Twelve interfaces, eleven of them standard protocols or Microsoft-supported connectors. Only the Workday inbound feed is bespoke, and it exists because the joining semantics are the client's, not Workday's.
Direction matters more than protocol here. Nothing writes into the directory except provisioning and the IaC pipeline, so an integration that wanted directory write access would be a design change, not a configuration.
The Cloud Sync path is deliberately one-way for objects and two-way only for group writeback, which keeps the cloud directory authoritative while the on-premises estate still works.
Cadence and coupling
Hourly for HR, two minutes for AD delta, forty minutes for SCIM outbound. Nothing in the JML path is real time, and view 17 states the resulting access lag explicitly rather than implying immediacy.
Sentinel receives a near-real-time stream, because detection latency is the one place where minutes matter more than cost.
ServiceNow is called synchronously for approvals but is not on any authentication path: an outage delays a grant, never a sign-in.
Risks
The Workday feed is a single upstream dependency for all human identity. Its failure mode is drawn in view 27 — the correct behaviour on an empty feed is to freeze, never to bulk-disable.
SCIM connectors are per-application and fail independently. There is no single view of provisioning health today; a workbook covering all 142 is an open item.
34 partner tenants means 34 sets of cross-tenant access settings. They are managed as code, but the review burden grows linearly with partners.
