User Guide

BIAM (Bayoex Identity and Access Management) centralizes the lifecycle of your organization's identities: onboarding, moves, suspensions and offboarding, plus automatic provisioning of accounts in Active Directory and target systems (legacy included) through connectors.

This guide has two parts:

• Deployment — for the infrastructure team: which servers are needed, how to install BIAM, and how it integrates with the existing Windows infrastructure without touching it.
• User manual — for BIAM administrators and operators: how to use each module.

What BIAM does for your organization

• Security & compliance — every sensitive operation requires a second person (four eyes), every action is audited and exportable (reports), access is deny-by-default and secrets are stored encrypted.
• Active Directory governance, without touching the DCs — users created in the right OU, attribute changes pushed to AD directly from the console (editing the profile updates the directory), password resets, enable/disable and governed OU moves (users). Operators need no RSAT and no access to domain controllers.
• Operational continuity — automatic health checks every 5 minutes and a circuit breaker that holds (never loses) tasks when a target system fails, draining them on recovery (connectors).
• Efficiency — a hire scheduled for a date materializes on its own: accounts created on every system, welcome email with a first-access link, manager notified (lifecycle).

All of it on a platform that requires 0 Windows VMs (Linux + PostgreSQL; one optional AutoIt runner only if GUI RPA is needed) and is installable air-gapped, with no internet egress.

Concepts in 30 seconds

• User / identity: the person, with their profile and attributes. Can exist in local mode or anchored to Active Directory.
• Connector: the connection to a target system (AD, NextCloud, core banking, legacy app…) where BIAM creates and manages accounts.
• Policy: groups access; granting it makes BIAM materialize the corresponding accounts in the assigned connectors.
• Four-eyes approvals: sensitive operations (deleting an account, moving an OU) always require a second person.
• Auditing: every relevant action is recorded and reportable.

Access to the product is governed by deny-by-default permissions: if your role lacks the permission, the option doesn't show.