Microsoft Identity Manager (MIM) 2016 is Microsoft's on-premises identity synchronization and provisioning server, with extended support ending in January 2029. Pages here cover replacing it with self-hosted midPoint or Apache Syncope.
Comparing MIM 2016 with midPoint for HR-driven provisioning and directory synchronization: MIM's Synchronization Service, Portal and SharePoint dependency against midPoint's Java and PostgreSQL stack, connector frameworks (ECMA 2.0 versus ConnId), policy, approval and certification features, and support timelines.
For MIM shops that mainly synchronize identities and run self-service password reset: how Apache Syncope's provisioning, ConnId connectors, end-user UI and REST API compare with MIM Sync and the MIM Portal, and what Syncope does not cover.
Moving MIM provisioning to midPoint: inventorying management agents, rules extensions and Portal workflows, mapping metaverse attribute flows to midPoint resources and object templates, running both in parallel against Active Directory, and switching off MIM sync runs per connected system.
Cost of ownership by component: Windows Server, SQL Server and SharePoint for MIM, Entra ID P1 or P2 for the extra support route, connector and rules-extension maintenance, against midPoint on Linux and PostgreSQL with an optional Evolveum subscription, plus migration and operations effort.
MIM 2016 extended support ends in January 2029 and several pieces (BHOLD, hybrid reporting, MFA Server integration) are already gone. This page sets out the decision timeline, what to retire now, and how long a move to midPoint or Microsoft Entra ID Governance takes.
Microsoft's path for MIM customers is Microsoft Entra ID Governance. This page is for organizations that need provisioning to stay on premises, in an air-gapped network or under EU control, and compares a self-hosted midPoint deployment with the cloud route.
BHOLD is no longer recommended and its Silverlight modules must be removed. This page maps BHOLD role-based attestation to midPoint roles and certification campaigns for organizations that will not move reviews to Entra ID access reviews.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.