HAP Capabilities

Available in current build

One identity view across hybrid systems.

HAP progressively assembles the selected person's administrative context from the providers available to the active runtime profile.

Active Directory identity and account information
Microsoft Entra ID identity context
Authentication methods and MFA-related information where permitted
Manager, direct-report, and organizational information
Group and role-related context where available
Exchange recipient and mailbox information
Device information from configured providers
Provider-attributed data within one identity workspace

Available and evolving

Organization-specific lifecycle workflows.

The current New User Wizard converts environment-specific mappings and operator input into a reviewable account plan and supported execution path.

Profile-driven new-user workflow
Organization-specific OU and group mappings
Generated account, UPN, and identity values
Plan review before execution
Active Directory account creation
Supported group assignment
Optional remote-mailbox enablement where configured
Structured results for individual workflow steps

Boundary: A complete offboarding workflow is not currently presented as finished functionality.

Available selectively

Operational actions performed from the identity context.

Administrative actions are exposed when the provider, target object, operator rights, and runtime configuration support the requested work.

Edit supported directory user attributes
Change a user's manager
Move direct reports during manager transitions
Update supported distribution-group membership
Configure supported mailbox forwarding
Manage supported mailbox delegates
Update address-list visibility where available
Return structured operation results rather than one opaque status

Availability: Capability varies by provider health, recipient type, environment configuration, and operator permission.

Available in current build

Device visibility without losing the provider source.

Device Manager normalizes records from configured sources into one read-oriented workspace.

Search by available user, device name, or device identifier
Combine configured Active Directory and Microsoft Graph sources
Display operating system and provider source
Display primary user where returned
Display compliance and last check-in where returned
Summarize total, stale, and non-compliant records where available

Current role: Device Manager is presently read-oriented.

Available in current build

Environment-driven behavior through runtime profiles.

Profiles describe the operational environment before HAP attempts to connect or expose workflows.

Simulation, Live, and Hybrid operating modes
Live, Simulation, or Disabled mode per provider
Commercial, GCC, GCC High, and DoD cloud definitions
Tenant, application registration, and certificate configuration
Provider-specific connection and authentication settings
Environment-specific OU, group, and workflow mappings
Validation before launch
Loaded profile context retained throughout the session

Platform direction

Customer-controlled extensibility without modifying the protected core.

The long-term provider model is intended to let organizations connect systems unique to their environment through controlled contracts and isolated execution.

Versioned provider contracts
Controlled provider registration
Declared operations, requirements, and grants
PowerShell-based customer integrations at the extension boundary
Out-of-process execution for optional customer providers
Failure containment and dependency isolation
Protected first-party application core

Status: This describes the architectural direction and should not be interpreted as a generally available extension marketplace or completed SDK.

Capabilities organized by operational outcome.

One identity view across hybrid systems.

Organization-specific lifecycle workflows.

Operational actions performed from the identity context.

Device visibility without losing the provider source.

Environment-driven behavior through runtime profiles.

Customer-controlled extensibility without modifying the protected core.

Walk through the current interface by workflow.