Identity providers

​

Overview

Your identity provider decides who can get into everything else, so it’s one of the most important tiers to watch. Tierity connects read-only to your identity provider, syncs every 6 hours, and turns what it finds into findings in the same queue as the rest of your stack.

​

What gets synced

Nothing is written back to your identity provider.

​

Findings

Each check runs on every sync. Findings close on their own once the problem is fixed, and findings you’ve accepted or closed are left alone. Service accounts are excluded from MFA and dormancy checks.

​

Employment status

Tierity looks for employment status in the profile attributes your HR system syncs to the identity provider. Common names such as employmentStatus, employeeStatus and terminationDate are found automatically, and Entra ID’s built-in leave date is used when it’s set. If your HR sync writes to a different attribute, enter its name in the Employment status attribute field when you connect.

​

Viewing in Tierity

• Each connected provider gets its own page in the sidebar with users, MFA coverage, admins, devices, applications and recent sign-in failures.
• The provider’s Workbench card shows MFA coverage, admins without MFA, inactive users and failed sign-ins at a glance.
• Identity findings appear in the Workbench findings list alongside findings from every other tool.

​

Sync schedule

Providers sync every 6 hours, and straight away when you first connect or click Test connection. Self-hosted instances can change the interval with the IDP_SYNC_INTERVAL_MINUTES environment variable.