Identity Source Integrations

Overview

These integrations bring the accounts people hold in more of your SaaS tools into Posture > Identities, so you can see who has access to each tool, spot stale accounts, and match each account to the person behind it. Each one connects with a credential you create in the vendor’s admin settings, and each is read-only: Fencer lists users or members and never changes anything in the vendor.

Integration	Syncs	Credential	Connections per organization
Apple Business	Managed Apple Accounts in Apple Business Manager	API account (Client ID, Key ID, private key)	One
Ashby	Ashby users	API key	One
Attio	Attio workspace members	Access token	One
MailerSend	MailerSend account users	API token	Several
Prefect	Prefect Cloud account members and service accounts	API key and account ID	Several
Schematic	Schematic account members	API key	One

New Relic members sync the same way; see Observability Integrations.

Prerequisites

An active Fencer subscription.
The Administrator role in your Fencer organization.
To sync identities, a Fencer plan that includes Identities.
Admin access in the vendor, to create the credential (see each section below).

How it works

When you connect one of these integrations, Fencer checks the credential with the vendor before it saves the connection, then adds the vendor to your organization and starts an identity sync. The sync runs again every night. Each account becomes a vendor identity on the Vendor Identities tab of Posture > Identities, where Fencer matches it to a person by email address.

Connecting an integration

Every integration on this page connects the same way:

Go to Admin > Integrations.
Click the integration’s card under Available Integrations, then click Continue.
Create the credential in the vendor, using the setup guide beside the form (the steps are also below), and fill in the form.
Click Connect. Fencer checks the credential and starts the first sync.

Every form has an optional Name field, a label for the connection. When you leave it blank the connection is named after the vendor.

Apple Business

You need the Organization Administrator role in Apple Business Manager.

Sign in to Apple Business Manager at business.apple.com. Select your name at the bottom of the sidebar, choose Preferences and open the API section.
Select Add API Account, give it a name, select the IT Administrator role so it can list users, and create it.
Download the generated private key when prompted. Apple only lets you download it once.
Select Edit on the new API account to view its Client ID and Key ID.

Form fields: Client ID, Key ID and Private key (the EC P-256 private key in PEM format, including the BEGIN and END header lines).

Fencer syncs each Managed Apple Account with its email address, name, roles, department, division and cost center (as groups) and creation date. Deactivated and released accounts are Inactive, locked accounts Suspended, new accounts Pending and external users Guest.

Ashby

You must be an Ashby admin.

In Ashby, go to Admin > Integrations > API Keys.
Click + New, give the key a descriptive name, such as “Fencer Integration”, and click Create API Key.
Under API Scopes, enable Organization - Read, then copy the generated key.

Form field: API key.

Fencer syncs each Ashby user with their name, email address, global role and status. Disabled users are Inactive.

Attio

Only Attio workspace admins can create API access tokens.

In Attio, open Settings in the left sidebar, go to the Developers section and select API access tokens.
Click Generate new token and give it a descriptive name, such as “Fencer Integration”. The token must have read access to workspace members.
Copy the generated token.

Form field: Access token.

Fencer syncs each workspace member with their name, email address, handle and access level, which it shows as the role. Suspended members are Suspended.

MailerSend

In MailerSend, go to Integrations > API Tokens in the left sidebar and click Create new token.
Give it a descriptive name, set an expiration date more than 24 hours away, and choose Custom Access with read access to Users.
Click Generate Token and copy the token.

Form field: API token.

Fencer syncs each MailerSend user with their name, email address, role and two-factor authentication status. Disabled users are Inactive, and no-reply and SMTP addresses are classified as service accounts.

Prefect

You need admin access to your Prefect Cloud account.

In Prefect Cloud, open Settings > Account > General and copy your Account ID (a UUID).
Go to Settings > API Keys, or create a service account under Members. Click Create API Key, give it a descriptive name, such as “Fencer Integration”, and an expiration if required.
Copy the generated key.

Form fields: Account ID and API key (a Prefect Cloud API key or service account key).

Fencer syncs each account member with their name, email address, handle and account role. Service accounts are classified as service accounts.

Schematic

You need admin access to your Schematic account.

In Schematic, open Settings in the left sidebar and go to the API Keys section.
Click Create API Key, or use an existing key, and give it a descriptive name, such as “Fencer Integration”. The key must have permission to list account members.
Copy the key.