title: Understanding the Person-Centric Identity Model category: Getting Started tags: identity, person, objects, matching, multi-source, architecture priority: High

Understanding the Person-Centric Identity Model

IdentityCenter uses a person-centric identity model that separates the concept of a real person from the accounts and objects that belong to them across multiple directory sources. This is the foundation of how IdentityCenter provides unified identity governance.

The Core Concept

In most organizations, a single employee has multiple accounts across different systems:

• An Active Directory account for Windows login
• An Entra ID (Azure AD) account for cloud services
• A mailbox object in Exchange
• Multiple group memberships
• Computer objects assigned to them

Traditional tools treat each of these as separate, unrelated items. IdentityCenter links them together under a single Person record.

Key Entities

Person (Identity)

A Person represents a real individual in your organization. The Person record contains:

A Person is not imported directly from any directory. Instead, it is created automatically when objects are synchronized and matched.

Object (Identity Object)

An Object represents a specific account or entry from a connected directory source. Objects have:

The Relationship

                    ┌──────────────┐
                    │    Person    │
                    │  "John Smith"│
                    └──────┬───────┘
                           │
              ┌────────────┼────────────┐
              │            │            │
      ┌───────▼──────┐ ┌──▼──────────┐ ┌▼─────────────┐
      │  AD Object   │ │ Entra Object│ │ LDAP Object  │
      │ jsmith@corp  │ │ john@tenant │ │ jsmith (HR)  │
      └──────────────┘ └─────────────┘ └──────────────┘

One Person can have multiple Objects from different sources. This gives you:

• Unified view of all accounts belonging to one individual
• Cross-source correlation for access reviews
• Complete audit trail across all systems
• Orphan detection when accounts exist without a matching person

How Matching Works

When IdentityCenter synchronizes objects from a directory, the Internal Sync Step automatically matches objects to existing Persons or creates new ones.

Matching Rules

The matching process follows a priority-based approach:

1. Email Match (highest confidence) - If the object's email matches an existing Person's email
2. Employee ID Match - If the object's employeeID attribute matches
3. Name + Department Match - Fuzzy matching on display name within the same department
4. UPN Match - User Principal Name correlation
5. Create New - If no match is found, a new Person is created

Matching in Sync Workflows

Matching happens automatically as part of the sync workflow:

1. Source Query step imports raw objects from the directory
2. Object Commit step saves/updates objects in the database
3. Internal Sync step matches objects to Persons
4. Lookup step resolves manager relationships (DN to Person)

Object Classes

IdentityCenter supports 24 Active Directory object classes. The most commonly used are:

Primary Object Classes

Extended Object Classes

Manager Resolution

IdentityCenter resolves manager hierarchies across your organization:

1. AD stores managers as Distinguished Name references (e.g., CN=Jane Doe,OU=Managers,DC=corp,DC=local)
2. The Lookup Step in the sync workflow resolves these DN references to actual Object GUIDs
3. Objects are then linked to their manager's Person record
4. This builds a complete organizational chart automatically

How It Works

AD Object (jsmith)                    IdentityCenter
─────────────────                    ──────────────
manager: CN=jdoe,OU=...  ──────►   ManagerObjectId: {guid}
                                    ManagerPersonId: {guid}
                                         │
                                         ▼
                                    Person: Jane Doe

The lookup step is generic — it works for any object type that has a manager attribute, not just users.

Multi-Source Identity Correlation

When you connect multiple directory sources, IdentityCenter correlates identities across them:

Example Scenario

Your organization has:

• Corporate AD (corp.local) — 500 users
• Cloud Entra ID (company.onmicrosoft.com) — 500 users
• HR LDAP — 480 records

After syncing all three:

• IdentityCenter creates ~500 Person records
• Each Person has up to 3 linked Objects (one per source)
• 20 cloud-only accounts are flagged (no HR match)
• Orphaned accounts are detected automatically

Correlation Benefits

Best Practices

1. Start with one source — Connect your primary AD first, let it sync and create Person records
2. Add sources incrementally — Each new source will match against existing Persons
3. Use email as primary match — It's the most reliable cross-source identifier
4. Review unmatched objects — Check the Objects browser for items that didn't match to a Person
5. Set an authoritative source — Decide which system is the "source of truth" for each attribute (e.g., HR for department/title, AD for login details)

Next Steps

• Quick Start Guide — Set up your first sync
• Auto Sync Projects — Auto-create sync projects for all 24 object classes
• Directory Browser — Explore your synchronized objects
• Access Reviews Overview — Start reviewing access across sources