Insights💡
In almost every first meeting, someone asks the same question before we even open a demo: can you connect to our systems?
They are rarely asking about Entra ID. They mean the HR system, the on-prem SQL database behind a business application, the file share nobody wants to touch, and the tool one team built ten years ago.
I lead delivery at Elimity, so I am the one who connects those systems with our customers. Here is how we get to first visibility in 2 days, and why it does not take a project per system.
Why connectors are where identity projects stall
In a classic IGA programme, a connector reads and writes. It has to, because the platform provisions accounts and changes access.
That write access comes at a price. Every connector needs a change process, a security review and an application owner who agrees to let a new tool make changes in their system. Multiply that by 40 systems and it is clear why those programmes connect the easy systems first and leave the rest for later.
The systems at the bottom of that list are often the ones nobody has looked at in years. They are exactly the ones you want to see.
Every unconnected system is a blind spot
The systems you cannot connect do not stop holding access. They just drop out of every decision you make about it.
An access review only covers what it can see. If the HR system, the on-prem database and the file share are missing, the review signs off on part of the picture. An auditor who asks who has access to what, under NIS2, DORA or ISO 27001, gets the same partial answer.
Attackers do not care which systems you connected. An orphaned account in an app nobody reviews is just as useful to them as one in Entra ID.
And the number of identities keeps growing. In a Cloud Security Alliance survey from April 2026, 82% of organisations found AI agents they did not know about in the past year. Every new agent is one more identity that has to show up somewhere.
Read-only changes the conversation
Elimity only reads. We do not provision accounts, we do not run joiner-mover-leaver processes and we never write anything back into your systems. That is a deliberate choice.
It completely changes the conversation with an application owner. The question is no longer "what will this tool change in my system?" but "which read account or export do you need?" There is no change process to start and no write connector to review.
That is the real reason we move fast. Not because we cut corners, but because there is far less to agree on.
Three ways in
Whatever the system, there is a way to connect it. We use three.
1. Built-in connectors. We have 60+ pre-built connectors for the directories, cloud platforms, SaaS apps, PAM tools and HR systems most organisations run, from Entra ID, Okta and AWS to Salesforce, ServiceNow and Workday. If you use Elimity as SaaS, they run through our own gateways, so you usually do not need to install anything.
2. Gateways and import agents for what sits behind your firewall. On-premises systems are rarely reachable from the outside, and they should not be. You can host a gateway yourself, inside your own network. For custom sources such as an SQL database or an LDAP directory, an import agent pushes the data to Elimity on a schedule you set. Today there are import agents for Active Directory, LDAP, SQL, SharePoint and Windows File Shares.
3. Files and open standards for everything else. If a system can export its users and permissions to a file, flexible file uploads turn that export into a source. Systems that speak SCIM or offer a REST API connect through those standards.
So when someone asks about the tool one team built ten years ago, my answer is usually the same: if it holds accounts and permissions, we can read it.
What the first weeks look like
This is the rhythm we see in our projects:
- Day 1: we connect your critical systems, usually your directory and your HR source.
- Day 2: first visibility. You see who has access to what, and which accounts are not linked to an employee.
- Week 1: you start cleaning up the first identity risks.
- Week 2: 10 sources are connected and kept up to date.
- Month 3: 40 systems are connected.
The order matters. Linking every account to a person through your HR source is what turns a pile of exports into answers.
One identity graph, not 40 spreadsheets
Every source lands in the same identity data graph. Each account is linked to the person behind it, and service accounts, API keys and AI agents sit in the same graph as your workforce.
That is where connecting pays off. Questions that used to mean a round of exports and spreadsheets get a direct answer:
- Which accounts belong to people who left?
- Who has admin rights, and who owns those accounts?
- Which service accounts have not been used in 90 days?
With Elimity MCP, you can even ask those questions in plain language from Copilot, Claude or ChatGPT. I wrote about that in Your identity data, one prompt away.
Already running an IGA?
Then keep it. Elimity reads your IGA as one more source, SailPoint IdentityIQ included, and covers the systems it does not reach. Visibility first, automation where it makes sense.
Don't see your system?
Take a look at every way Elimity connects, or request a connector. If it holds accounts and permissions, we will talk about how to read it.
See your own orphaned accounts, within days
Related article: Your identity data, one prompt away