Explore configuration with Visuals
Configuration explorer
See what depends on a resource, where changes land, and how your systems connect before you investigate or change an identity automation.
Open Configuration > Visuals in NIM Studio. Select a view below to see how it works, then expand a practical scenario when you need an example.
- Resources
- Flow
- Systems
- Role mining
Resources: trace the impact of a changeDirect link to Resources: trace the impact of a change
The Resources tab draws dependencies between configuration items. A line points from a resource to something it uses: for example, from a filter to its tables, or from a table to its system. This direction helps distinguish an item's inputs from the resources that depend on it.
Inspect a resourceDirect link to Inspect a resource
- Enter its name in Find resource, or select it in the graph or the lists on the right.
- Click the resource to put it in the middle of the graph.
- Under Around the selection, choose 1 step, 2 steps, 3 steps, or All to control how far you follow its connections.
- Use Fit to view to bring the graph into view. Toggle Hide implied lines when you need to show or hide implied connections.
- Trace the connections to identify the resources you should inspect or test before making a change.
- To open the selected resource's configuration, click Open in the right-hand panel.
- Clear the selection to see all resources again, then select another resource to start a new drill-down.
The counters beside the controls show how many resources and lines are displayed, including how many implied lines are hidden. Clear the current selection to return to the overview of all resources and start your drill-down. When nothing is selected, the right-hand panel provides starting points: An isolated resource is a prompt to investigate, not a reason to delete it. Review its purpose and run Validation before removing or changing configuration.Resource summaries and dependency checks
Find resources that need attentionDirect link to Find resources that need attention
Summary How to use it Most depended on Start here when reviewing shared resources whose changes could affect many other items. Referenced but not configured Investigate named references that do not have a corresponding configured resource. Not connected to anything Review isolated resources to understand whether they are still needed.
Resources use casesDirect link to Resources use cases
Choose the situation that matches your task.
Change an employee eligibility rule
A department or employment-status rule needs updating.
Investigate: Select the filter and expand its connections to find mappings, jobs, Apps, or other resources that depend on it. Use Open to inspect their configuration.
Next step: Build a test list from those dependents. Preview people who should qualify and people who should be excluded before running the affected automation.
Repair a missing reference
An App or job stops working after configuration is renamed or removed.
Investigate: Start with Referenced but not configured, then trace the resources that use the missing item.
Next step: Open the affected configuration, repair the reference, run Validation, and retry with a test record.
Hand over an environment
Another administrator needs to maintain an existing process.
Investigate: Clear the selection, start with Most depended on, and drill into the shared resources supporting that process.
Next step: Walk through the inputs and dependents with the new administrator and document the purpose, owner, and testing requirements of each shared resource.
Flow: follow changes from source to tableDirect link to Flow: follow changes from source to table
The Flow tab summarizes object mutations from the audit log. Read the diagram from left to right: Source → Operation → System → Table. Each band's width represents the number of mutations along that path.
Investigate a period of activityDirect link to Investigate a period of activity
- Choose a period from the dropdown in the upper-right corner, such as Last 90 days.
- Review Mutations, Create, Update, Delete, and Tables touched above the diagram.
- Follow a source, such as Scheduled sync, an on-demand execution, or a named App, through its operation to the affected system and table.
- Inspect the daily timeline below the diagram. Drag across the timeline to narrow the period around a spike or another interval you want to investigate.
- Use Logs when you need execution details beyond the visual summary.
Operation colors and mutation counts
The operation colors are green for create, blue for update, and orange for delete. The timeline uses the same colors and reports the number of days with activity.
Mutation totals describe recorded changes, not unique people or accounts. Use the Flow view to locate activity, then investigate the underlying records before drawing conclusions about affected identities.
Flow use casesDirect link to Flow use cases
Choose the situation that matches your task.
Investigate an unexpected update spike
Many account updates appeared overnight.
Investigate: Narrow the timeline to that interval and follow the update bands from their sources to the affected systems and tables.
Next step: Inspect the relevant execution logs and changed records to distinguish an expected bulk update from a configuration or source-data issue.
Review a controlled provisioning test
You ran a job for a small test population.
Investigate: Select the test interval and inspect which sources, operations, and tables have recorded activity.
Next step: Compare the records and target-system state with your expected results. Other activity may overlap the interval, so use logs to identify the test execution.
Explain activity during a busy period
A hiring wave or school-term rollover generated many changes.
Investigate: Review creates, updates, and deletes, then follow the largest bands to identify the processes and tables contributing to the volume.
Next step: Use the findings to guide an operational review. Report mutation counts as changes, not as a count of unique employees or students.
Systems: explore tables and relationsDirect link to Systems: explore tables and relations
The Systems tab groups each system's tables into a colored patch. Each dot represents a table; its size reflects its row count. Lines within a patch represent that system's references and link tables. Lines between patches represent inter-system relations.
Explore the data modelDirect link to Explore the data model
- Point at a table to see its relations. Click it to keep those relations visible while you inspect the graph.
- Use the legend checkboxes to show or hide Reference (1-n), Link table (n-n), and Intersystem relation connections.
- Drag a table or system name to reposition it. Double-click it to go to that item, scroll to zoom, or select Fit to view.
- Review the right-hand summary for system and table totals and Tables without relations.
- Open the relevant data model if you need to inspect or change a table, key, or relation.
Tables without relations can help you spot gaps in a data model. A standalone table can also be intentional, so check how its data is used before adding a relation. Use the controls above the graph to choose how much detail to show: Select Replay the audit log and use the timeline slider to explore changes in the graph. The replay period follows the period selected on the Flow tab. Its legend uses the same create, update, and delete colors. For example, narrow the Flow timeline around a busy day, then return to Systems to explore the activity in the context of the tables and their relations.Display controls and audit-log replay
Adjust the displayDirect link to Adjust the display
Controls What they help you inspect Row counts, System totals, Size legend, Last collected Data volume, table sizes, and collection recency. The size legend also distinguishes tables whose data is not loaded. Line width, Relation counts, Coverage, Field names Additional detail about the connections between tables. Flow, Size intensity, Animations, Fewer crossings Visual emphasis and readability of the graph. Dot colour The coloring mode; the example uses Per system. Replay changes across the systemsDirect link to Replay changes across the systems
Systems use casesDirect link to Systems use cases
Choose the situation that matches your task.
Investigate an identity-matching problem
An HR employee does not match the expected directory account.
Investigate: Find the source and target tables, show inter-system relations, and inspect the connection between them. Use Field names and double-click a table to inspect its configuration.
Next step: Check the relation's keys and the actual values for the affected person. A visible relation shows the configured connection; inspect data to confirm the individual match.
Review a newly connected system
A new source or target has been added.
Investigate: Locate its patch, inspect collected tables and Last collected, and review Tables without relations for tables you expected to connect.
Next step: Confirm collection and configure any required keys or relations. Leave intentionally independent tables unconnected.
Locate stale or unexpectedly small collections
Provisioning appears to use incomplete data.
Investigate: Enable row counts and collection timestamps, then inspect the relevant tables and any not loaded indicators.
Next step: Check collection settings, permissions, and logs. Compare counts with the expected source population before relying on the data for provisioning.
Role mining: explore how groups fit rolesDirect link to Role mining: explore how groups fit roles
The Role mining tab visualizes mining progress for a selected role miner. Use the playback controls to follow the steps, inspect role clusters, and see how the number of required membership changes evolves.
Select a miner and replay its stepsDirect link to Select a miner and replay its steps
- Select the configuration to inspect from Role miner. For creating a miner and calculating its results, see Mine existing group memberships.
- Choose the number of groups to display from Groups. The example uses up to 250.
- Select Play to follow the sequence, or use the first, previous, next, and last step controls to inspect individual steps. Drag the slider to move through the sequence.
- Adjust Speed to control playback. Use the step counter to see your position in the sequence.
- Turn on Role names to display labels. Point at a node to inspect its name and member count; the example highlights the Employees role and its connected nodes.
Mining summaries and example results
Read the mining summariesDirect link to Read the mining summaries
The panels on the right explain what is happening at the selected step:
| Summary | What it tells you |
|---|---|
| Mutations needed | The membership changes needed for the role fit at this point, with a chart showing how the count changes through the sequence. It also reports groups with a role, groups managed by hand, and the reduction from the starting count. |
| Current step | A description of the current mining decision. For example, a group that fits no role can remain managed by hand. |
| Clusters | The named clusters, their colors, and their counts, helping you interpret the graph. |
In the example, Mutations needed falls from 22,629 at the start to 11,134, a 51% reduction. These are example mining results, not a guaranteed reduction for other environments.
Fewer mutations do not by themselves confirm that access is appropriate. Review proposed group-to-role associations in the role miner before applying them to the development model or activating the model. The playback view helps explain the fit; it does not establish that those changes have been executed in a target system.
Role mining use casesDirect link to Role mining use cases
Choose the situation that matches your task.
Introduce role-based access to existing groups
Memberships have accumulated through manual administration.
Investigate: Select the relevant miner, replay its steps, and inspect clusters alongside Mutations needed.
Next step: Review the proposed group-to-role associations in the role miner with the access owners before applying them to the development model.
Review exceptions
Some groups do not fit a proposed role.
Investigate: Follow Current step and the groups reported as managed by hand to understand which cases need separate attention.
Next step: Review those groups' purpose and membership with their owners. Decide whether to retain manual management or revise the role model.
Explain a proposed role model
Stakeholders need to understand the membership changes it would require.
Investigate: Use role names, clusters, and the mutation chart to walk through the fit and its remaining changes.
Next step: Review the role miner's add/remove details and record approval decisions outside the visualization. A lower mutation count is useful context, not proof that the access is appropriate.
Use Visuals during a configuration reviewDirect link to Use Visuals during a configuration review
- Before a change: use Resources to identify dependencies and the items that need testing.
- Check the data model: use Systems to inspect connected tables and investigate unexpected gaps.
- After testing: use Flow to check where recorded creates, updates, and deletes landed.
- Validate the result: run Validation and review Logs for issues that a diagram alone cannot explain.