The best ideas, in one place
Role-based access, birthright access, requests and approvals, access reviews, time-bound access and separation of duties. Proven patterns from the market leaders, designed to fit together from day one.
In progress
Sinkrona Compass · identity governance
The best of the big IAM platforms. Without the big IAM project.
Sinkrona Connect keeps your identities in sync. Sinkrona Compass decides where they should be: who should have access to what, for how long, and why. We are bringing together the strongest ideas from today's leading identity governance platforms in one product that is clear, open and pleasant to use.
Compass is in development. Everything on this page is subject to change.
Why another governance product?
The large identity governance suites have great ideas. They also come with long projects, heavy licences and concepts only a specialist can explain. We want the ideas without the weight.
Clear enough to explain
Every grant of access has a reason you can show: which role, which rule, who approved it and until when. Auditors, managers and the help desk get the same clear answer.
Open and API-first
Everything Compass does is available through a documented REST API, the same way Sinkrona Connect works. No closed boxes, no special tools to automate it.
What Compass will do
The building blocks of modern identity governance, kept simple.
Roles
Roles that match your organization
Business roles and IT roles that bundle the access people need for their job. Assign them by hand, or let rules assign them from HR data, so the right people get the right access automatically.
Entitlements
One catalog of everything people can get
Groups, licences, application roles and permissions from all your systems in one catalog, with owners and descriptions people actually understand.
Lifecycle
Joiners, movers and leavers
Access follows the person. New starters get what they need on day one, a move to a new job adjusts access, and leavers lose it on time, without tickets falling between chairs.
Time
Access with a start and an end
Grant access from a date, until a date, or for a project. Compass removes it again when the time is up.
Explainability
"Why does this person have access?"
One click shows every path that leads to a piece of access, and what would happen if one of them were removed.
Governance
Owners, reviews and policies
Every role and entitlement has an owner. Regular reviews let owners confirm or remove access, and policies catch combinations that should never happen.
Compliance
Audit you can hand to an auditor
Who got what, when, why and who approved it, kept as a complete history. Built with NIS2 and ISO 27001 requirements in mind.
Self-service
Request and approve
People ask for access in plain language, the right owner approves, and the change flows out to the connected systems.
A data model built for real organizations
Most organizations do not fit a single org chart. People work in several companies, stores, projects and cost centers at once, and their access should follow each of those. Compass is designed around that from the first version, while a small setup stays simple.
Three layers
Business meaning, technical package, concrete access
A role says what someone does ("Store Manager"). Behind it sit reusable access packages per system, and behind those the concrete groups, licences and permissions. Business owners talk about roles, system owners maintain the packages, and nobody has to manage hundreds of single groups by hand.
Context
The same role, in the right scope
A role is assigned in a context: a company, a country, a department, a store, a project or any other dimension you need. Contexts can form hierarchies or cut across them, and one person can belong to many at once. "Store Manager at store 12" and "Store Manager at store 31" are one role, two scopes.
Time
Every relation has a start and an end
Memberships, roles and access are all time-bound, also in the future and the past. Compass can answer "what will she have on Monday?" as well as "what did he have on March 14, and why did it stop?". Revoking access ends it; it never erases the history.
One assignment, fully explained
Søren Granfeldt
has role Project Administrator
in Project Alpha (Company › Denmark › IT)
from 2026-05-01
until 2026-06-30
because requested, approved by the project owner
gives Project Alpha – contributors (directory group)
Project Alpha – site owner (collaboration site)
Time reporting: project lead (business system)
Rules and exceptions
Automatic where it can be, manual where it must be
Rules assign roles from HR data and context, and the result updates itself when the data changes. Exceptions are first-class: if an administrator takes away access that a rule would give, the rule respects it instead of quietly granting it again.
Many paths
Several reasons, one clear answer
People often get the same access in more than one way. Compass keeps every path, so removing one reason does not remove access another reason still justifies, and it can always show which reasons are left.
The data model is in design. Examples are illustrative and subject to change.
Everything you expect from an enterprise governance suite
Compass is planned to cover the core of what the established identity governance suites do, so you do not have to choose between a simple tool and a capable one.
| Capability | Enterprise IGA suites | Sinkrona Compass |
|---|---|---|
| Business and IT roles, role hierarchy | Yes | Planned, from the first version |
| Birthright and rule-based access | Yes | Planned |
| Joiner, mover, leaver processes | Yes | Planned, driven by HR data through Connect |
| Access requests and approvals | Yes | Planned |
| Access reviews and certification campaigns | Yes | Planned |
| Separation of duties policies | Yes | Planned |
| Ownership and delegated administration | Yes | Planned, per context |
| Time-bound and future-dated access | Often an add-on | Built into the model |
| "Why does this person have access?" | Reports and specialists | One click, every path |
| Point-in-time history | Audit logs | Ask the model for any date |
| API | Partial, often extra licence | API-first: everything |
| Time to first value | Months, large projects | Start small, grow without remodelling |
Planned capabilities, subject to change.
Coming from the FIM/MIM Service and Portal?
The FIM and MIM Service had a small and powerful policy model. Many organizations still run their joiner, mover and leaver processes on it, and it reaches end of support together with the rest of MIM 2016 on January 9, 2029. Compass takes over the ideas that worked, and gives them a modern home.
| FIM/MIM Service and Portal | What it did | In Sinkrona Compass |
|---|---|---|
| Sets | Named populations: a filter plus explicit members | Named, reusable populations with include and exclude, time-aware and explainable |
| Criteria-based groups | Group members calculated from a filter | Rule-based roles and access, calculated from HR data and context |
| Management Policy Rules (MPRs) | Who may do what to which objects | Policies and delegated administration, scoped by population and context |
| Set transitions | Run actions when an object enters or leaves a Set | Events on entering and leaving a population: notify, review, end access |
| Temporal Sets | Criteria relative to dates, e.g. "leaves within 30 days" | Time is built into the model: future, current and past access |
| Authorization workflows | Approvals before a request is committed | Requests and approvals by manager, owner or several levels |
| Action workflows | Custom steps after a change, often code | Declarative steps first, code extensions when you need them |
| Request objects | Every change recorded as a request | Every change audited with who, what, when, why, before and after |
| The Portal (SharePoint) | Self-service and administration UI | A modern browser portal, and the same REST API behind it |
| FIM/MIM Synchronization Service | Brought data in and pushed changes out | Sinkrona Connect, built for exactly that job |
Planned capabilities, subject to change. Self-service password reset is not part of the first versions.
Compass decides. Connect delivers.
Compass is its own product, and it works hand in hand with Sinkrona Connect. Compass works out who should have which access. Connect carries that out in Active Directory, Entra ID, databases and business applications, and reports back what is really there.
Start with Connect
Get your identities in sync today. Compass builds on the same data when you are ready.
Add Compass
Bring roles, reviews and requests on top, without replacing what already works.
Keep it in your hands
Run it on your own servers or containers, on Windows or Linux, with your data under your control.
Be the first to see Compass
Compass is in progress. If you want to follow along, shape it with your needs or be a pilot customer, get in touch with Søren directly.