> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tierity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Identity providers

> Connect Okta, Microsoft Entra ID or authentik to find admins without MFA, leavers who still have access, dormant accounts and risky users.

## Overview

Your identity provider decides who can get into everything else, so it's one of the most important tiers to watch. Tierity connects read-only to your identity provider, syncs every 6 hours, and turns what it finds into findings in the same queue as the rest of your stack.

> **[Okta](https://docs.tierity.com/integrations/okta.md)**
>
> Read-only API token.

> **[Microsoft Entra ID](https://docs.tierity.com/integrations/entra.md)**
>
> App registration with Microsoft Graph permissions.

> **[authentik](https://docs.tierity.com/integrations/authentik.md)**
>
> API token; works with self-hosted instances.

## What gets synced

| Data | Details |
| - | - |
| **Users** | Status, last sign-in, employment status, admin roles, and whether the account is a person or a service account |
| **MFA** | Each user's enrolled factors, rated by strength: phishing-resistant (security keys, passkeys, FastPass, Windows Hello), app-based, weak (SMS, voice, email) or none |
| **Devices** | Devices assigned to each user, and their compliance where the provider reports it |
| **Applications** | Which apps each user can sign in to |
| **Sign-in events** | Failed sign-ins and other security events from the last 30 days |
| **Risk** | Risky-user ratings from Entra ID Identity Protection (Entra ID P2) |

Nothing is written back to your identity provider.

## Findings

Each check runs on every sync. Findings close on their own once the problem is fixed, and findings you've accepted or closed are left alone.

| Finding | Severity | Raised when |
| - | - | - |
| **Terminated user still active** | Critical | HR data marks someone as terminated or on leave, but their account is still active |
| **Admin without MFA** | Critical | An account with admin rights has no MFA enrolled |
| **Admin with phishable MFA** | High | An admin relies on SMS, voice or email codes |
| **Dormant admin** | High | An admin hasn't signed in for 90 days |
| **Risky user** | Medium or high | Entra ID Identity Protection rates an active user at medium or high risk |
| **Devices still assigned to a leaver** | Medium | An offboarded user still has devices assigned |
| **Non-compliant device** | Medium | A user's device fails your provider's compliance policy |
| **Users without MFA** | Medium or high | Active people have no MFA; high when more than 20% of users are affected |
| **Dormant accounts** | Low | Accounts haven't been used in 90 days |

Service accounts are excluded from MFA and dormancy checks.

### Employment status

Tierity looks for employment status in the profile attributes your HR system syncs to the identity provider. Common names such as `employmentStatus`, `employeeStatus` and `terminationDate` are found automatically, and Entra ID's built-in leave date is used when it's set.

If your HR sync writes to a different attribute, enter its name in the **Employment status attribute** field when you connect.

## Viewing in Tierity

* Each connected provider gets its own page in the sidebar with users, MFA coverage, admins, devices, applications and recent sign-in failures.
* The provider's **Workbench card** shows MFA coverage, admins without MFA, inactive users and failed sign-ins at a glance.
* Identity findings appear in the Workbench findings list alongside findings from every other tool.

## Sync schedule

Providers sync every 6 hours, and straight away when you first connect or click **Test connection**. Self-hosted instances can change the interval with the `IDP_SYNC_INTERVAL_MINUTES` environment variable.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.