Your organisation has clear agreements on access rights. Who gets access? Who approves it? And when are rights removed again? Yet some applications still fall outside that policy, because the integration with the Identity Governance & Administration (IGA) platform is still on the roadmap.
As a result, application onboarding is often a bottleneck in IGA programmes. Traditional connector development requires technical expertise, custom work, testing and maintenance. In the meantime, employees keep managing accounts and rights manually.
The AI-assisted connector wizard in Evolveum MidPoint 4.11 can lower that barrier. This creates room to bring more applications under identity governance. The real value lies in the control organisations can build as a result.
When integrations lag behind, governance falls behind too
At the start of an IGA programme, core systems usually take priority. Departmental applications, industry-specific software and in-house applications come later. That’s often where integration work piles up.
Take a manufacturing company with its own planning application. A local administrator creates accounts and adjusts rights after receiving an email. When someone leaves, a separate check has to confirm that their account has been removed as well.
So the central identity policy can be sound, while its execution remains incomplete. On top of that, access reviews require extra digging as long as the IGA platform can’t retrieve that data directly.
Less development work, more reuse
The connector generator in MidPoint 4.11 guides the development of low-code connectors for SCIM, REST and SQL integrations. AI analyses the application documentation and proposes schemas and connector scripts. The administrator then reviews the sources and proposals. Existing low-code connectors can also serve as a starting point.
This support fits a wide range of environments, from SaaS applications with SCIM to REST APIs and internal SQL databases. Teams have less work to do from scratch, which can reduce their dependence on scarce specialist development capacity.
Shared frameworks also provide a foundation for consistent, reusable integrations. That still requires design agreements and quality control. AI doesn’t make connectors uniform by itself.
Visibility first, automation second
More room for the substance of IGA
A working connector doesn’t determine who needs which access. Connector development is followed by mappings, correlation and synchronisation rules, among other things. Evolveum explicitly describes these as next steps, including verification through simulations.
Correlation deserves particular attention: which application account belongs to which person? A wrong match can assign rights to the wrong identity.
When technical preparation takes less time, IGA experts can focus more on roles, policies, data quality and governance. Together with application owners, they define what rights mean and how processes should work. To see how far that can go, read for example how we built a supplier portal natively in midPoint.
Based on ACEN’s experience with Identity Security and IGA, that’s where the biggest gain lies: a smaller gap between identity policy and day-to-day access management.
Faster development requires careful management
MidPoint’s open-source approach offers more control over architecture and configuration. The AI layer also leaves room for choice: organisations can host the generation service themselves and choose a suitable LLM. The AI services are optional.
That freedom of choice doesn’t guarantee digital sovereignty, though. If you use an external LLM provider, you need to assess what information it receives and which terms apply to processing, retention and reuse. Hosting and logging deserve attention too.
Digital sovereignty remains a choice
MidPoint’s open-source approach offers more control over architecture and configuration. The AI layer also leaves room for choice: organisations can host the generation service themselves and choose a suitable LLM. The AI services are optional.
That freedom of choice doesn’t guarantee digital sovereignty, though. If you use an external LLM provider, you need to assess what information it receives and which terms apply to processing, retention and reuse. Hosting and logging deserve attention too.
