> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/administration-guide/lifecycle.md).

# Connect applications and automate lifecycle

Connect an application to OpenIAM and automate the identity lifecycle — joiner, mover and leaver processing, account creation, attribute updates, imports, drift detection and retirement — in the order

## What this is, and when you need it

This section owns everything between "OpenIAM decided this person should have an account" and "the account exists in the target with the right attributes" — the delivery half of the **identity lifecycle**, and the machinery behind joiner-mover-leaver (**JML**) processing — joiner, mover and leaver events, in OpenIAM's own words. It is for the administrator onboarding an application, standing up an authoritative feed, or working out why a change in OpenIAM did not reach a managed system. Four mechanisms do that work, they share objects but fail independently, and keeping them apart is the single most useful thing you can do early:

| Mechanism           | Direction                                | Runs when                                                           | Page that owns it                                                                          |
| ------------------- | ---------------------------------------- | ------------------------------------------------------------------- | ------------------------------------------------------------------------------------------ |
| **Synchronization** | source → OpenIAM                         | manually, or on a schedule                                          | [Set up a synchronization](/administration-guide/lifecycle/synchronize-and-import-data.md) |
| **Policy map**      | calculates the outbound attribute set    | inside every provisioning operation                                 | [Build a policy map](/administration-guide/lifecycle/policy-map.md)                        |
| **Provisioning**    | OpenIAM → managed system                 | on user save, entitlement change, business rule or request approval | [Configure provisioning](/administration-guide/lifecycle/configure-provisioning.md)        |
| **Reconciliation**  | compares both sides, can write to either | manually, or on a schedule                                          | [Configure reconciliation](/administration-guide/lifecycle/configure-reconciliation.md)    |

## Start here

Build one application at a time, in this order. Each page assumes the one before it, and skipping ahead produces failures that look like the wrong thing.

1. [Choose an onboarding pattern](/administration-guide/lifecycle/onboarding-patterns.md) — decide whether this application needs a connector at all.
2. [Configure a managed system](/administration-guide/lifecycle/configure-managed-system.md) — the endpoint, the credential and the connector-specific fields.
3. [Build a policy map](/administration-guide/lifecycle/policy-map.md) — nothing reaches a target that is not on a policy map row.
4. [Verify connectivity to the target](/administration-guide/lifecycle/verify-connection.md) — before you trust a green row.
5. [Configure provisioning](/administration-guide/lifecycle/configure-provisioning.md) — create, modify, disable, set password and deprovision, on one disposable user, verifying at the target each time.

Then reconciliation, report-only first, and only after two repeatable manual runs put anything on a schedule. [Simulation mode](/administration-guide/lifecycle/simulation-mode.md) holds the first real connector operation for review instead of sending it.

## Choose your outcome

| I want to…                                                                               | Go to                                                                                                                                                                 |
| ---------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Decide whether this application needs a connector at all                                 | [Choose an onboarding pattern](/administration-guide/lifecycle/onboarding-patterns.md)                                                                                |
| Understand connector package versus connector definition versus managed system           | [Connectors and managed systems](/administration-guide/lifecycle/connectors-and-managed-systems.md)                                                                   |
| Fill in the managed-system form, including connector-specific fields                     | [Configure a managed system](/administration-guide/lifecycle/configure-managed-system.md)                                                                             |
| Find out why a managed system shows green but nothing works                              | [Verify connectivity to the target](/administration-guide/lifecycle/verify-connection.md)                                                                             |
| Decide which attributes are sent, and how each one is calculated                         | [Build a policy map](/administration-guide/lifecycle/policy-map.md)                                                                                                   |
| Run logic before or after every provisioning operation                                   | [Attach a provisioning processor](/administration-guide/lifecycle/provisioning-processors.md)                                                                         |
| Understand what triggers provisioning, and recover a failed request                      | [Configure provisioning](/administration-guide/lifecycle/configure-provisioning.md)                                                                                   |
| Import identities from HR, a directory, a database or a custom source                    | [Set up a synchronization](/administration-guide/lifecycle/synchronize-and-import-data.md)                                                                            |
| Load a user CSV                                                                          | [Import users from a CSV file](/administration-guide/lifecycle/synchronize-and-import-data/import-users-from-csv.md)                                                  |
| Load roles, groups, organizations or entitlement memberships                             | [Import roles, groups, organizations and entitlement memberships](/administration-guide/lifecycle/synchronize-and-import-data/import-roles-groups-and-memberships.md) |
| Put a feed on a schedule, or make it incremental                                         | [Schedule an incremental synchronization](/administration-guide/lifecycle/synchronize-and-import-data/incremental-synchronization.md)                                 |
| Feed the same people from two sources without one overwriting the other                  | [Import from two authoritative sources without overwriting](/administration-guide/lifecycle/synchronize-and-import-data/import-from-two-authoritative-sources.md)     |
| Understand matching, orphans, and why a clean run changed the wrong person               | [How a synchronization matches and processes a record](/administration-guide/lifecycle/synchronize-and-import-data/synchronization-matching-and-processing.md)        |
| Change what a feed asserts about a user                                                  | [Edit a synchronization transformation script](/administration-guide/automation/synchronization-scripts.md)                                                           |
| Hold connector operations for human review before they are sent                          | [Simulation mode](/administration-guide/lifecycle/simulation-mode.md)                                                                                                 |
| Detect and act on drift between OpenIAM and a target                                     | [Configure reconciliation](/administration-guide/lifecycle/configure-reconciliation.md)                                                                               |
| Write a reconciliation population, query or match script                                 | [Reconciliation scripts](/administration-guide/lifecycle/reconciliation-scripts.md)                                                                                   |
| Grant baseline access automatically from identity attributes                             | [Grant birthright access](/administration-guide/lifecycle/birthright-access.md)                                                                                       |
| Stop a leaver's access end to end: terminate, deprovision, revoke and end their sessions | [Offboard a leaver end to end](/administration-guide/lifecycle/offboard-a-leaver.md)                                                                                  |
| Disable people automatically when their end date passes                                  | [Disable leavers automatically on their end date](/administration-guide/lifecycle/disable-leavers-automatically.md)                                                   |
| Retire an integration without stranding its accounts                                     | [Decommission a managed system](/administration-guide/lifecycle/decommission-a-managed-system.md)                                                                     |
| Handle future starts, leave, transfers, terminations, rehires and two HR sources         | [Advanced lifecycle patterns](/administration-guide/lifecycle/advanced-lifecycle-patterns.md)                                                                         |
| Look up a field on the policy map form, or what a policy map row can hold                | [Policy map reference](/administration-guide/lifecycle/policy-map/policy-map-reference.md)                                                                            |
| Look up what a provisioning processor may read, return or safely mutate                  | [Provisioning processor reference](/administration-guide/lifecycle/provisioning-processors/provisioning-processor-reference.md)                                       |
| Look up a field on the managed-system form, or what reaches the connector request        | [Managed system fields and the connector request](/administration-guide/reference/managed-system-fields.md)                                                           |
| Look up a field on the synchronization form for my source type                           | [Synchronization configuration fields](/administration-guide/reference/synchronization-configuration-fields.md)                                                       |
| Look up what a reconciliation situation response will actually write                     | [Reconciliation situations and responses](/administration-guide/reference/reconciliation-situations-and-responses.md)                                                 |
| Look up which connectors ship, and what each one supports                                | [Shipped connectors](/administration-guide/reference/shipped-connectors.md)                                                                                           |

## What this section does not own

* **Installing, registering, upgrading or securing a connector package**, and the target-side permissions it needs — **Connector Configuration Guide**.
* **Modelling** roles, groups, resources and organizations — [Model and grant access](/administration-guide/access.md).
* **Requestable** rather than automatic access, and manual fulfilment tasks — [Configure requests and approvals](/administration-guide/requests.md).
* **Sign-in** protocols — [Configure federation and application SSO](/administration-guide/federation.md).
* **Certification and SoD** — [Govern access](/administration-guide/governance.md).

## The evidence chain

Every consequential procedure in this section ends at a different place from where it started. In order:

`configuration saved` → `audit event` → `provisionrequest` doc → `provisionconnectorrequest` doc → `connectorreply` doc → `Login.PROV_STATUS` → the object in the target

Those four indexes are named in [Search indexes and the authorization graph](/administration-guide/reference/search-indexes.md). `Login.PROV_STATUS` holds a `ProvLoginStatusEnum` value; `SAVED`, `CREATED`, `UPDATED`, `ENABLED`, `DISABLED` and `DELETED` are terminal successes, and anything beginning `FAIL_` or `PENDING_` is not. A `Save` message in the browser proves only that the first arrow was taken.

{% hint style="warning" %}
Two shipped defaults in this section surprise people:

**A managed system with no `ON_DELETE` resource property deletes target accounts.** An absent or blank value is coerced to `DELETE`. If your policy is "disable, never delete", you must add the row. See [The `ON_DELETE` resource property](/administration-guide/lifecycle/configure-provisioning.md#the-on_delete-resource-property).

**Provisioning is on.** `org.openiam.provision.service.flag` and `org.openiam.provision.service.user.entitlements.flag` both ship `true`, so saving a user reaches every managed system they are entitled to as soon as one exists.
{% endhint %}

## Related

* [Change configuration safely](/administration-guide/start/change-safely.md) — the change, test and rollback standard every page here assumes.
* [Shipped batch tasks](/administration-guide/reference/shipped-batch-tasks.md) — what is already running on a schedule.
* [Synchronization script contracts](/administration-guide/reference/synchronization-script-contracts.md) — what a feed's transform, validation and attributes scripts may return.

*Applies to OpenIAM 2026.8.1. Last reviewed 7 August 2026.*


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.openiam.com/administration-guide/lifecycle.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.