How NIM works
From data to action
The NIM workflow turns trusted source data into repeatable account, access, and lifecycle automation across your connected systems.
NIM works best as a continuous flow: collect and relate identity data, decide what should change, execute the approved changes, and monitor the result. Each stage creates a reusable building block for the next one—so you can start with a single automation and grow into a governed identity process.
The core automation flow
The diagram shows the core path from connected systems through scheduled automation. Apps and onboarding sit alongside this flow, giving people a controlled way to request or complete identity tasks when an automated process alone is not appropriate.
Select a step to explore the flow from connected systems to automation.
1. Establish trusted identity data
Connect systems and define their data
Start by connecting NIM to the systems that hold authoritative information and the systems that need to receive changes. A typical implementation uses an HR or student-information system as a source and directories, applications, or collaboration platforms as targets.
Relate records across systems
Configure inter-system relations to identify which records represent the same person, account, group, or resource. These relations let NIM build a reliable view of identity data before it changes anything downstream.
Outcome: NIM can distinguish the desired identity state from the current state in each connected system.
2. Turn policy into identity logic
Use filters to select the right population
Filters are SQL-like queries that select the records an automation should evaluate. For example, a filter can identify active employees who need a Google Workspace account, or users whose department changed and require a different set of groups.
Outcome: Your automation begins with explicit, testable criteria rather than manual lists.
Define account and access changes
Create mappings to create, update, or remove target-system data. Use roles to manage group memberships and other entitlements based on the same trusted identity data. Name and password generators can compose values when a target system requires them.
3. Execute, schedule, and observe
Group changes into jobs
A job combines the mappings and role operations that belong together. This makes each business process reusable—for example, one job can manage a department’s account lifecycle while another handles access changes.
Run jobs through sync tasks
Sync tasks run jobs manually or on a schedule. Before enabling recurring automation, validate filters and preview the changes so you understand the expected impact. Then choose a schedule that reflects how quickly source-data changes should reach target systems.
Outcome: Joiner, mover, and leaver changes are processed consistently without relying on manual follow-up.
Respond to events and exceptions
Use events to trigger follow-up actions such as notifications, auditing, or operational workflows. Events help make automation observable and give administrators a clear response path when a process needs attention.
4. Add controlled self-service
Use Apps and onboarding where people are part of the process
Not every identity task should run without a person. NIM Apps let you delegate defined tasks through secure forms, while onboarding helps new users activate access without sharing default passwords. Both extend the same data, policies, and audit trail used by the automation flow.
Next: Your first workflow