# IdentityPilot — identity governance

*Source: https://jordantech-solutions.net/identitypilot · Part of JordanTech Solutions (https://jordantech-solutions.net)*

- IdentityPilot — automate employee access
- IdentityPilot keeps employee access aligned with HR and policy: create accounts, update access, disable leavers, and record every change for audit.
- Access lifecycle
- Employee access stays right.
- When someone joins, changes teams, or leaves, IdentityPilot turns the HR update into the right accounts, groups, licenses, and device steps. It keeps checking what exists against policy, fixes drift, and records every change, so audits are simple lookups.
- Book a demo
- Ask for pricing
- Connects: SAP SuccessFactors · Active Directory · IT Service Management
- An employee table: one person joins, changes role, and leaves — IdentityPilot starts the right access tasks for each step
- Employees
- IdentityPilot · tasks
- 6 tasks
- watching HR changes
- New hire → create access
- Role change → adjust access
- Last day → disable access
- working · {n}/6 systems
- Lena Hoffmann
- Replay Lena Hoffmann's journey from day one
- active
- starts Jul 1
- R&D → Sales
- leaves Sep 30
- Active Directory
- Outlook
- Office 365
- Teams
- File shares
- Laptop · ITSM
- day one ready · 0 tickets
- account ready
- mailbox ready
- license active
- added to R&D
- R&D drive ready
- laptop ordered
- 3 updates · old access removed
- groups updated
- unchanged
- license kept
- Sales in · R&D out
- R&D removed
- unchanged
- access off · records kept
- sign-in blocked
- mail blocked
- license reclaimed
- removed
- access removed
- return planned
- The problem
- Access still depends on tickets
- A new hire often means the same request repeated across directory, email, licenses, chat, and devices. A move to another team adds new groups while old ones linger. Offboarding works only if every checklist item is done. That is too much identity risk for busy IT teams to carry by memory.
- When an audit asks who had which access in March, the proof is scattered across tickets, spreadsheets, and inboxes.
- IdentityPilot turns the HR record into the source of truth for access. You define which accounts, groups, licenses, and device steps each role needs. From then on, HR changes create, adjust, or disable access automatically, and every action is recorded with the rule that caused it.
- Lifecycle automation
- One HR change. Every system aligned.
- Joiner: day one, ready
- SAP SuccessFactors gets the new-hire record. IdentityPilot creates the directory account, groups, mailbox, licenses, and device order through IT Service Management. It waits for the laptop to be ready before onboarding is complete. Day one starts with access that works.
- Mover: role changes without leftovers
- An employee moves from R&D to sales. IdentityPilot compares the new role with policy and changes only what needs to change: department, groups in Active Directory, and role-specific access. Old permissions are removed instead of carried forward. Privilege creep stops.
- Leaver: last day, locked out
- HR sets the last day. IdentityPilot disables access across connected systems at the right time: sign-in, groups, apps, and managed devices. Records stay for audit, but the person can no longer use them. If they return, the rehire starts from clean history.
- How it works
- Expected access meets real access
- IdentityPilot keeps two views: what policy says each person should have, and what connected systems actually show. Its job is to keep those views matched.
- HR leads
- Joiners, movers, and leavers start in SAP SuccessFactors. IdentityPilot reads HR as the source of truth and does not write back to it.
- Policy decides
- Your rules translate each HR record into expected access: accounts, groups, licenses, devices, and platform settings for this person right now.
- Reality is checked
- IdentityPilot reads Active Directory and IT Service Management to see what is actually there, including manual changes.
- Fixes are logged
- When expected and actual access differ, IdentityPilot updates the connected systems and records why. It runs after each event and performs a full nightly check.
- IdentityPilot works as a reconciliation loop. Source systems send joiner, mover, and leaver events; the engine builds one person record, compares expected access with current access, and sends only the changes needed to bring each target back in line.
- Source systems such as SAP SuccessFactors and IT Service Management publish lifecycle events. IdentityPilot reads them in one direction.
- The core engine turns those events into one person record, then compares expected state from policy with current state from connected systems.
- When something is missing or extra, the actions engine writes the right changes to targets such as Active Directory, IT Service Management, Confluence, and Citrix.
- IdentityPilot reference architecture: an event-driven reconciliation loop from source systems through the core engine to target systems
- Source systems
- Incoming
- IdentityPilot core engine
- Outgoing
- Target systems
- Input
- Expected
- Current
- Events / actions
- Input events
- Action events
- Feedback events
- Input data
- As received
- Expected state
- Policy view
- Current state
- Read from targets
- per-source identity
- + 4 systems
- Rules
- Mapping
- Compare
- IdentityPilot
- Changes
- Engine
- schema
- JSON
- Tap a state card to view its JSON
- Reconciliation loop
- Play the walkthrough
- Pause the walkthrough
- Step
- View JSON
- This step
- View fullscreen
- Exit fullscreen
- Source systems send joiner, mover, and leaver events; IdentityPilot only reads them.
- Events are queued in order so changes are not missed or applied twice.
- Each source is kept in its raw shape — exactly as SAP or IT Service Management sent it.
- Rules map each source into one clear person record.
- Expected state is the access policy says this person should have.
- IdentityPilot compares expected state with what target systems show.
- Current state is the access that really exists right now.
- When expected and current access differ, the actions engine sends only the needed changes.
- Targets receive those changes: Active Directory, IT Service Management, Confluence, and Citrix.
- Targets send their own events back so the loop keeps checking itself.
- Copy
- Copied
- Close
- canonical JSON · read-only
- Capabilities
- Clear answers for every access change
- Manual changes are corrected
- If someone edits a directory group by hand, IdentityPilot treats it as drift: current access no longer matches policy. The next event or nightly sweep finds it, fixes it, and records what changed. The directory you audit is the directory your policy expects.
- A complete audit trail
- For any account, IdentityPilot can show the previous value, new value, trigger, timestamp, and rule version. The platform records changes it makes and drift it finds, and it does not write a value without a source. That makes access reviews evidence, not reconstruction.
- Works with your existing stack
- No rip-and-replace. SAP SuccessFactors stays the HR source of truth, Active Directory and IT Service Management are read and updated, and IdentityPilot keeps them aligned. Adding another system means adding a connector; policy and reconciliation stay the same.
- Preview rule changes before they act
- Test a policy change before it writes to production. IdentityPilot shows which accounts, groups, and devices would change across connected systems, then you decide whether to apply it.
- Questions
- The short answers first
- Do we have to replace any of our systems?
- No. IdentityPilot connects to what you already run. SAP SuccessFactors, Active Directory, and IT Service Management keep doing their jobs; IdentityPilot reads them, compares access with policy, and writes only the needed corrections. Adding another system later is a connector, not a re-platforming project.
- Which systems does it connect to today?
- Today the core setup is SAP SuccessFactors as the HR source of truth, plus Active Directory and IT Service Management for identities and devices. IdentityPilot reads the SAP source system, compares it with the target systems, and updates the targets when something changes. Each new system is a connector; the core platform stays the same.
- Does it write to our HR system?
- Never. SAP SuccessFactors is read as the source of truth and is not written by IdentityPilot. Corrections go only to the managed systems.
- What if a record in HR is wrong — say, a leave date?
- Fix it in HR and IdentityPilot follows the corrected record. Offboarding disables rather than deletes, so a wrongly disabled account can come back intact. The whole episode stays on the record: wrong value, action taken, and correction.
- What if an admin changes something by hand?
- It gets found. A hand-edited group or stray account becomes drift between current access and policy. IdentityPilot corrects it on the next event or in the nightly sweep, then records the edit, detection, and correction.
- Are a leaver’s accounts deleted?
- Disabled, not deleted. Access is revoked in every connected system, but records stay available for audit and rehire history. If the person returns, IdentityPilot can rebuild access from the current HR record and policy.
- We still have to run access reviews. Does this help?
- Yes. The review question — who had what access, when, and under which rule — is a direct query in IdentityPilot. Every value carries history, so the answer works for past dates, not just today.
- See access move with HR
- Book a demo and watch one HR record create accounts, order the device, update access, and leave a clean audit trail.
- See pricing
- Pricing
- Pricing that scales with your estate
- Pricing is based on active employees. Plans start at 250 employees, include every connector and workflow, and scale with your estate — talk to sales for a quote.
- Contact sales
- Employees
- Connectors and workflows are included. Integration work is billed time and materials.
- Starter
- For 250+ employees, with every connector and workflow included.
- Growth
- Automatic volume discounts as your estate grows.
- Enterprise
- For estates over 3,000 employees, plus SSO/SCIM, on-prem agents, access reviews, and rollout planning.
- Employees
- Per employee
- Volume discount
- IdentityPilot — {n} employees, estimated {cost}/mo. I’d like to review the fit.
- Integration
- Time & materials
- IdentityPilot — around {n} employees. I’d like a custom quote and rollout estimate.