Five MIM Attribute Precedence Conflicts That Break A SailPoint Migration

Every Microsoft Identity Manager estate carries a hidden decision table. For each metaverse attribute fed by more than one management agent, MIM knows which source wins and which sources wait as fallbacks. That table is what makes HR the authority for a job title while Active Directory stays the authority for a phone number. It is also the single item most likely to be carried across incorrectly when a shop migrates MIM to SailPoint IdentityIQ.

Azure IAM, LLC has been rebuilding MIM estates in IdentityIQ since well before Microsoft pushed MIM 2016 SP2 support out to January 10, 2029, and its published transformation notes at https://azureiam.com/mim-to-sailpoint call attribute precedence the single highest-risk item in the whole move. The reason is not complexity. It is silence. A wrong ordering produces output that passes every visual check.

How the two products decide a winner

MIM ranks the management agents that contribute to an attribute. Rank 1 wins. If rank 1 has nothing to say, rank 2 is consulted, and so on. IdentityIQ does something that sounds identical: it evaluates identity attribute sources in order and takes the first non-null value. An HR application listed first stays authoritative and Active Directory remains the fallback.

The two models line up for the simple case, which is why most migrations copy the list and move on. The conflicts live in everything that is not the simple case.

Conflict one: equal precedence

MIM offers an equal precedence option, where the most recent import wins no matter which connector supplied it. Shops use it for attributes such as telephone numbers that legitimately change in more than one place. IdentityIQ has no last-writer-wins mode for identity attributes. Each equal-precedence attribute needs an explicit order, and choosing that order is a business decision, not a technical one. A migration that quietly picks the first management agent in alphabetical order has made a policy choice nobody signed off on.

Conflict two: two precedence lists that combine

Classic attribute flows configured directly on a management agent and declarative synchronization rules built in the MIM Portal both flow into the same metaverse attribute. The Metaverse Designer holds one ranking. Each synchronization rule carries its own precedence number. The effective winner is the product of both lists. Reading only the Metaverse Designer, which is the common shortcut, reproduces half the answer and calls it done.

Conflict three: manual precedence in compiled code

Some attributes are set to manual precedence, which hands the decision to a rules extension written in C# or VB and compiled into an assembly years ago. The MIM Configuration Documenter report records that a flow uses a rules extension. It cannot say what the extension does. Most estates Azure IAM sees no longer have the source. The developers left and the project files went with them.

The consultancy's approach is to decompile the assemblies at the client's direction, recover the logic, and translate it with a real C# parser. Constructs it cannot honor, such as loops over multivalued attributes, exception handling, LINQ, or calls to external services, are refused by name and left as clearly marked scaffolds. A scaffold is an honest deliverable. A confidently wrong precedence rule is not.

Conflict four: empty versus absent

MIM allows a lower-ranked source to contribute when the higher-ranked connector does not supply the attribute at all. IdentityIQ's first-non-null rule treats an empty string as a real value. An HR export that fills unused columns with blanks can win an attribute in IdentityIQ that it never won in MIM, and Active Directory's correct value is discarded on the next refresh. Null handling has to be verified attribute by attribute during the parallel run.

Conflict five: multivalued merges

For a multivalued attribute at equal precedence, MIM combines the values from every contributing management agent into one list. IdentityIQ selects a single source per attribute. Proxy addresses, secondary email addresses, and group lists that were a union in MIM become a single feed after migration unless the design deliberately reconstructs the merge.

What catching them looks like

At Contoso, the estate Azure IAM uses to demonstrate the transformation because it is built from Microsoft's own published sample configuration, the tool found four join rules on the Active Directory management agent and asked which one is authoritative, in what fallback order, and what to do when zero or several accounts match. Attribute precedence is handled the same way. Every contested attribute is listed in a caveats file with the evidence it was inferred from and a confidence score. The ones that genuinely need a human decision are marked MUST CONFIRM, and the wizard refuses to proceed past them. Ambiguous ordering is never resolved by guessing.

Every translated rule also carries the original MIM expression as a comment directly above the BeanShell it became, so a reviewer checks the translation rather than trusting it.

Why now

MIM 2016 SP2 is supported until January 10, 2029, so the synchronization engine is not the urgent part. The MIM Portal's dependency on SharePoint 2019, which reached end of support on July 14, 2026, is the nearer problem for shops that still run the Portal, and Entra ID Governance does not absorb every MIM workflow. Whatever the timeline, the precedence map is the first artifact a migration needs, and it can be produced from the Configuration Documenter report a team can generate this week.

Azure IAM delivers the IdentityIQ package and builds the site, including import, connector configuration, aggregation, and a parallel comparison run against the live MIM estate. Identity teams planning a MIM exit can book a scoping call at https://azureiam.com/contact

Azure IAM, LLC
City: Las Cruces
Address: 2521 North Main
Website: https://azureiam.com