rn.identity connects to Microsoft Graph and Entra ID — provisioning, offboarding, license auditing and playbook automation in one CLI-first platform built for IT and security teams.
rn-identity — zsh — offboard workflow
0+
Organizations
0%
Faster provisioning
0s
Avg offboard time
0M
Identities managed
01 — Provisioning
New hire. Ready in seconds.
Drop a CSV or pipe an API payload and RN creates the Entra ID account, assigns licenses, configures conditional access, and fires a welcome email — all in the time it takes to make a coffee. Role templates for Engineering, Sales, Finance and custom roles are built-in and shareable across your team.
CSV or API-driven bulk import
Role templates ship with all tiers
Conditional access applied automatically
Webhook trigger from your HRIS (Workday, BambooHR)
provision — new-hire-engineering
$ rn provision--csvnew-hires.csv--templateengineering Reading new-hires.csv... 7 users found Template: engineering (E3 license, MFA enforced)✓alex.rivera@contoso.comprovisioned✓sam.okafor@contoso.comprovisioned✓jess.huang@contoso.comprovisioned✓tom.walsh@contoso.comprovisioned✓nina.patel@contoso.comprovisioned✓kai.brooks@contoso.comprovisioned✓rin.yamada@contoso.comprovisioned 7 accounts created · 7 E3 licenses assigned Completed in 4.2s · Audit logged
offboard — graceful
$ rn offboard--upnc.ford@contoso.com--playbookoffboard-graceful✓ Sessions revoked (3 tokens cleared)✓ Account disabled in Entra ID
✓ MFA methods removed
✓ Mailbox → shared, forwarding set
✓ Removed from 14 security groups
✓ License reclaimed (saves $36/mo)✓ OneDrive archived to retention
Completed in 11.4s Audit event #AE-48821 logged
02 — Offboarding
11 seconds. Nothing left behind.
When someone leaves, RN runs a sequenced playbook — sessions revoked, account disabled, MFA cleared, mailbox converted, groups removed, license reclaimed — in the right order, every time, in under 15 seconds. Every step is auditable and every deviation is flagged.
Sequenced, not scripted — deterministic order every time
Immediate and graceful modes available
Auto-notifies manager and IT distribution list
SOX / SOC 2 compliant audit record per run
03 — License intelligence
Stop paying for seats nobody uses.
RN audits every SKU assignment in your tenant daily. It surfaces inactive licenses, duplicate SKUs, over-provisioned accounts and licensed shared mailboxes — then reclaims them on a schedule you define. The average customer identifies recoverable spend within 48 hours of deployment.
Authenticate with Entra ID using device-code flow or a service principal. RN requests only the Graph scopes it needs — User.ReadWrite.All, Group.ReadWrite.All. No global admin required.
02
Sync your directory
RN syncs your Entra ID users, groups, licenses and assigned roles using Graph delta queries — so subsequent syncs take seconds, not minutes. Initial sync for 50,000 users completes in under 9 minutes.
03
Configure playbooks
Define your provisioning templates and offboarding sequences in YAML or via the dashboard. Use built-in actions or write custom Graph API calls. Trigger via CLI, webhook, or schedule.
04
Monitor and audit
Every action is logged, timestamped and tied to the operator who ran it. Set up Slack alerts, email digests or webhook notifications. Export audit logs for SOC 2, ISO 27001 or SOX compliance.
Terminaldevice-code auth
$ rn auth login--tenantcontoso.onmicrosoft.com Opening browser for device-code flow... Code: HXKP4-MBZRT URL: https://microsoft.com/devicelogin✓Authenticated as admin@contoso.com✓Scopes granted✓Token cached at ~/.rn/tokens/contoso.json
Terminaldirectory sync
$ rn sync Pulling directory from Graph API... Users 2,847 Groups 94 Licenses 3 SKUs✓Sync complete in 8.1s⚠31 stale accounts detected⚠12 duplicate SKU assignments
Terminalplaybooks
$ rn playbooks list NAME TRIGGER ────────────────────────────── new-hire-engineermanual / webhook new-hire-saleswebhook offboard-gracefulmanual offboard-immediatemanual license-auditscheduled (Mon 08:00)
Terminalaudit log
$ rn audit log--last4 TIME ACTOR ACTION STATUS ─────────────────────────────────────────── 14:22j.parkprovision userOK 13:55autoassign licenseOK 11:30s.chenoffboard userOK 09:14m.webbremove groupWARN
Developer-first
The rn CLI in action
Every dashboard action is available as a CLI command. Pipe it, script it, wire it into GitHub Actions.
rn usersuser management
# List all users with license info$ rn users list--formattable# Search by display name or UPN$ rn users get--upnj.smith@contoso.com# Export stale accounts (90+ days inactive)$ rn users list--filterstale--days90--outputstale.csv# Reset password and force change on next sign-in$ rn users reset-password--upnj.smith@contoso.com--force-change
rn offboardoffboarding automation
# Run graceful offboard (manager notified, mailbox converted)$ rn offboard--upnc.ford@contoso.com--playbookoffboard-graceful# Immediate offboard (security incident — sessions revoked first)$ rn offboard--upnc.ford@contoso.com--playbookoffboard-immediate# Dry-run to preview what will happen$ rn offboard--upnc.ford@contoso.com--dry-run# Bulk offboard from CSV (e.g. RIF event)$ rn offboard--csvterminations.csv--playbookoffboard-graceful
rn licenseslicense intelligence
# Full audit of all SKUs$ rn licenses audit# Reclaim licenses — preview first$ rn licenses reclaim--typestale,duplicate,shared-mailbox--dry-run$ rn licenses reclaim--typestale,duplicate,shared-mailbox--confirm# Assign specific license to user$ rn licenses assign--upnnew@contoso.com--skuM365_E3# Export license report as HTML for stakeholders$ rn licenses audit--formathtml--outputreport.html
rn playbooksautomation sequences
# List all configured playbooks$ rn playbooks list# Inspect a playbook's steps$ rn playbooks describeoffboard-graceful# Create a playbook from a YAML definition$ rn playbooks create--filecontractor-offboard.yaml# Run a playbook manually$ rn playbooks runlicense-audit--notifyit@contoso.com
From the field
Teams that switched don't go back
"
We offboarded 23 contractors in a single Friday afternoon. Took 4 minutes total. Used to take our team an entire day of manual PowerShell and tickets.
DW
Devon Walsh
IT Director · Brightwell Logistics
"
The audit log alone justified the purchase. Our SOC 2 auditors were impressed that every identity action had an actor, timestamp, and outcome attached to it.
PK
Priya Khatri
Head of InfoSec · Meridian Health
"
Set up in 40 minutes. No PowerShell, no custom scripts, no begging the Azure team for elevated permissions. Exactly what I needed as a one-person IT department.
ML
Marcus Leung
Senior SysAdmin · Nexora Software
Get started
Start automating in under an hour
Free 14-day trial. No credit card. Full feature access from day one.
Our story
We are on a mission to make identity boring.
Identity operations should not require a PhD in PowerShell. We are fixing that.
Founded December 2025 · Seattle, WA
Built by people who lived the problem
James Thornton spent six years as an Azure Identity PM at Microsoft watching enterprise IT teams struggle with the same manual processes week after week. When he left in 2025, he called Sarah Chen — who had just wrapped up leading the MSAL SDK team — and they started building the tool they always wished existed.
rn.identity launched in January 2026. We closed our seed round in March, hired a small team of people who had all felt this pain firsthand, and shipped SOC 2 Type II in April. We are seven months old and already managing identity for 287 organizations across North America and Europe.
We believe the right answer to identity management is boring automation that works every single time.
By the numbers
287+
Organizations
$6.8M
Seed round
Dec'25
Founded
4.2M
Identities managed
How we work
Six things we do not compromise on
01
Security by default
Minimal Graph scopes, no user data stored on RN servers, immutable audit logs. Security is not a feature — it is the foundation.
02
CLI over dashboards
Every action available in the UI is also available in the CLI. Engineers automate; dashboards are for visibility, not dependency.
03
Minimal permissions
We request only the Graph scopes we actually need and document exactly why we need each one. No over-privileged service principals.
04
Audit everything
Every provisioning event, license change, offboarding action, and group modification is logged with actor, timestamp, and outcome. No exceptions.
05
Fast iteration
We ship every two weeks. If something is broken or missing, we fix it fast. Our changelog is public and we post updates when we mess up.
06
Enterprise ready
SOC 2 Type II. SAML SSO. Dedicated CSM on Enterprise plans. We pass security reviews because we designed for them from day one.
Timeline
Seven months of fast
Dec 2025
rn.identity incorporated
James and Sarah incorporated in Seattle. First lines of code committed on Christmas Eve.
Jan 2026
First customer goes live
Brightwell Logistics became customer zero. Their 340-person tenant was our first production deployment.
Mar 2026
$6.8M seed round closed
Led by Benchmark. Hired Marcus Webb (Infra), Priya Reyes (CS), Oliver Brandt (Security), and Emma Jordan (Product).
Apr 2026
SOC 2 Type II completed
Fast-tracked via Vanta. Four months from first customer to certified. No findings.
May 2026
v2.0 ships
Playbooks, GitHub Actions integration, and the license intelligence engine. Biggest release to date.
Jul 2026
287 organizations
Crossed 287 orgs and 4.2M identities under management. v2.5.0 ships with AI anomaly detection beta.
The team
Small team. Deep expertise.
Everyone here has been an end user of what we are building. That is not an accident.
JT
James Thornton
CEO & Co-Founder
Six years as an Azure Identity PM at Microsoft. Led the GA launch of Entra External Identities. Left in 2025 to build the tool his customers kept asking for.
AzureIdentityPM
SC
Sarah Chen
CTO & Co-Founder
Led the MSAL SDK team at Microsoft for four years. Built the token caching architecture used by millions of developers. Holds two patents on OAuth token lifecycle management.
MSALSDKGraph API
MW
Marcus Webb
Head of Engineering
Ten years building infrastructure at Stripe and Cloudflare before joining RN. Designed the delta-sync engine that lets us sync 50,000-user tenants in under nine minutes.
InfraReliabilityCLI
PR
Priya Reyes
Head of Customer Success
Five years as IT Director at a 4,000-person logistics company before joining RN. Has personally run offboarding for 600 plus employees using legacy tools.
EnterpriseIT OpsCS
OB
Oliver Brandt
Head of Security
OSCP certified. Previously at Microsoft MSRC researching Azure AD privilege escalation paths. Designed our minimal-permission Graph scope model and SOC 2 controls program.
OSCPMSRCSOC 2
EJ
Emma Jordan
Product
Previously at Rippling managing identity product features for 18 months. Obsessed with offboarding UX and the gap between disabled in Entra and actually off all systems.
ProductUXRippling
Live demo
The rn.identity dashboard
A real-feeling interactive demo. Click around — the data is fake, the UI is production.
app.rn-identity.com/dashboard
Users
Licenses
Playbooks
Audit Log
Total Users
2,847
Active
2,703
Pending
31
Inactive
113
User
Status
License
Last Active
JT
James Thornton
j.thornton@contoso.com
Active
M365 E3
2h ago
SC
Sarah Chen
s.chen@contoso.com
Active
M365 E5
14m ago
CF
Claire Ford
c.ford@contoso.com
Pending
E3
3d ago
RK
Ryan Kim
r.kim@contoso.com
Active
M365 E3
1h ago
MP
Maria Park
m.park@contoso.com
Inactive
M365 E3
97d ago
Total Seats
3,200
In Use
2,847
Available
353
Waste/mo
$5.2k
Microsoft 365 E32,400 / 2,800 — 86% utilization
Microsoft 365 E5447 / 400 — over-provisioned
Defender for Endpoint P289 / 200 — 45% utilization
5 playbooks configured
new-hire-engineering
trigger: manual / webhook · 12 steps
new-hire-sales
trigger: webhook · 10 steps
offboard-graceful
trigger: manual · 9 steps
offboard-immediate
trigger: manual · 7 steps
license-audit
trigger: scheduled Mon 08:00
Time
Actor
Action
Target
Status
14:22:08
j.park
Provision user
a.rivera@contoso.com
OK
13:55:41
auto
Assign license
a.rivera@contoso.com
OK
11:30:17
s.chen
Offboard user
c.ford@contoso.com
OK
09:14:53
m.webb
Remove group
sg-devops-all
WARN
08:01:00
auto
License audit
scheduled run
OK
Add new user
CLI Reference
The rn CLI
Install once. Automate everything. Works anywhere a shell does.
Installation
Get started in 30 seconds
HomebrewmacOS / Linux
$ brew tap rn-identity/tap$ brew install rn$ rn --versionrn v2.5.0
# Device-code login (recommended for interactive use)$ rn auth login--tenantcontoso.onmicrosoft.com# Service principal login (for CI/CD)$ rn auth login--tenantcontoso.onmicrosoft.com--client-id$CLIENT_ID--client-secret$CLIENT_SECRET# Show current authentication status$ rn auth status# Revoke cached tokens$ rn auth logout
User management
rn users
# List all users$ rn users list--formattable# Get a specific user$ rn users get--upnj.smith@contoso.com# Provision a single user$ rn provision--upna.rivera@contoso.com--templateengineering# Provision from CSV$ rn provision--csvnew-hires.csv--templateengineering# List stale accounts (90+ days inactive)$ rn users list--filterstale--days90
Offboarding
rn offboard
# Graceful offboard (manager notified, mailbox converted)$ rn offboard--upnc.ford@contoso.com--playbookoffboard-graceful# Immediate offboard (security incident — sessions first)$ rn offboard--upnc.ford@contoso.com--playbookoffboard-immediate# Preview what will happen without executing$ rn offboard--upnc.ford@contoso.com--dry-run# Bulk offboard from a CSV of UPNs$ rn offboard--csvterminations.csv--playbookoffboard-graceful
License management
rn licenses
# Full tenant license audit$ rn licenses audit# Reclaim stale and duplicate licenses (preview first)$ rn licenses reclaim--typestale,duplicate,shared-mailbox--dry-run$ rn licenses reclaim--typestale,duplicate,shared-mailbox--confirm# Export license report as HTML$ rn licenses audit--formathtml--outputlicense-report.html# Assign a license SKU to a user$ rn licenses assign--upnnew@contoso.com--skuM365_E3
Changelog
What we have shipped
We ship every two weeks. Everything we change, we document.
v2.5.0Jul 7, 2026Major
AI anomaly detection (beta) + performance improvements
AI-powered anomaly detection for unusual sign-in patterns and suspicious license assignments — now in beta for all Pro and Enterprise customers
Delta sync now 40% faster for tenants over 10,000 users thanks to parallel Graph batch requests
Playbook execution logs now include per-step timing data
New --notify-managers flag on license reclaim for grace period workflows
Fixed: audit log export occasionally omitted the final 20 entries on large tenants
v2.4.0Jun 23, 2026Minor
License intelligence overhaul
Complete rewrite of the license audit engine — now surfaces shared mailbox licenses, soft-deleted account licenses, and duplicate SKU assignments as separate categories
New weekly license digest email (opt-in, configurable recipients)
SKU downgrade workflows now require explicit manager approval via email confirmation link
rn licenses reclaim now supports --grace-period flag (e.g. --grace-period 30d)
