Azure IAM, LLC explains when a BeanShell rule can be generated automatically from a Microsoft Identity Manager rules extension, which C# constructs a parser translates into finished SailPoint IdentityIQ rules, and which are left as marked scaffolds for a human to finish.

Las Cruces, United States, October 1, 2026 /NewsNetwork/ -- Teams planning to retire Microsoft Identity Manager (MIM) in favor of SailPoint IdentityIQ keep arriving at the same question: can a BeanShell rule be generated automatically from a MIM rules extension, or does every line of C# have to be rewritten by hand? Azure IAM, LLC, an independent identity consulting firm, says the answer is yes for the logic a parser can translate faithfully, and no for the rest, and that the boundary between the two should be stated before a migration starts. The firm documents its method at https://azureiam.com/mim-to-sailpoint for the people who have to sign off on the result.

A rules extension is .NET code compiled into an assembly that the MIM synchronization service calls during attribute flow, join, and provisioning. The MIM Configuration Documenter report can show that a flow uses a rules extension, but not what the code does. Azure IAM describes this as normally the hardest part of a MIM migration, and the reason most projects end up rewriting logic from scratch.

The firm's approach starts from an exact key that joins the report to the code. The documenter report records each flow's mapping type as the rules-extension script context, and that context is the same string MIM passes as the flow rule name into the import mapping call. When the source is supplied, each case in the extension is matched to its flow and translated into a finished IdentityIQ rule rather than a stub.

The translation is deterministic. Azure IAM states that expressions and .NET rules extensions are converted by parsers, not by pattern matching and not by a language model, so the same input always produces the same output. The C# is parsed with a real grammar so the translator can reliably detect the constructs it cannot honor.

Those constructs are refused by name. A case that loops over a multivalued attribute, catches exceptions, uses LINQ, or calls an external service keeps a marked scaffold, and a caveats file records which construct stopped the translation. Refusal is per case, so one untranslatable flow does not discard the others in the same file. "A scaffold is an honest deliverable. Confidently wrong identity logic is not," the firm states on its migration page.

Missing source code does not end the conversation. According to Azure IAM, most MIM estates it sees no longer have the C# or VB source for their rules extensions, because the developers left and the project files went with them. In those cases the firm decompiles the organization's own assemblies at the organization's direction, recovers the logic, and translates it like any other input.

Provisioning code is handled separately, because it is not an attribute flow. Each connected system becomes a provisioning plan rule called from the lifecycle workflow. The request shape is generated, while the distinguished name and attribute values are carried as comments holding the original C#, because a mistranslated distinguished name puts accounts in the wrong organizational unit.

Azure IAM points to a public test anyone can repeat. Microsoft publishes a sample MIM configuration, the Contoso Pilot estate, alongside the Configuration Documenter. Feeding the two Contoso reports through the transformation produces 18 BeanShell rules, of which 6 are finished and 12 are marked scaffolds, because the sample drives most of its flows through compiled rules extensions that a report cannot describe. Those 12 are scaffolds only because the assemblies are not part of the sample. The firm states that supplying the source, or decompiling the assemblies, turns them into finished rules.

Generated rules are not accepted on inspection alone. Azure IAM executes generated BeanShell through IdentityIQ's own interpreter during development, then runs MIM and IdentityIQ in parallel and compares what each system would send to connected systems. During that parallel run MIM remains the only system provisioning, and both run live until the comparison holds.

Microsoft's extended support for MIM 2016 SP2 runs through January 10, 2029, which leaves time to plan, though compiled extensions with no surviving source tend to be the item that slows discovery the most.

Organizations still running MIM can book a scoping call with Azure IAM at https://azureiam.com/contact to find out which of their rules extensions translate automatically and which need a human decision.

Contact Info:
Name: Robin Lilly
Email: Send Email
Organization: Azure IAM, LLC
Address: 2521 North Main Unit 1-276, Las Cruces, New Mexico 88001, United States
Website: https://azureiam.com

Source: NewsNetwork

Release ID: 89205001

In the event of encountering any errors, concerns, or inconsistencies within the content shared in this press release, we kindly request that you immediately contact us at [email protected] (it is important to note that this email is the authorized channel for such matters, sending multiple emails to multiple addresses does not necessarily help expedite your request). Our dedicated team will be readily accessible to address your feedback within 8 hours and take appropriate measures to rectify any identified issues or facilitate press release takedowns. Ensuring accuracy and reliability are central to our commitment.