Azure IAM Maps MIM PCNS Password Sync To SailPoint's AD Password Interceptor
Oct 24, 2026
Azure IAM, LLC explains what replaces Microsoft Identity Manager's Password Change Notification Service in a SailPoint IdentityIQ migration, how the AD Password Interceptor takes over, and how to cut password sync over target by target without a gap.
Las Cruces, United States, October 24, 2026 /NewsNetwork/ -- Password synchronization is the MIM feature most migration plans forget until the week of cutover. Teams moving from Microsoft Identity Manager (MIM) to SailPoint IdentityIQ inventory management agents, attribute flows, and workflows, then discover that a mainframe, an LDAP directory, or a line of business database has been receiving Active Directory password changes through MIM for a decade. The question that follows is what replaces MIM PCNS password sync after a move to SailPoint IdentityIQ. Azure IAM, LLC, an independent identity consulting firm, says the answer is SailPoint's Active Directory Password Interceptor, and the work is less about the agent than about the cutover order. The firm documents its MIM to SailPoint method at https://azureiam.com/mim-to-sailpoint.
How MIM does it today. Microsoft's Password Change Notification Service has three moving parts on every domain controller: a password filter, Pcnsflt.dll, loaded by the Local Security Authority; the PCNS service, which queues each change and encrypts it; and configuration stored in Active Directory and managed with pcnscfg.exe. PCNS authenticates to the MIM server through a Kerberos service principal name and delivers the change over encrypted RPC. MIM then finds the user's connector space object, follows the join table, and pushes the new password to every management agent with password sync enabled. Directory agents handle the set natively. File, database, and extensible connectivity agents need a .NET password extension DLL, which is custom code. An inclusion group and an optional exclusion group decide whose passwords leave the domain, typically Domain Users in and Domain Admins out.
How SailPoint does it. The AD Password Interceptor is an agent installed on every domain controller in the domain. When a user changes a password, Active Directory hands the agent the sAMAccountName and the new password, and the agent sends the change to IdentityIQ over its web services port. IdentityIQ then acts as the provisioning engine, running a workflow that pushes the password to each target application through that application's connector. The first domain controller set up becomes the primary, and the rest receive the replicated configuration and keys during installation. IQService, the Windows helper IdentityIQ uses for Active Directory provisioning, is not part of the interceptor path. SailPoint has deprecated interceptor versions 20.0.0 and below, so new deployments start on a current release.
Azure IAM sorts the migration work into five items.
Inventory every password sync target. The MIM configuration shows which management agents have password sync enabled and which rely on a password extension DLL. Each extension DLL is a small rules project of its own: its set and change logic moves into the IdentityIQ connector's password operation or a provisioning rule.
Rebuild the scoping. The PCNS inclusion and exclusion groups live in PCNS configuration, not in IdentityIQ. The same boundary, especially keeping privileged accounts out, has to be rebuilt in the IdentityIQ password workflow and tested with real accounts from each group.
Open the right network paths. PCNS talks to MIM over Kerberos and dynamic RPC ports. The interceptor needs a route from every domain controller to at least one IdentityIQ server on its web services port. That is a firewall change request that should be filed in the first week, not the last.
Run both, cut over by target. Microsoft documents that the PCNS filter runs alongside other password filters on a domain controller, so PCNS and the interceptor can coexist during a parallel run. Only one system should set the password on any given target at a time. Azure IAM moves targets from MIM to IdentityIQ one at a time, verifies each with a test account from the inclusion group and one from the exclusion group, and confirms queue and retry behavior while IdentityIQ is briefly unavailable before trusting it in production.
Decommission cleanly. After the last target moves, PCNS is uninstalled from each domain controller in a change window that includes the restart, the MIM target is removed with pcnscfg, and the service principal name is deleted. The PCNS schema extension stays, because Active Directory schema additions cannot be deleted, only left unused.
None of this changes the direction of the flow. MIM does not support bi-directional password sync, and neither design should: Active Directory remains the source of the password, and every target receives it. Azure IAM scopes MIM to SailPoint migrations, password sync included, on a fixed fee and offers a scoping call at https://azureiam.com/contact.
Contact Info:
Name: Robin Lilly
Email: Send Email
Organization: Azure IAM, LLC
Address: 2521 North Main Unit 1-276, Las Cruces, New Mexico 88001, United States
Website: https://azureiam.com
Source: NewsNetwork
Release ID: 89207265
Should you identify any discrepancies, concerns, or inaccuracies in the content provided in this press release or require assistance with a press release takedown, we strongly urge you to notify us promptly by contacting [email protected] (it is important to note that this email is the authorized channel for such matters, sending multiple emails to multiple addresses does not necessarily help expedite your request). Our responsive team is committed to addressing your concerns within 8 hours by taking necessary actions to resolve identified issues diligently or guiding you through the necessary steps for removal. Our dedication lies in providing accurate and reliable information.
Coach of China’s women’s football team leaves post eight months before World Cup
Ante Milicic has left his post as coach of China’s national women’s team, the football association said on Friday, eight months before the World Cup. The 52-year-old Australian had been in charge since May 2024 and led the team to the semi-finals of the Women’s Asian Cup in March. That finish earned them a spot at next year’s World Cup in Brazil. Milicic also recently took China to fourth place at the Aichi-Nagoya Asian Games in Japan after losing 2-0 to North Korea in the semi-finals. “After...
Matthew Cheung 36 holes from history after taking Hong Kong Open lead at halfway point
Matthew Cheung rode a wave of emotion and a little bit of luck to take a three-shot lead in the Link Hong Kong Open on Friday, leaving himself 36 holes from making history. Beginning the day two strokes back, Cheung carded a sensational eight-under-par 62 to move to 14 under overall, with Caleb Surratt alone in second on 11 under after also posting a 62. Overnight leaders Anirban Lahiri and Kevin Yuan could not match their first-round fireworks, with the former’s 68 leaving him in a tie for...
Fencing risks global divide as top official fires off world league threats
Days after the World Fencing League (WFL) said it would start its 2027 season in Hong Kong, the sport’s world governing body has warned athletes and officials against taking part in unauthorised events In an official statement released on Thursday, the International Fencing Federation (FIE) said the league was not an official competition and it had not sanctioned any of its proposed tournaments. Signed by FIE secretary general Gulnora Saidova, the statement also pointed to the federation’s...
Indian para swimmer sent home from Japan over misconduct allegations, could face life ban
Former world No 1 Indian para swimmer Mohammad Shams Aalam Shaikh has been sent home from Japan after being accused of molesting a female hotel employee during the Asian Para Games, and faces a potential lifetime ban. According to local media reports as well as The Times of India, the 40-year-old athlete was detained by Japanese police and released after submitting a written apology, before being sent back to India on Tuesday. Official sources said the incident occurred on Monday at the Four...
Asian Football Confederation endorses Gianni Infantino for another term as Fifa president
The head of the Asian Football Confederation said on Friday the regional body would support Gianni Infantino’s bid for re-election as Fifa president. Sheikh Salman bin Ibrahim Al Khalifa, the AFC president, had previously backed opposition to Infantino’s failed plan to sell off the commercial rights to Fifa tournaments, including the World Cup, to private investors. He had joined with the presidents of Uefa and Concacaf to pen an open letter calling the Fifa Forward Enterprise (FFE) plan...
Local pair’s brush with Hong Kong Open history a sign the sport is flourishing
There was a moment on Thursday when history looked like being made at the Link Hong Kong Open, and while forgiving greens and some generous pins meant normal service was later restored, the glimpse on offer was of a local game in rude health. For the first time since the tournament began in 1959, two Hongkongers – Isaac Lam and Matthew Cheung – briefly sat at the top of the leaderboard at six-under-par. By the end of the day they were far from alone and further down the field than they might...
Asian Para Games: Hong Kong win gold again as swimmer Chan Yui-lam defends title
Hong Kong won a gold medal at the Asian Para Games for the second day in a row after swimmer Chan Yui-lam defended her 100m butterfly (S14) crown on Thursday. Chan, 23, stormed to gold at Nagoya City General Gymnasium in one minute and 5.19 seconds to finish ahead of host swimmer Aira Kinoshita, who finished in 1:05.56. Fellow Hongkonger Lau Chiu-yee took bronze in 1:07.39. The victory for the regional and Asian Para Games record-holder added to her success earlier this week when she took home...
Philippines’ Eala ousted as Rybakina moves into Ningbo Open last 8 on return from injury
Alexandra Eala crashed out in the Ningbo Open last 16 on Thursday as world No 1 Elena Rybakina reached the quarter-finals on her return from injury when opponent Polina Kudermetova retired. Top seed and defending champion Rybakina was cruising 5-0 in eastern China when the world No 105 from Uzbekistan called it quits because of injury. Earlier, Philippine history-maker Eala suffered a battling straight-sets defeat to Diana Shnaider, the Russian world No 13 winning 7-5, 6-4 to book a...
Local golfers briefly top Hong Kong Open leaderboard in strong start on day one
In the 67 years the Link Hong Kong Open has been in existence, the leaderboard has never featured two local players at the top – Matthew Cheung and Isaac Lam briefly changed that on Thursday. Out among the morning groups, the pair carded matching six-under-par 64s, a score South Korea’s Kim Mink-yu also posted, to sit one-stroke clear of a bunched chasing pack at Hong Kong Golf Club. The trio were later overhauled by Jazz Janewattananond and Poosit Supupramai, who shot 63s, while Anirban Lahiri...
David Hayes plans to tinker with winkers in Ka Ying Rising’s The Everest redemption bid
Still hurting from Ka Ying Rising’s agonisingly close The Everest defeat, David Hayes has flagged a gear change for the champion sprinter’s bid for redemption in the world’s richest turf race next year. Hayes was still adamant barrier 11 ultimately cost Ka Ying Rising when he finished strongly late after a wide run to finish a half-neck second to Tempted in last Saturday’s Group One sprint. It was the nine-time Group One winner’s first defeat since January 2024, ending his record streak for a...
Asian Para Games: mayor sorry for ‘painful’ mistakes after playing wrong national anthems
Officials at the Asian Para Games in Nagoya played the wrong national anthems three times this week, prompting the mayor to apologise just weeks after the city hosted the mishap-plagued Asian Games. The Asian Para Games are taking place in the central Japanese hub city through Saturday, featuring around 4,000 athletes and officials in 18 sports. Nagoya mayor Ichiro Hirosawa apologised on Wednesday for the latest error, which occurred despite officials’ pledges to implement steps to prevent...
David Eustace mulls Lightning Stakes aim with Colourful King ahead of key Sha Tin test
David Eustace is plotting a path towards the Group One Lightning Stakes (1,000m) at Flemington and Royal Ascot with super sprinter Colourful King, with his run at Sha Tin on Sunday being a fork in the road in terms of seasonal plans. The Blue Point galloper surged up to a rating of 110 when making a mockery of a smart field in the Group Three National Day Cup (1,000m) on return, flashing clear with the minimum of fuss in the closing stages. His higher rating means options are becoming more...
YOUR NEWS, OUR NETWORK.
Do you have Great News you want to tell the world?
Be it updates about your business or your community, you can make sure that it’s heard by submitting your story to our network reaching hundreds of news sites across 6 verticals.