Vendor Identities and Syncing

Overview

Vendor identities are the individual accounts that Fencer discovers from each connected integration, or that you add by hand for vendors without an integration. A vendor identity represents one account as it exists in a specific platform — for example, a GitHub user, a Slack member, or a Google Workspace account. Multiple vendor identities from different platforms are correlated into a single organization identity, giving you a unified view of each person or service account.

The Vendor Identities Tab

Go to Posture > Identities and switch to the Vendor Identities tab to see every account discovered across your vendors. The datagrid shows columns including:

• Account Name, Username, and Email — the account as the vendor reports it.
• Linked User — the organization identity this vendor account is correlated to.
• Vendor and Source — the vendor and the integration (or manual import) it came from.
• Role, Type, and MFA — the account’s role in the vendor, its type (User, Service Account, Bot, App/Integration, or Unknown), and whether multi-factor authentication is on.
• Status — Active, Inactive, Suspended, Deprovisioned, Pending, or Guest.
• Last Login, Login Location, and Last Seen — activity the integration reports, where available.
• Recommendations — suggested review actions for the account.

Use the filters to narrow results by Vendor, Type, Status, Current, Has Recommendations, Vendor Risk, or Linked User.

Correlation Logic

When a sync runs, Fencer correlates each newly discovered vendor identity with an organization identity using the following strategy, in order:

1. Email matching — if the vendor identity’s email matches an organization identity’s primary or alternate email (ignoring case), they are linked automatically.
2. Name matching — if no email matches, Fencer compares the normalized display name and username. A name match links the accounts too, but flags the organization identity Needs Review with a note asking you to verify the correlation.
3. New identity — if nothing matches, Fencer creates a new organization identity, which you can later merge with an existing one if needed.

Bots and service accounts are not matched by name or email: each gets its own organization identity, linked to its human owner when the vendor reports one. Admins can relink or unlink vendor identities at any time (see below).

Integration-Specific Sync Behavior

Each integration produces vendor identities differently based on what data the platform exposes. Some examples:

Integration	Identity source	Notes
Google Workspace	Directory users	Suspended users show as Suspended; admins and delegated admins get those roles
Microsoft Entra	Users from the Microsoft Graph API	Guest users show as Guest; disabled accounts as Inactive
1Password	Users seen in audit events from the last 120 days	Service accounts are typed as Service Account
GitHub	Organization members	Bot accounts are typed as Bot; reports admin role and 2FA status
Slack	Workspace members, including bots and apps	Deactivated users show as Deprovisioned; guests as Guest

Sync Job Monitoring

Running a sync

Fencer syncs identities automatically once a day and whenever you connect an integration. When you disconnect an integration, the vendor identities it synced are removed. To sync on demand:

1. Go to Posture > Identities and click Sync Identities.
2. Select the integrations to sync (Select All or Select None to toggle them), then click Start Sync.
3. Sync jobs run in the background. Starting a sync requires the Administrator role.

Sync history

Click Job History to see the latest sync runs. Each entry shows:

• The integration synced and how long ago the run started.
• Counts of users Found, created (+), updated (~), and removed (−).
• Any error encountered during the sync, or whether it was skipped or is still running.

Note

Only one sync per integration can run at a time. If a sync is already in progress for an integration, starting another sync skips that integration until the running job completes.

Adding Vendor Identities by Hand

For a vendor you track manually (one without an integration), you can add its accounts yourself from the Vendor Identities tab. Both options require the Administrator role, and the vendor must already be tracked in the Admin > Vendor Catalog. Vendors managed by an integration can’t take manual identities.

• Add Identity — opens Add Vendor Identity. Pick the Vendor and enter at least one of Email, Display Name, or Username, plus an optional Role, Status, and Type.
• Import CSV — opens Import identities from CSV. Upload a CSV, review the preview of new and updated identities and any rows with errors, then confirm the import.

CSV format

Column	Description	Required
vendor	The vendor’s name or slug as tracked in your catalog (vendor_name or vendor_slug also work)	Yes
email	The user’s email address	One of these three
display_name	The user’s full name or display name (name also works)	One of these three
username	The user’s username on the vendor’s platform	One of these three
role	The user’s role or permission level within the vendor’s product	No
status	active, inactive, suspended, deprovisioned, pending, or guest (default active)	No
type	user, service_account, bot, app, or unknown (default user)	No
owner	For a service account, the email or username of the identity that owns it	No

• Encoding: UTF-8. Maximum file size: 5 MB. Maximum rows: 10,000.
• Column names are not case-sensitive. Rows with none of email, display name, or username are ignored.
• A row whose email (or, without an email, username or display name) matches an existing identity for that vendor updates it; other rows create new identities.

Linking and Unlinking Vendor Identities

Linking and unlinking require the Administrator role.

Linking

1. On the Vendor Identities tab, select one or more vendor identity rows.
2. Click Link to User and choose the organization identity from the search list.
3. The vendor identities are associated with the chosen organization identity immediately.

Unlinking

Right-click a linked vendor identity and choose Unlink identity (or click Unlink next to it in the organization identity’s Linked Vendor Identities). Fencer detaches the vendor identity from its current organization identity and moves it to a separate organization identity. Choosing No user in Link to User unlinks several at once.

Caution

You cannot unlink a vendor identity whose email address exactly matches the organization identity’s primary email. To unlink in this case, first make a different email the organization identity’s primary email, or merge the organization identity into another before unlinking.

Examples

Correlating identities across tools:

1. After connecting Google Workspace and GitHub, wait for the automatic sync or click Sync Identities.
2. Fencer automatically links the GitHub user jsmith and the Google account j.smith@example.com because both share the same email address.
3. Open the organization identity for Jane Smith to verify both vendor identities appear under Linked Vendor Identities.

Monitoring a sync job:

1. Click Sync Identities, select GitHub, and click Start Sync.
2. Job History shows: Found 42, +2, ~5, −1.
3. The two new identities represent recently added GitHub members. Review them and assign appropriate types and owners.

Troubleshooting

• Sync stuck in “Running” state — check Job History for error details. Revoked API credentials or an integration connection failure are common causes. Reconnect the integration and start a new sync.
• Vendor identity not correlating automatically — confirm that the email addresses match (including domain). Minor differences (e.g., alias vs. primary address) prevent automatic email correlation. Use Link to User to associate the accounts.
• Cannot unlink vendor identity — the vendor identity’s email matches the organization identity’s primary email. Change the primary email first or merge the organization identity before attempting to unlink.
• Same person appears twice after sync — this can happen when the same user has different emails in different tools. Use Merge Identity on the organization identity to combine them, which keeps the other email as an alternate email automatically.
• CSV row rejected with “Vendor … not found” — track the vendor in Admin > Vendor Catalog first, or fix the vendor name in your file.

Related pages

• Identity Management
• Bulk Operations and Export
• Vendor Management
• Google Workspace Integration
• Microsoft Entra Integration
• 1Password Integration