Azure IAM Maps MIM PCNS Password Sync To SailPoint's AD Password Interceptor

Azure IAM, LLC explains what replaces Microsoft Identity Manager's Password Change Notification Service in a SailPoint IdentityIQ migration, how the AD Password Interceptor takes over, and how to cut password sync over target by target without a gap.

Las Cruces, United States, October 24, 2026 /NewsNetwork/ -- Password synchronization is the MIM feature most migration plans forget until the week of cutover. Teams moving from Microsoft Identity Manager (MIM) to SailPoint IdentityIQ inventory management agents, attribute flows, and workflows, then discover that a mainframe, an LDAP directory, or a line of business database has been receiving Active Directory password changes through MIM for a decade. The question that follows is what replaces MIM PCNS password sync after a move to SailPoint IdentityIQ. Azure IAM, LLC, an independent identity consulting firm, says the answer is SailPoint's Active Directory Password Interceptor, and the work is less about the agent than about the cutover order. The firm documents its MIM to SailPoint method at https://azureiam.com/mim-to-sailpoint.

How MIM does it today. Microsoft's Password Change Notification Service has three moving parts on every domain controller: a password filter, Pcnsflt.dll, loaded by the Local Security Authority; the PCNS service, which queues each change and encrypts it; and configuration stored in Active Directory and managed with pcnscfg.exe. PCNS authenticates to the MIM server through a Kerberos service principal name and delivers the change over encrypted RPC. MIM then finds the user's connector space object, follows the join table, and pushes the new password to every management agent with password sync enabled. Directory agents handle the set natively. File, database, and extensible connectivity agents need a .NET password extension DLL, which is custom code. An inclusion group and an optional exclusion group decide whose passwords leave the domain, typically Domain Users in and Domain Admins out.

How SailPoint does it. The AD Password Interceptor is an agent installed on every domain controller in the domain. When a user changes a password, Active Directory hands the agent the sAMAccountName and the new password, and the agent sends the change to IdentityIQ over its web services port. IdentityIQ then acts as the provisioning engine, running a workflow that pushes the password to each target application through that application's connector. The first domain controller set up becomes the primary, and the rest receive the replicated configuration and keys during installation. IQService, the Windows helper IdentityIQ uses for Active Directory provisioning, is not part of the interceptor path. SailPoint has deprecated interceptor versions 20.0.0 and below, so new deployments start on a current release.

Azure IAM sorts the migration work into five items.

Inventory every password sync target. The MIM configuration shows which management agents have password sync enabled and which rely on a password extension DLL. Each extension DLL is a small rules project of its own: its set and change logic moves into the IdentityIQ connector's password operation or a provisioning rule.

Rebuild the scoping. The PCNS inclusion and exclusion groups live in PCNS configuration, not in IdentityIQ. The same boundary, especially keeping privileged accounts out, has to be rebuilt in the IdentityIQ password workflow and tested with real accounts from each group.

Open the right network paths. PCNS talks to MIM over Kerberos and dynamic RPC ports. The interceptor needs a route from every domain controller to at least one IdentityIQ server on its web services port. That is a firewall change request that should be filed in the first week, not the last.

Run both, cut over by target. Microsoft documents that the PCNS filter runs alongside other password filters on a domain controller, so PCNS and the interceptor can coexist during a parallel run. Only one system should set the password on any given target at a time. Azure IAM moves targets from MIM to IdentityIQ one at a time, verifies each with a test account from the inclusion group and one from the exclusion group, and confirms queue and retry behavior while IdentityIQ is briefly unavailable before trusting it in production.

Decommission cleanly. After the last target moves, PCNS is uninstalled from each domain controller in a change window that includes the restart, the MIM target is removed with pcnscfg, and the service principal name is deleted. The PCNS schema extension stays, because Active Directory schema additions cannot be deleted, only left unused.

None of this changes the direction of the flow. MIM does not support bi-directional password sync, and neither design should: Active Directory remains the source of the password, and every target receives it. Azure IAM scopes MIM to SailPoint migrations, password sync included, on a fixed fee and offers a scoping call at https://azureiam.com/contact.

Contact Info:
Name: Robin Lilly
Email: Send Email
Organization: Azure IAM, LLC
Address: 2521 North Main Unit 1-276, Las Cruces, New Mexico 88001, United States
Website: https://azureiam.com

Source: NewsNetwork

Release ID: 89207265

Should you identify any discrepancies, concerns, or inaccuracies in the content provided in this press release or require assistance with a press release takedown, we strongly urge you to notify us promptly by contacting [email protected] (it is important to note that this email is the authorized channel for such matters, sending multiple emails to multiple addresses does not necessarily help expedite your request). Our responsive team is committed to addressing your concerns within 8 hours by taking necessary actions to resolve identified issues diligently or guiding you through the necessary steps for removal. Our dedication lies in providing accurate and reliable information.