What Is Reconciliation in Identity Governance?

Understanding Reconciliation

Reconciliation is a two-way comparison process between OpenIAM and connected systems such as Active Directory, Entra ID, or business applications.

Its purpose is to verify that identity and access data are consistent in both systems — confirming that what exists in OpenIAM accurately matches what exists in each target system.

When discrepancies are found, OpenIAM applies policy-driven actions that determine how to correct or handle the mismatch:

• Update OpenIAM from the target system (accept external changes).
• Update the target system from OpenIAM (enforce central policy).
• Reject or flag the difference for manual review.
• Ignore specific changes when they’re acceptable exceptions.
• Report discrepancies for later analysis or audit.

Reconciliation ensures both systems are accurate and compliant, automatically aligning data based on governance rules.

Reconciliation vs. Synchronization

While the two processes are related, they serve distinct purposes in identity governance.

In short: Synchronization keeps OpenIAM up-to-date, while Reconciliation keeps OpenIAM and external systems in agreement.

Both can detect orphaned accounts — but reconciliation decides what to do about them.

Why Reconciliation Matters

Even in automated environments, data drift happens.

Accounts may be created directly in target systems, attributes may change out of band, or access removals may be missed during employee exits.

These inconsistencies lead to:

• Orphaned accounts – accounts left behind after terminations.
• Unauthorized entitlements – access added manually, outside policy.
• Inconsistent data – mismatched records between OpenIAM and external systems.
• Audit failures – inability to prove compliance or data integrity.

Reconciliation identifies and corrects these discrepancies, ensuring your identity governance system always reflects reality.

How Reconciliation Works

1. Connect to Target Systems

OpenIAM retrieves identity and entitlement data from connected systems (e.g., AD, Entra ID, databases, SaaS apps).

2. Compare Data

OpenIAM compares user and access attributes between its internal identity store and each target system.

3. Identify Discrepancies

Differences such as missing accounts, mismatched attributes, or unauthorized entitlements are flagged.

4. Apply Policy-Based Actions

Based on configuration, OpenIAM updates the target system, updates its own records, rejects the change, or creates an audit report.

5. Log and Report

Every detected and resolved difference is logged for compliance evidence and audit tracking.

Reconciliation transforms data validation into continuous governance assurance.

Types of Reconciliation

Reconciliation in the Identity Lifecycle

Reconciliation closes the loop in the Joiner–Mover–Leaver (JML) lifecycle by validating that each change actually occurred as intended.

It acts as the governance safety net that ensures lifecycle automation stays accurate over time.

Continuous Governance and Risk Mitigation

Reconciliation supports ongoing compliance and risk reduction by enabling OpenIAM to:

• Detect orphaned or unauthorized accounts across systems.
• Auto-remediate issues based on policy or workflow.
• Alert and report exceptions for certification or audit follow-up.
• Integrate with SoD and access certification to strengthen overall governance.

 Continuous reconciliation keeps your environment clean, compliant, and audit-ready. 

Using Reconciliation to Enforce Policy Compliance

Reconciliation can also serve as an active enforcement mechanism for governance policies.

Organizations often designate OpenIAM as the authoritative source for identity data and use reconciliation to ensure that no direct or unauthorized changes occur in downstream systems.

For example, if an administrator makes a manual change in Active Directory or Entra ID — such as adding a user to a restricted group — OpenIAM’s reconciliation process can detect that deviation and apply policy logic to respond appropriately:

• Revert the change in the target system to match OpenIAM.
• Reject and flag the change for investigation.
• Allow but report it for later audit review.

By enforcing “no direct changes” policies, reconciliation ensures that all updates flow through controlled identity management workflows — maintaining governance discipline and data integrity across the enterprise.

OpenIAM’s Approach to Reconciliation

With OpenIAM, reconciliation is not a periodic cleanup — it’s a continuous, policy-driven compliance mechanism built into identity operations.

Example: Detecting and Resolving Orphan Accounts

A terminated employee’s HR record is removed, but their AD and Salesforce accounts remain active.

During reconciliation:

1. OpenIAM detects both accounts exist without an active identity.
2. Policy rules mark them as orphans.
3. OpenIAM automatically disables those accounts and updates logs.
4. If automation isn’t possible, a ServiceNow ticket is generated.
5. The resolution is captured for audit and future certification.

Reconciliation not only detects orphaned accounts — it ensures they’re resolved consistently and documented.

Benefits of Automated Reconciliation

• Data Consistency – Keep OpenIAM and connected systems aligned.
• Security Assurance – Detect and eliminate unauthorized or manual changes.
• Policy Enforcement – Prevent direct modifications in target systems.
• Compliance Confidence – Maintain full audit evidence.
• Operational Efficiency – Automate detection and correction.
• Continuous Monitoring – Move beyond scheduled audits.
• Lifecycle Accuracy – Validate provisioning, deprovisioning, and policy enforcement.

← Back to Identity Lifecycle Management

Related Concepts

• Joiner–Mover–Leaver Lifecycle
• Access Certification
• Segregation of Duties (SoD)
• Birthright Access
• Identity Governance (IGA)
• Workforce Identity Governance