Every Microsoft Identity Manager (MIM) estate that plans a move to SailPoint IdentityIQ reaches the same inventory moment. Someone exports the management policy rules, counts the workflows behind them, and asks whether MIM action workflows and authorization workflows can be rebuilt as SailPoint workflows. Azure IAM, LLC, an independent identity consulting firm that runs MIM to SailPoint migrations, answers that question by workflow type, because each type lands somewhere different. The firm’s method is documented at https://azureiam.com/mim-to-sailpoint.
Why the question is harder than it looks
MIM workflows never run on their own. Each one is bound to a management policy rule (MPR), and the MPR decides when it runs. Request MPRs can bind authentication, authorization, and action workflows to a create, update, or delete request. Set transition MPRs bind action workflows to an object entering or leaving a set. The logic of a MIM estate is therefore split between the workflow, the MPR that triggers it, and the set definitions the MPR references.
IdentityIQ has none of those objects. A workflow there is a self-contained XML definition of steps, transitions, approvals, and BeanShell, started by a lifecycle request, a lifecycle event, or a task. Sets become populations, and Azure IAM translates set XPath into IdentityIQ filters emitted as GroupDefinition populations. The workflow itself has to absorb whatever the MPR used to decide.
Action workflows: converted, then merged
Action workflows carry most of a MIM estate’s joiner, mover, and leaver logic, and they convert the most completely. Function Evaluator activities hold real function expressions, and Azure IAM translates those deterministically into BeanShell. Email notification activities become IdentityIQ email templates.
The structural change is consolidation. MIM commonly implements one lifecycle event across several MPR and workflow pairs: one pair sets an attribute when a user enters the active employees set, another sends a welcome email, a third adds group membership. IdentityIQ wants one workflow per event. Azure IAM classifies every pair as joiner, mover, leaver, or unclassified, attaches the evidence behind each call, and has a human confirm or correct it. Confirmed pairs for the same event are merged into one consolidated workflow, with the translated BeanShell spliced in rather than regenerated.
The leaver is where the subtlety lives. In MIM, a transition MPR fires once, on the way into a set. A naive IdentityIQ lifecycle event that matches a state, such as inactive, would fire again on every refresh that sees it. The firm builds the leaver trigger to match a transition rather than a state, so a move from inactive to terminated does not rerun the workflow against an account that is already disabled.
Authorization workflows: mapped to approvals
An authorization workflow runs before a MIM request commits and can deny it. Its most common activity is Approval, which holds the request until a named approver or the requester’s manager responds. IdentityIQ expresses the same control through approval schemes and work items in its lifecycle request workflow, routed to a manager, an application owner, a security officer, or a named identity.
This is a mapping exercise rather than a code conversion. Azure IAM inventories each authorization workflow, the request types it gates, and who approves, then chooses the IdentityIQ approval that preserves the same control. Filter validation activities, which reject a request whose values break a rule, usually become form field validation or a policy check instead of a workflow step. The goal is that every approval an auditor relied on in MIM still exists, with the same approver, after cutover.
Authentication workflows: usually leaving for Entra ID
Authentication workflows gate self-service password reset with question and answer or one time password activities. IdentityIQ is not where most organizations want that function in 2026. In most current estates, password reset moves to Microsoft Entra ID self-service password reset, with writeback to on-premises Active Directory where needed. Azure IAM flags these workflows early so the password reset plan is not discovered during cutover week.
Custom activities: inventoried, never assumed
Many mature MIM estates extend workflows with the Microsoft Identity Manager Workflow Activity Library (MIMWAL). Its activities carry function expressions, and Azure IAM translates those into BeanShell backed by a shared MIMWAL helper library. Two kinds of extension are different: custom activities compiled as .NET assemblies, and scripts embedded in PowerShell activities. A documenter report shows that the activity exists but not what its code does. Azure IAM lists every custom activity in the migration caveats file, so its logic is reviewed and rebuilt as BeanShell on purpose instead of disappearing because no report could see it.
The timing change nobody budgets for
A MIM set transition fires when the request that changes membership is processed. An IdentityIQ lifecycle event fires when an identity refresh task notices the change. For most attribute updates that difference is invisible. For termination it can matter a great deal. Azure IAM identifies any process that depends on near real time behavior during scoping, so the refresh schedule and any event driven triggers are designed around it.
How converted workflows are proven
Generated workflows are not accepted on inspection. MIM and IdentityIQ run in parallel, with MIM as the only system provisioning to downstream systems. IdentityIQ aggregates, evaluates, and produces the provisioning it would send, and the two are compared until they agree. Workflow differences surface in that comparison, before any connected system is touched.
A worked example
Consider Contoso, a hypothetical organization running MIM with eleven MPR and workflow pairs: four for joiners, three for movers, two for leavers, and two authorization workflows that require manager approval for adding members to privileged groups. In the migration plan, the nine lifecycle pairs collapse into three lifecycle workflows, joiner, mover, and leaver, each with its expressions translated and its emails carried as templates. The two authorization workflows become a manager approval scheme on requests for the privileged roles. One custom PowerShell activity that writes to an HR system is listed in the caveats file and rebuilt by hand.
The calendar
Microsoft’s extended support for MIM 2016 SP2 runs through January 10, 2029. MIM Portals hosted on SharePoint Server 2019 are already past that platform’s end of support date of July 14, 2026. Workflow inventory is one of the slower parts of discovery, so it is worth doing before the date pressure arrives.
Next step
Organizations still running MIM workflows can book a scoping call with Azure IAM at https://azureiam.com/contact. The call establishes which workflows convert, which merge, and which need a decision, and leads to a fixed fee migration quote.
Azure IAM, LLC
2521 North Main
Unit 1-276
Las Cruces
New Mexico
88001
United States
