Microsoft Identity Manager vs midPoint: which fits your provisioning estate
If your Microsoft Identity Manager 2016 estate is approaching the January 2029 extended support end and you still run HR-driven joiner, mover and leaver flows through its Synchronization Service, MIM remains the lower-change option while your connected systems are mostly Active Directory and Exchange, your rules extensions are small, and your Portal workflows are stable. midPoint becomes the better fit when you want provisioning logic expressed as roles, object templates and policies rather than custom code, when you need built-in certification campaigns, or when your target systems are growing beyond what your team wants to maintain as bespoke management agents. Either way, the decision should be made before your next renewal, because the migration effort is driven by the estate you have today, not by the product you pick.
Start with an inventory of what the decision turns on. Count your connected systems and classify each one: which have a supported connector in the Evolveum connectors catalog, which need a community or experimental connector, and which would need a custom ConnId connector written in Java. Next, list every custom rules extension and every Portal workflow, SharePoint site or form that depends on MIM, since these are the items that carry the most rework. Then check the skills your team has. midPoint is written in Java and uses PostgreSQL as its native repository, so a team that already runs Java services and PostgreSQL will move faster than one that depends on SQL Server and the MIM tooling. Confirm the current midpoint.home layout and system requirements against the midPoint system requirements page before sizing hosts.
Finally, decide whether you want a commercial support route. midPoint is open source with no enterprise edition, and Evolveum offers Product Support subscriptions for bug resolution with an 8x5 next-business-day or 24x7 SLA, plus Platform Subscriptions that add feature development. Ask Evolveum for current pricing and terms in writing, and ask DeployOpen or another implementation partner for a fixed-scope quote covering connectors, object templates, testing and hardening. Keep in mind that subscription cost recurs annually, while implementation and migration are largely one-time, so compare both options over the same period when you build the business case.
Which option fits which scenario
This table matches common Microsoft Identity Manager buyer scenarios to the better fit between staying with MIM 2016 and moving to self-hosted midPoint. Read each row for the condition that tips the decision, since the right answer usually depends on target systems, operating skills and whether you need vendor support.
| Scenario | Better fit | Condition that makes it so |
|---|---|---|
| Stable AD-centric sync with little change planned | Stay on MIM until the replacement plan is set, then reassess | Your MIM sync rules still run cleanly and the only targets are Active Directory and Entra ID. Confirm your extended support date and plan the move well before January 2029. |
| Heavy HR-driven provisioning to non-Microsoft targets | midPoint | You provision from an HR source to LDAP, databases, SCIM or SaaS applications through ConnId connectors. midPoint's object templates and resource model are built for these lifecycle flows, but confirm each connector's support status first. |
| Air-gapped or EU-controlled estate | midPoint | Your rules require provisioning to stay on premises or inside EU control with no cloud dependency. midPoint runs on Linux and PostgreSQL, so confirm your own offline update and licensing process. |
| Windows-only operations team | Stay on MIM for now, or plan a skills build for midPoint | Your staff know Windows, SQL Server and the MIM Synchronization Service, but not Java or PostgreSQL. Budget time for training or a partner before any cutover. |
| Need for certification campaigns | midPoint, if your reviews fit its model | You need periodic access reviews with reviewer workflows and evidence. Confirm that midPoint's certification features cover your campaign types, and check whether BHOLD attestation is also in scope. |
| Need for a vendor-backed support contract | midPoint with an Evolveum subscription, or a fixed-scope partner for support | You need a contractual response commitment. Evolveum offers Product Support subscriptions with 8x5 next-business-day or 24x7 SLA options, so compare these with your current MIM support route. |
| Need to keep MIM Portal self-service workflows | Neither directly; plan a redesign | Your users rely on the MIM Portal and SharePoint for requests. midPoint provides self-service access requests and password reset, but the workflows, forms and approvals must be rebuilt and tested. |
| Plan to move to Microsoft Entra ID Governance | Entra ID Governance, if cloud is acceptable | Your identity data and governance can move to Microsoft's cloud service. Choose midPoint instead when on-premises control, air-gapped operation or EU-only processing is a requirement. |
Where the data sits and who controls it
Both products run on infrastructure you choose, so the decision is less about vendor hosting and more about what runs where and who holds the keys. The cards below cover the deployment models, the Windows dependency on the MIM side, the air-gap and EU control questions, and the parts of the identity stack midPoint does not cover.
On-premises hosting for both
MIM 2016 and midPoint both run entirely inside your own data center, private cloud or air-gapped network, so identity data stays in systems you operate. Neither product requires a vendor-hosted tenant to function. Confirm with your own architecture team that the chosen hosting location meets your data residency rules for directory extracts, logs and backups, since those copies travel with the deployment.
Linux and Docker for midPoint
midPoint runs on Linux in a virtual machine or from Docker images, with PostgreSQL as its native repository database, ideally on a separate database server. Multi-node deployments add a sticky HTTP load balancer and a shared central database. Ask your platform team whether your container and database standards cover this layout and who patches the Java runtime and the database.
MIM depends on Windows and SQL Server
MIM Synchronization Service, Portal and SharePoint components sit on Windows Server with SQL Server behind them. Moving to midPoint therefore changes the operating system and database estate that your security team must patch, back up and harden. Inventory which of these Windows and SQL instances hold identity data and plan their retirement alongside the midPoint build.
Air-gapped and EU-controlled operation
A self-hosted midPoint can be deployed in a network with no outbound internet access, with its packages and Docker images mirrored internally, which keeps provisioning decisions inside the boundary. The same applies where EU control is required. Check that your internal mirror, licence file handling and connector source code review processes work without external access before you commit to a design.
Audit log retention and key custody
Provisioning audit trails, certification records and connector credentials are the evidence and the risk in both products. Confirm how long your audit logs must be kept, where they are stored, and who can read or alter them. Also confirm who holds the encryption keys and service account passwords used by connectors, because that custody model is yours to define in either product.
Plan SSO separately
midPoint is an identity management system, not an access management or SSO server, and it does not implement the server side of OAuth2, OpenID Connect or SAML. Its own user interface can authenticate against an external SSO service, so you must select and run that service yourself. Decide the SSO platform early, because login flows, MFA and session policy will not come from midPoint.
What midPoint's open licensing changes for the buyer
The core question for a buyer is what the license lets you do without asking anyone. midPoint's repository is licensed under the European Union Public License (EUPL-1.2), with Apache 2.0 as a secondary license, and Evolveum states that midPoint has no enterprise edition and that every line of its code is published under open source licenses. The project describes itself as open source, not open core, which means features you need for production are not held back in a paid tier. Ask your legal team to confirm which license applies to the exact release and artifacts you plan to deploy, and to review how EUPL-1.2 obligations interact with your internal modifications, connectors and distribution model before you build on it.
Evolveum funds development through subscriptions, training and professional services, and states that midPoint developers work on it full-time. Two paid options exist: Product Support subscriptions for resolving product bugs, offered with an 8x5 next-business-day or 24x7 SLA, and Platform Subscriptions that add feature development and roadmap influence. The Evolveum support subscriptions page lists no prices, so you should request a written quote that states the SLA tier, the covered midPoint release line, the number of environments, and whether feature development is included. Treat the subscription as optional: you pay for response commitments and roadmap input, not for the right to run the software.
Microsoft Identity Manager carries a different set of cost dependencies. MIM 2016 runs on Windows Server with SQL Server for its databases, and the SharePoint-based Portal is part of the usual deployment, so license entitlements, server operating system and database renewals, and the Microsoft support route all sit in the budget alongside the product itself. Confirm your current entitlements with your Microsoft account team and your licensing advisor, and compare the full stack rather than the MIM product line alone. The cost comparison in its own section sets out the components in detail.
Cost components on each side
Replacing MIM with midPoint changes which costs you carry, not just the license line. Most of the spend on either side sits in people, connectors and hosting, so compare the components one by one before comparing totals.
Windows Server and SQL Server for MIM
MIM 2016 runs on Windows Server with a SQL Server database for the Synchronization Service and Service and Portal. Both carry Microsoft licensing that you hold for the life of the deployment, and the core count and edition you need depend on how many management agents and connected systems you run. Ask your Microsoft licensing partner which editions and core counts your current MIM footprint requires, and whether your existing agreements already cover the servers you would retire.
SharePoint for the MIM Portal
The MIM Portal depends on SharePoint for its user interface and workflow surfaces, so SharePoint farm licensing and its server maintenance sit inside the MIM cost base. Retiring the Portal removes this dependency, but only after you have confirmed which self-service flows users rely on. Inventory those flows before you count the SharePoint cost as saved.
Entra ID P1 or P2 for support routes
Some support or identity features that sit alongside MIM require Microsoft Entra ID P1 or P2 licensing. Whether your organization pays for these only to keep a route open is a question for your Microsoft account team, and the answer changes if your sync scope or licensing agreement changes. Treat this as a recurring cost to verify per user, not as an assumed part of the MIM bill.
Connector and rules extension upkeep
Custom MIM rules extensions and management agents are code that your team or a partner maintains, tests on each Windows or SQL patch and rebuilds when a target system changes. On the midPoint side, connectors are ConnId Java code, and the supported ones come with the project, while community or experimental connectors may need your own maintenance. Ask which connectors you would need, their support status and who owns patching for each one.
midPoint hosting and PostgreSQL
midPoint runs on Linux in a virtual machine or from Docker images and uses PostgreSQL as its native repository, ideally on a separate database server. These are infrastructure costs you pay to your cloud or data center provider, and they recur with capacity, backup retention and high availability design. Ask for a sizing that states node count, database placement and the cache and task scheduling requirements for your identity volume.
Optional Evolveum subscription
midPoint has no license fee, but Evolveum sells Product Support subscriptions for resolving product bugs, with an 8x5 next-business-day or 24x7 SLA, and Platform Subscriptions that add feature development and roadmap influence. Whether you buy one is a risk decision: compare the subscription with the cost of your own support staff and a partner retainer. Request the current price list and the SLA terms in writing, since the public page lists no prices.
Migration effort and operations staffing
Migration is largely one-time work: inventorying management agents and Portal workflows, mapping attribute flows to midPoint resources and object templates, and running both systems in parallel. Operations staffing recurs, covering midPoint administration, PostgreSQL and Linux patching, and connector work. Ask any implementation partner for a fixed scope with deliverables and a timeline agreed in writing before work starts, and ask which of these items are one-time and which are retainers.
What a move from MIM to midPoint involves
The sequence turns MIM's current provisioning behavior into a documented midPoint design, proves it side by side with production data, and then retires MIM sync one connected system at a time. The scope of each step depends on what the inventory finds, so no fixed duration is given here.
Inventory management agents, rules and Portal workflows
Your team lists every MIM management agent, including the connected systems, their sync rules and any custom rules extensions, and every Portal workflow that creates, changes or removes identities or access. Record which systems are fed from the HR source, which are written to, and which steps are manual approvals. The output is a signed-off inventory that names each flow, its owner and the business reason it exists. Ask DeployOpen or your integrator to review it before design starts, because the inventory sets the sequence and scope of everything that follows.
Map metaverse attribute flows to midPoint
For each attribute in the MIM metaverse, document its source, its transformations and its target, then translate that map into midPoint resources, object templates, mappings and roles. Rules extension logic is re-expressed as midPoint mappings, expressions or policies where possible, and any logic that cannot be translated is flagged for a separate design decision. The check that closes this step is a mapping workbook that a reviewer from HR and the directory team has approved line by line.
Stand up midPoint on Linux with PostgreSQL
Install midPoint on Linux, either in a virtual machine or from Docker images, using the Java version that matches the release you choose (the midPoint system requirements list Java 25 for 4.11 and later and Java 21 for 4.10 and older). Place the PostgreSQL repository on a separate database server, as the documentation recommends, and plan the multi-node layout early if you need more than one midPoint node behind a sticky HTTP load balancer. Confirm the release you deploy against the midPoint releases page, since support windows differ between LTS and feature releases. The step is done when a test instance starts, connects to its database and passes your build checklist.
Connect systems through ConnId connectors
Configure a midPoint resource for each connected system, using the ConnId connectors that match your targets, such as the Active Directory and LDAP connectors for directory work. Where a connector is not listed as supported in the catalog, record it as a risk and decide with the vendor or the community whether it is acceptable. Your team should test read and write access per system in a non-production environment. The output is a connection test log per resource with the account and group schemas that midPoint discovered.
Run both in parallel against Active Directory
Point midPoint at a non-production or read-only scope of Active Directory while MIM continues to own production writes, then compare the changes each platform would make for the same HR records. Use the midPoint simulation capability where it fits your change review, and log every difference as either a defect in the new design or an intended improvement. The step closes when the two platforms agree on the agreed set of cases for a set period that your change board approves.
Test joiner, mover and leaver cases
Build a test set that covers new hires, transfers between departments or locations, role changes, leavers, rehires and contractors whose access ends on a fixed date. For each case, record the expected result in every target system, then run the case in midPoint and check the account state, group membership and any notification that MIM previously sent. Include the failure paths, such as a missing manager, a duplicate account name or a target system that is offline. The check that closes this step is a signed test report that the HR owner and the security team accept.
Switch off MIM sync per connected system
Move one connected system at a time from MIM to midPoint as the owner of writes, starting with the system that carries the least risk. Disable the MIM management agent for that system only after the midPoint resource has been running in production for a period your change process sets, and keep a documented rollback path that re-enables the agent. Track each switch in your change register with its date, owner and reconciliation result. Done means MIM no longer writes to that system and its logs show no pending exports.
Decommission MIM and archive its records
Once every connected system is running on midPoint and the rollback window has closed, stop the MIM Synchronization Service and Portal, remove the agents and retire the SQL Server and SharePoint components that existed only for MIM. Archive the MIM configuration, the rules extensions source, the Portal workflow definitions and the test evidence so auditors can trace past decisions. Confirm with your compliance team which records they must retain and for how long. The step is complete when the decommission record is signed and the archive is verified as readable.
How much operating effort midPoint asks for
midPoint runs on Java, and the recommended runtime depends on the release. For version 4.11 and later, Evolveum recommends Java 25, with Java 21 supported. For 4.10 and older, Java 21 is recommended and Java 17 is supported. Check the midPoint system requirements against the exact release you plan to deploy, because the JVM choice sets your patching cycle and the base image you certify. midPoint uses PostgreSQL as its native repository database and recommends running it on a separate database server, so plan a database host, its backups and its patching alongside the application nodes.
MIM 2016 has a different operating shape. Its Synchronization Service, Portal and SharePoint components sit on Windows Server with SQL Server, so most of your existing skills are in Windows administration, SQL Server maintenance and SharePoint. midPoint shifts the effort toward Linux or Docker hosting, PostgreSQL administration, JVM tuning and HTTP load balancing. For a multi-node deployment, expect a sticky HTTP load balancer in front of the nodes, a shared central database, cache invalidation between nodes over HTTPS, and Quartz for distributed task scheduling. Each of these is a component your operations team must monitor, back up and test during failover, and none of them exists in a single MIM server design.
The skills gap is the real planning question, and it is one this page cannot answer for your organization. Confirm internally whether your team has Java application operations experience, PostgreSQL administration, Linux hardening and load balancer configuration, and who owns connector and object template changes after go-live. Ask any implementation partner to state in the written scope which of these tasks they will perform, which they will hand over and what training is included. Also confirm your own change control and recovery targets for the midPoint database and cluster before you size the environment.
Questions buyers ask before choosing midPoint over MIM
Can midPoint replace MIM's Synchronization Service one-for-one?
No, not as a direct swap of components. midPoint covers the same core job of synchronizing identities and provisioning accounts, but it uses its own model of resources, object templates, mappings and synchronization rules rather than MIM's metaverse and management agents. Expect to redesign attribute flows instead of copying them. Map each MIM management agent and its rules extension to a midPoint resource and its logic, then confirm with a proof of concept that every flow your HR source depends on has a clear equivalent. Connectors are built on the ConnId framework, so check the connector list for each system you run today.
How long does a move from MIM to midPoint take?
The duration depends on what you run, not on the product alone. The main drivers are the number of connected systems and their connector coverage, the count and complexity of custom rules extensions and Portal workflows, the quality of your HR source data, and how many approval and certification steps must be rebuilt. Parallel running against Active Directory adds time but reduces cutover risk. The migration guide sets out the inventory and cutover steps in more detail. Ask any implementation partner for a written, fixed scope and timeline based on your own inventory before committing.
Can our own team run the migration without outside help?
Possibly, if you already have Java, PostgreSQL and Linux operations skills, plus engineers who understand MIM's sync rules and your directory design. midPoint uses an XML and object-based configuration model and a Java connector framework, so the learning curve sits in identity modeling, not in writing a new platform from scratch. Plan for people who can own object templates, connector configuration, testing and day-two operations. Many teams combine internal ownership with a fixed-scope implementation engagement for the parts they have not done before.
What do we need from our own staff during the migration?
You need the people who know your identity data and your business rules. That means HR system owners who can confirm joiner, mover and leaver events, directory administrators who understand OU and group design, application owners for each connected system, and a security or compliance lead who approves the access model. Expect them to review mappings, test provisioning results and sign off on certification campaigns. Agree in writing who approves each phase, because delays usually come from waiting on those decisions rather than from the technology.
Does midPoint have an equivalent for MIM Portal workflows?
midPoint provides approval workflows, self-service access requests and certification campaigns, but it does not replicate MIM Portal screens one to one. Inventory each Portal workflow, form and approval path in MIM, then confirm how midPoint handles the same step, including its self-service interface and approval configuration. Some custom Portal behavior will need redesign or custom development. Ask the vendor or implementer to demonstrate each workflow against your own approval scenarios before you retire the Portal.
Should we buy an Evolveum subscription for midPoint?
midPoint is open source with no license fees, and Evolveum has no enterprise edition, so the subscription is optional. Evolveum offers Product Support subscriptions that resolve product bugs with an 8x5 next-business-day or 24x7 SLA, and Platform Subscriptions that add feature development and roadmap influence. Evolveum's page lists no prices, so request a quote. Decide based on how much vendor-backed response time your operations require, and remember that internal staff or a separate implementation partner still carry the configuration work.
When should we stay on MIM during its extended support?
Stay on MIM while your migration is in progress, while your team is still validating midPoint in parallel, and until every connected system you rely on has a tested replacement. MIM 2016 extended support ends in January 2029, so use that date as the outer limit rather than the target. Retire MIM features that are already unsupported, such as BHOLD and hybrid reporting, sooner. Keep MIM running only where it protects production access until cutover is complete and rollback has been tested.
When staying on MIM for longer is the right call
Staying on MIM 2016 is the lower-risk option only when several conditions hold at once. The first is that the management agents for your connected systems, such as Active Directory and your HR feed, run without manual intervention and have not needed rules extension changes in recent cycles. The second is that no HR system change is pending, such as a new HR platform, a revised employee data model or a new way of recording contractors, because each change would force rework of Synchronization Service rules at the moment the team has the least capacity. The third is that your operations team is Windows-only and skilled in MIM administration, so the Synchronization Service, its SQL Server databases and the Portal can be run without learning a new stack. The fourth is a signed decision to move to Microsoft Entra ID Governance, in which case MIM only needs to keep running until that migration completes.
Before you rely on MIM for the years ahead, confirm your exposure to the components Microsoft has already retired. BHOLD is no longer recommended and its Silverlight modules must be removed, so any role-based attestation that depends on it is already on borrowed time. Hybrid reporting and MFA Server integration are also gone, which means any report, multi-factor flow or helpdesk process built on them needs a replacement or a documented workaround today. Check your inventory of Portal workflows, custom extensions and scheduled jobs against these three items. Ask whether anything in your estate calls a retired component, and whether your internal runbooks still assume it works. Record each dependency as a dated item in the plan.
Treat the remaining support window as a planning constraint that sets the latest date for leaving. Extended support for MIM 2016 ends in January 2029, so the decision date you set must leave time for a parallel run against Active Directory and for switching off sync runs one connected system at a time. If you move to midPoint, the long-term support release midPoint 4.8 (Curie) is supported until October 17, 2028, while midPoint 4.9 support ends October 18, 2026, so choose a supported release line deliberately and check the midPoint releases page before you commit. Ask Microsoft or your licensing partner in writing what the Entra ID Governance route costs and covers for your environment. Staying on MIM is defensible only with a dated exit plan attached.
How DeployOpen helps evaluate, implement or migrate
DeployOpen plans, implements, customizes, integrates, hardens, backs up, upgrades and documents self-hosted midPoint inside your own infrastructure, including your cloud accounts, data centers or air-gapped networks. We start with a written scope that matches your MIM estate to the midPoint side, so the decision rests on your environment rather than on a generic comparison.
How we scope
- Inventory your MIM management agents, connected systems, rules extensions and Portal workflows before any design work starts.
- Agree in writing which HR sources, target systems and certification processes are in scope for the midPoint evaluation.
- Confirm the Java, PostgreSQL, Linux or Docker hosting model your security team will accept, and record it in the scope document.
- Engagements are fixed-scope, so deliverables and timelines are agreed in writing before work begins. Ongoing support is available as a retainer.
How we build
- Map metaverse attribute flows to midPoint resources, object templates and mappings, and document each decision for review.
- Build ConnId connector configurations for Active Directory, Entra ID and other agreed targets, and test them against non-production copies.
- Run MIM and midPoint in parallel against Active Directory and compare the resulting account and group changes before switching anything off.
- Harden the deployment, including database access, cache invalidation between nodes and backup procedures, and test the results.
How we hand over
- Deliver runbooks for operating midPoint nodes, the PostgreSQL database, scheduled tasks and connector upgrades.
- Document the migration cutover per connected system, including rollback steps and the MIM sync runs that are switched off.
- Provide compliance-readiness evidence, such as access control configuration and audit logging records, for your own auditors to assess.
- Train your identity and operations staff on role design, certification campaigns and day-to-day administration in midPoint.
How we support
- Offer ongoing support, upgrades and continuous testing as a retainer, aligned to the midPoint release calendar you choose.
- Plan each midPoint version upgrade in writing, including Java runtime changes, and test it in your environment first.
- Run security testing of the deployed identity platform and its connectors so that findings are tracked to closure.
- Confirm with Evolveum which support subscription your organization needs, since DeployOpen does not resell or certify that support.
