Account Provisioning
Create user accounts across multiple customer tenants simultaneously.
Accounts are fully configured from the start with the right identity,
permissions, and access.
- Provision accounts to one or multiple tenants at once
- Apply templates for consistent role and group assignments
- Automatic UPN generation based on configurable patterns
- Secure password generation with customizable complexity rules
- Optional welcome email with credentials on first provisioning
Reusable Templates
Define standardized templates that describe exactly how an account
should be configured. Templates are the foundation for consistent
provisioning and drift correction.
- UPN prefix and suffix patterns with placeholders
- Directory role assignments (e.g. Global Admin, Exchange Admin)
- Security group and Microsoft 365 group memberships
- Access package assignments from Entra ID Governance
- License assignments (e.g. Microsoft 365 E3, EMS E5)
- Administrative unit scoping
Team Management
Organize your engineers into teams with department and company
context. Teams determine which users get provisioned and help you
manage access at scale.
- Import users directly from your Entra ID tenant
- Assign users to teams with department and company metadata
- Use teams for bulk provisioning across tenants
- Role-based access: Admin and Reader roles for your staff
Monitoring & Drift Correction
Continuously monitor all provisioned accounts against their templates.
When someone changes a role, removes a group, or modifies a license
in a customer tenant, Optymate detects and corrects it automatically.
- Scheduled monitoring on a configurable cron schedule
- Detect drift in roles, groups, access packages, and properties
- Automatic drift correction to re-apply the template state
- Strict enforcement: adds missing AND removes extra assignments
- Email notifications on drift detection
- Full audit trail of all corrections
Secure by Design — Zero Trust
Every aspect of Identity Sync is built on Zero Trust principles.
No passwords are stored, all authentication uses managed identities
and certificates, and all data stays in your own Azure subscription.
- Azure Managed Identity for service-to-service authentication
- Certificate-based authentication for customer tenants (Key Vault)
- No stored passwords — generated credentials are sent, not saved
- Data encrypted in transit (TLS) and at rest (Azure SQL)
- Role-based access control (Admin / Reader) with Entra ID
- IP restriction support for additional access control
- Full audit logging of all mutations
Email Notifications
Automatically send branded welcome emails when accounts are
provisioned. Emails include credentials and are fully customizable
with placeholder variables.
- Customizable email subject and body with HTML support
- Placeholders: %firstname%, %lastname%, %upn%, %password%, %tenant%, %team%
- Sent via Microsoft Graph using a configured sender mailbox
- Works with shared mailboxes — no extra license needed
Automatic Sync
Account properties are automatically synchronized from Entra ID
on a regular schedule. When a user's name or department changes
in your tenant, provisioned accounts are updated across all
customer tenants.
- Scheduled sync every 6 hours (configurable)
- Syncs display name, department, job title, and other properties
- Manual sync available per account or in bulk