Introducing Directory Sync 2.0: SCIM at Fortune-500 scale

When Northcell started onboarding onto Authr last year, their identity team gave us a deceptively simple acceptance test: sync all 112,000 directory users, including 14 years of accumulated group structure, and get every entitlement right on the first pass. Their previous provisioning system had needed three weekends and a spreadsheet of manual fixes. Ours took four hours and produced a diff report instead of a war room. Directory Sync 2.0, generally available today, is the engine that made that boring.

What SCIM looks like at real scale

SCIM is a fine protocol that was never really stress-tested by its own specification. At Fortune-500 scale, the problems are not about payloads, they are about physics and ordering. A reorganization at a 90,000-person company can emit half a million changes in an afternoon, and if a department deletion arrives before the transfers out of that department, people lose access mid-shift. Version 1 of our sync engine handled this the way everyone handles it, with retries and apologies. Version 2 is a ground-up rebuild around a simple principle: directory changes are an ordered, transactional stream, not a pile of independent events.

What is new in 2.0

• Ordering guarantees: causally related changes apply in causal order, full stop. Moves land before removals; renames never race their own group memberships.
• Dry-run mode: point 2.0 at your directory and get a complete, human-reviewable diff of what would change, before anything does. Northcell ran three dry runs before their first live sync.
• Throughput: sustained 2,000 operations per second per tenant, which turns a 112,000-user initial sync into an afternoon.
• Conflict surfacing: when the source directory disagrees with itself, and at this scale it always does, 2.0 quarantines the conflict with full context instead of guessing.
• Every mutation in Audit Fabric: who changed, what changed, which upstream event caused it, hash-chained like everything else.

The dry run is the product

I want to single out one feature, because early access customers were unanimous about it. Identity teams do not fear syncing; they fear syncing wrong, invisibly, at scale. The dry-run diff turns a leap of faith into a code review. One identity architect at Polaris Systems told us the diff report was the first time in her career she could show a change advisory board exactly what a provisioning change would do before it did it. Meetings that used to be arguments became approvals.

Directory Sync 2.0 is available now for all customers, and existing tenants migrate with zero downtime on their own schedule. If your last big directory migration involved a weekend, a bridge call, or a spreadsheet named final-final-v3, we would love to show you the alternative. Book a demo and bring your worst org chart.