Microsoft Identity Manager End of Life: The 2029 Date and the Move to Entra ID

Microsoft Identity Manager (MIM) 2016 SP2 reaches end of support on January 9, 2029. Microsoft extended the date from January 13, 2026, and its recommended path forward is Microsoft Entra ID, with Entra ID Governance covering the provisioning and lifecycle work MIM does today. Organizations that still provision accounts through MIM have about two years to move each flow, and the ones that start with a full inventory of their MIM configuration tend to finish with the least disruption.

What the Microsoft Identity Manager end of support date covers

The January 9, 2029 date is the end of support for Microsoft Identity Manager 2016, the last version of the product. After that date Microsoft stops releasing security updates and fixes for MIM, and support cases for it are no longer accepted. The software keeps working on the servers where it is installed, but every vulnerability found after that date stays open.

Microsoft's own MIM 2016 news and updates page records the extension from January 13, 2026 to January 9, 2029. Mainstream support, the phase in which Microsoft adds features, ended in January 2021. Since then MIM has received hotfixes and platform support updates only.

The extension gives organizations more time. Microsoft's investment in identity provisioning and governance is in Microsoft Entra ID, and the Microsoft guidance on migrating from MIM maps MIM scenarios to their Entra equivalents.

MIM depends on other Microsoft products with earlier support dates

MIM deployments depend on SQL Server, Windows Server and, for the MIM portal, SharePoint. Each of those has its own support date, and some are earlier than 2029.

SharePoint Server 2016 and 2019, the versions most MIM portals use, reached end of support on July 14, 2026, as KuppingerCole noted when the MIM extension was announced. An organization with a MIM portal on one of those SharePoint versions already has an unsupported component in production. The same check applies to the SQL Server and Windows Server versions under the MIM synchronization service.

A quick dependency list for each MIM server shows which parts of the stack are already out of support and which date really sets the migration deadline.

What replaces Microsoft Identity Manager in Microsoft Entra ID

Microsoft Entra ID replaces MIM through several services, each covering part of what MIM does. The table maps common MIM functions to their Entra counterparts.

Two points from the table come up in most migrations. Custom MIM code, such as extension DLLs and complex sync rules, has no direct equivalent and needs to be rebuilt as attribute mappings, expressions or Logic Apps. And licensing differs by feature: HR-driven provisioning, lifecycle workflows and entitlement management have their own requirements across Entra ID P1, P2 and Entra ID Governance, so the licensing check belongs in the assessment.

HR-driven provisioning is the core of most MIM migrations

In most MIM deployments, the main job is HR-driven provisioning: a new record in the HR system creates an account in Active Directory, attribute changes update it, and a termination disables it. Moving that flow is the largest piece of a MIM migration.

Microsoft Entra ID has built-in inbound provisioning for Workday and SAP SuccessFactors. For other HR systems, including Dayforce, Oracle HCM, UKG, BambooHR and on-premises SAP HCM, Entra offers API-driven inbound provisioning, which accepts SCIM payloads from a script, Azure Logic Apps or the HR system's own integration tools. In both cases Entra can create the account in Entra ID and write it to on-premises Active Directory through a provisioning agent, so applications that still need Active Directory keep working.

The guide to HR-driven provisioning in Microsoft Entra ID covers the connectors, attribute mapping and the joiner, mover and leaver design in detail.

A Microsoft Identity Manager migration plan, flow by flow

A MIM migration goes best one flow at a time, with MIM and Entra side by side until each replacement is proven. The steps below are the order we follow in identity engagements.

1. Inventory the MIM configuration. List every management agent, sync rule, workflow, extension DLL and scheduled job, with the source and target for each. Export the configuration so the inventory can be checked against the live system.
2. List the dependencies and their support dates. SQL Server, Windows Server and SharePoint versions for each MIM server. This sets the real deadline.
3. Map each flow to its Entra replacement. Use the table above. Mark the flows with custom code, since those need the most design time.
4. Check licensing. Confirm which Entra ID P1, P2 or Entra ID Governance features each replacement needs, for employees and for contractors.
5. Clean the HR data. Provisioning automation follows the HR record, so missing managers, duplicate records and inconsistent job codes cause wrong access. Fixing them before the pilot saves rework.
6. Pilot one population. Move one department, region or worker type to Entra provisioning while MIM keeps serving everyone else. Compare the accounts each system would create.
7. Move the remaining flows in waves. Joiners first, then movers, then leavers, so a problem in one flow has a small blast radius. Turn off each MIM flow only after the Entra flow has worked cleanly for a full cycle.
8. Retire MIM. Remove the management agents, archive the configuration export and decommission the servers and their dependencies.

Contractors and non-employees in a MIM migration

Many organizations keep contractors out of the main HR system, and MIM often handles them through a separate source such as a SQL table, a CSV file or a request form. The Entra design needs a home for that population too.

The options include adding contractors to the HR system, provisioning them through API-driven inbound provisioning from a separate source, or managing them through Entra entitlement management with sponsors and expiry dates. Each has a different cost and audit trail. Adding contractors to an HR platform can carry a per-record licence cost, while a separate source keeps that cost down and needs its own owner and review cadence.

How the MIM migration supports SOC 2 and ISO 27001

A move from MIM to Entra ID Governance produces the records that access control audits test. SOC 2 CC6.2 covers registering, authorizing and removing user access, and the SOC 2 CC6.2 guide lists the evidence auditors sample. ISO 27001 A.5.16 covers identity management, described in the ISO 27001 A.5.16 guide, and A.5.18 covers access rights.

Entra provisioning logs, lifecycle workflow history and access review records give auditors dated evidence for each joiner, mover and leaver. A migration plan that keeps those logs for the full audit period, by forwarding them to the central log store, makes the first audit after the move straightforward.

Practical steps to start a Microsoft Identity Manager migration this quarter

1. Export the MIM configuration and count the management agents, sync rules and custom extensions.
2. Write down the SQL Server, Windows Server and SharePoint versions under each MIM server and their support dates.
3. Name the HR systems that feed MIM, such as Workday, SAP SuccessFactors, Dayforce or SAP HCM, and check which have a built-in Entra connector.
4. Confirm current Entra licensing against the features the replacement needs.
5. Pick a pilot population and a target date for the first flow.

The guide to centralizing identity governance in hybrid estates covers the wider design questions, such as which directory is the source of truth and how cloud and on-premises applications share one identity. Organizations that plan to retire on-premises Active Directory after MIM can follow the Active Directory to Entra ID migration plan.

Microsoft Identity Manager retires on the organization's schedule when the plan starts early

The January 9, 2029 date gives organizations time to move MIM to Microsoft Entra ID one flow at a time, with both systems in place until each replacement is proven. The organizations that finish well start with a full inventory, clean HR data and a pilot, and treat MIM's dependencies as part of the deadline.

Planning a move off Microsoft Identity Manager? Truvo's identity architects inventory the MIM configuration, design the Entra ID replacement and migrate each flow, including HR-driven provisioning from Workday, SAP SuccessFactors and Dayforce. See Microsoft Entra ID consulting or book a strategy call.

Frequently asked questions

When does Microsoft Identity Manager reach end of life?

Microsoft Identity Manager 2016 SP2 reaches end of support on January 9, 2029. Microsoft extended the date from January 13, 2026. After that date Microsoft releases no further security updates or fixes for MIM.

What is the replacement for Microsoft Identity Manager?

Microsoft's recommended replacement is Microsoft Entra ID with Entra ID Governance. HR-driven provisioning replaces HR-to-Active Directory sync, lifecycle workflows replace joiner, mover and leaver workflows, entitlement management replaces portal requests, and access reviews replace attestation. Entra Connect or cloud sync keeps Active Directory in step with Entra ID.

Can MIM and Entra ID work side by side during a migration?

Yes. Most migrations keep MIM and Entra provisioning side by side and move one population or flow at a time. Each MIM flow is turned off only after its Entra replacement has worked cleanly for a full cycle.

Does Entra ID support provisioning from Dayforce or other HR systems?

Yes. Entra ID has built-in connectors for Workday and SAP SuccessFactors. Dayforce, Oracle HCM, UKG, BambooHR and other HR systems connect through API-driven inbound provisioning, which accepts SCIM payloads from a script, Azure Logic Apps or the HR system's integration tools.

What happens to the MIM portal and SharePoint?

The MIM portal depends on SharePoint, and SharePoint Server 2016 and 2019 reached end of support on July 14, 2026. Self-service requests and approvals move to Entra entitlement management and the My Access portal, so the SharePoint dependency goes away with the portal.

Sources

• Microsoft, Microsoft Identity Manager 2016 news and updates (end of support extended from January 13, 2026 to January 9, 2029)
• Microsoft Learn, Migrate from Microsoft Identity Manager to Microsoft Entra ID
• Microsoft Learn, What is HR-driven provisioning
• KuppingerCole, Microsoft Extends Support for Microsoft Identity Manager (SharePoint Server 2016 and 2019 end of support July 14, 2026)