Is Microsoft Entra ready to replace MIM?

It’s no secret that, while MIM continues to be supported, Entra is where Microsoft is directing its identity and access investment. With January 2029 approaching, organisations that rely on MIM need to begin planning what comes next.

The final MIM support date is not the only lifecycle concern. Components beneath MIM can follow different support timetables. The short interval between MIM 2016 SP3 becoming available and SharePoint Server 2019 reaching end of support is one example of the planning pressure this can create. Remaining on MIM means managing the support position of the wider platform, not only MIM itself.

Starting from what MIM does today

Before any migration begins you need a clear account of what MIM does today and which business outcomes depend on it.

MIM has lasted because it reliably reconciles identity data from several sources, applies business rules and aligns access across directories and applications. Over time, rules written for one department or acquisition can become dependencies elsewhere, leaving each estate with its own history and complexity.

That history records how the organisation has decided who should have access to what.

A successful move must preserve the outcomes the business relies on. Such as:

• Day-one access for starters
• Prompt removal for leavers
• Dependable sign-in throughout

It must also retain the operational knowledge held in the estate and by the people who maintain it.

MIM and Entra approach identity differently

MIM is built around a synchronisation engine, metaverse, management agents, rules extensions and workflows delivered through the MIM Service and Portal.

Entra combines provisioning, lifecycle workflows, entitlement management, access reviews and other cloud services, with Logic Apps and Azure resources extending the native capabilities where required.

The move is therefore not like-for-like.

Start with the outcome each MIM process delivers, then decide how Entra, Azure services or a changed business process can produce it. This also creates an opportunity to retire obsolete processes and redesign those shaped around MIM’s particular capabilities.

What Entra handles well today

Entra provides established capabilities for HR provisioning, lifecycle management, entitlement management, access reviews and application provisioning. Some transition scenarios still depend on preview features, additional Azure services or redesigned processes.

Where design work remains

A few areas need more than configuration and benefit most from early design work.

Multiple authoritative sources

MIM’s metaverse joins records from several systems and applies precedence rules to determine which source owns each attribute.

Entra has no direct metaverse equivalent, but API-driven inbound provisioning can accept data from multiple systems of record through separate provisioning applications.

The design still needs an explicit authority model for each attribute, with reconciliation performed before data reaches Entra where competing sources cannot be resolved safely in the provisioning layer.

Password synchronisation

Entra currently has no direct replacement for MIM’s Password Change Notification Service.

The options are to remove the dependency by updating or retiring applications, use a third-party service, or retain a small MIM deployment solely for password synchronisation while the remaining dependencies are phased out.

Certificate and smart card management

MIM Certificate Management scenarios can often be redesigned within the wider Microsoft estate rather than moved to a separate platform.

Microsoft Cloud PKI and Intune can provide cloud-based certificate authorities and automate certificate issuance and renewal for managed devices, while Entra supports modern, certificate-based and passwordless authentication.

Because Cloud PKI does not reproduce every MIM smart card lifecycle function, discovery should identify any remaining specialist requirements and determine whether they can be simplified, retired or addressed through other Microsoft capabilities.

Heavily customised Portal functions

Microsoft’s My Account, My Apps, My Groups, My Staff and My Access portals cover many standard self-service scenarios, but they do not reproduce a heavily customised MIM Portal as a single replacement experience.

Portal requirements should therefore be separated into the outcomes users need, then mapped to Microsoft’s portals, redesigned processes or a broader identity experience such as Alira.

These requirements do not prevent a move to Entra, but they determine what can move first, what needs a redesigned process or additional service, and where a smaller MIM footprint may remain temporarily.

How your use of MIM shapes the route

The route to Entra depends on how MIM is used. Most estates broadly fit one of three patterns:

1. MIM mainly supports scenarios Entra already covers
2. Most functions can move but a smaller set needs temporary coexistence
3. Reconciliation, certificate management and other specialist functions remain central to the estate

Where MIM is used mainly for HR provisioning, lifecycle processes, application provisioning and straightforward self-service access, Entra provides a strong foundation for phased transformation.

Complex rules, heavily customised Portal functions, PCNS dependencies and on-premises privileged access may still require process changes or extensions through Azure services.

Where most of the estate can move but a few scenarios depend on multi-source reconciliation, PCNS or complex custom logic, the remaining MIM footprint can be narrowed while those requirements are redesigned. For PCNS, a small MIM deployment can act as a temporary bridge while other functions move to Entra.

Where reconciliation, certificate management or other specialist functions remain central to the estate, MIM may need to stay in place for longer.

SP3 can provide a supported bridge, but this should sit alongside a defined exit plan.

Planning the transition

A credible transition plan must account for the technical estate, the business processes built around it and the people who depend on it.

Start with discovery

Establish which management agents, sync rules, workflows, Portal functions and business processes are in use, what depends on them and who owns them.

Secure leadership backing, then involve the teams affected by the change early enough for their requirements to shape the design. The technology is often the simpler part; the greater challenge lies in changing established processes and bringing people with the programme.

Sequence the work around what discovery finds

HR provisioning, lifecycle workflows, entitlement management and access reviews are natural early candidates where they match the required outcome. Connector reuse, multi-source reconciliation, customised Portal functions, PCNS and certificate management should be analysed early even if they move later.

Timescales depend on the estate

Timescales depend on the estate. Discovery comes first, followed by design, testing and phased migration. Decisions about data ownership may involve several business teams, while bespoke applications can extend the schedule. For a deeply embedded estate, January 2029 leaves little room for a late start.

Moving without disruption

Move each scenario only after the replacement design has been tested against the outcome MIM currently delivers. Validate joiner, mover and leaver processes, connector behaviour, approvals and exception handling before retiring the corresponding MIM function.

Where people interact with MIM directly, communicate what will change and when. Service desks, application owners and other dependent teams should be involved before the processes they rely on move.

The critical design work lies in understanding why each rule, connector and exception exists before deciding whether Entra should replace, simplify or remove it.

That requires knowledge of both MIM and Entra, together with the judgement to distinguish an essential business outcome from a workaround inherited from the current estate.

Transformation beyond the technology

The transition is an opportunity to retire processes that no longer add value and redesign the rest around current requirements.

Entra is not MIM in the cloud, nor is it intended to reproduce every MIM feature. It provides the central identity layer for Microsoft’s cloud-first model, with its power coming from how it works across Azure, Microsoft 365, Intune and the wider security ecosystem.

For most Microsoft estates, these connected capabilities can deliver the required identity outcomes without rebuilding MIM. Some scenarios will still need Azure extensions, process redesign or temporary coexistence.

That’s why we advocate for a phased transformation, migrating proven scenarios first, managing genuine exceptions deliberately and adopting new Microsoft identity capabilities as the platform continues to evolve towards 2029 and beyond.

We’ve put together some answers to common questions that we hope will help clarify things further. And, if you’re still unsure about how migrating from MIM to Entra would work in your estate, then please get in touch and we’ll talk it through with you.

Your MIM and Entra questions