The Identity Merge Rules page lists the rules used to match identities of different providers and merge them into one unified identity. Open it from Settings > Merge Rules. Viewing the page requires the ReadMergeRuleConfig permission. Turning rules on or off requires WriteMergeRuleConfig (without it the status switches are disabled).
Merge Rules
Disabled Rule Status
The Merge Rules Configurations table has the following columns:
Rule: Name of the rule.
Merged Providers: Providers whose identities are compared by the rule.
Matched Fields: The field of each provider that will be used for the matching process.
Status: Switch that enables or disables the rule.
The product ships with seven built-in rules. New rules cannot be added. You can only enable or disable them.
| Rule | Merged providers and matched fields |
|---|---|
| Login Identifier Match | AWS UserName · Azure UserPrincipalName · GCP IAM Emails · Active Directory UserPrincipalName |
| Email Match | AWS Email · Azure Email · GCP IAM Emails · Active Directory UserPrincipalName |
| SSO Users SCIM External Id Match | AWS ExternalId · Azure ObjectID |
| SSO Groups External Id Match | AWS ExternalId · Azure ObjectID |
| AD synced objectSid and Entra OnPremSID Match | Azure OnPremSID · Active Directory ObjectSid |
| AD Group objectSid and Entra OnPremSID Match | Azure OnPremSID · Active Directory ObjectSid |
| AD Computer objectSid and Azure Device OnPremSID Match | Azure OnPremSID · Active Directory ObjectSid |
GitHub identities are not part of any merge rule.
Disabled rules are not included in the merge process. A change to a rule’s status takes effect from the next scan.