it through the Password Change Notification Service (PCNS) for years. Azure IAM, LLC, an independent identity consulting firm that migrates MIM estates to SailPoint IdentityIQ, treats PCNS as its own workstream. The firm's method is documented at https://azureiam.com/mim-to-sailpoint . What PCNS actually does Microsoft's MIM password management documentation describes the pieces precisely. On every domain controller, a password filter named Pcnsflt.dll is loaded by the Local Security Authority. It receives the plaintext password at the momen...