AI Glossary / Data engineering and architecture / Intermediate
Metadirectory
Definition
A metadirectory is an integration system that coordinates identity information across directories and other data sources. It links corresponding entries, maps attributes and synchronizes approved changes according to defined rules. Typical information includes people, accounts, groups and organizational attributes. Its purpose is to keep connected systems aligned while respecting which source is authoritative for each piece of information.
What it means
An employee can appear in a human-resources database, an organizational directory and several application account stores. Those records may use different field names and identifiers. A metadirectory helps establish that the relevant records refer to the same person and controls how selected values move between them.
It is not simply a directory containing a list of other directories. Its defining concern is coordinated information flow. Nor is it automatically a login service. Identity synchronization can support authentication and access management, but verifying a login and deciding which resources a user may access remain separate functions with their own rules.
How it works
Connectors import information from participating systems. Matching or joining rules link corresponding entries, while attribute mappings copy or transform values. A consolidated representation may combine attributes from several sources, each with a defined authority.
Outbound rules determine which changes should be sent to each destination. Some systems stage those changes before exporting them. Scheduling, failures and filtering can therefore create a delay between a source update and its appearance in another application.
The integration needs explicit behavior for conflicts, missing values, account creation and removal. A deletion in one source should not be interpreted casually as permission to delete every linked record. The intended lifecycle must be represented in the rules and checked through the full path to the destination.
Three practical examples
1. Employee updates: A verified department change in the authoritative staff system flows to relevant directory attributes. Local application fields that have a different owner are preserved according to the mapping rules.
2. Application onboarding: A new service receives approved identity attributes for eligible users. The organization tests whether the matching rule identifies existing accounts rather than creating unnecessary duplicates.
3. AI workspace access: A business uses identity integration as part of managing accounts for an internal AI service. It separately checks the service's authorization rules and how quickly account changes are enforced in active sessions.
Think of it this way
Think of a coordinated address-change desk serving several membership lists. It knows which records belong to the same person, which list supplies the official address and where an approved change should go.
The analogy has limits. Digital identity attributes can affect access to systems, and synchronization follows exact mappings and schedules. A successful update at the desk does not prove that every destination has accepted or begun enforcing the new information.
Worked example
Suppose a staff database contains employee ID E204, department Research and preferred name Lina. A directory account has the same stable employee ID but an older department value, Operations.
The rules specify that the staff database owns department, while the directory owns the account's technical login identifier. A join using E204 links the entries. The department is scheduled to change to Research; the login identifier remains under its existing authority.
If the import occurs at 09:00, synchronization at 09:02 and successful export at 09:05, the destination does not receive the new value at 09:00 merely because the import succeeded. This timeline is invented to illustrate distinct stages, not a product default.
Now introduce another employee with the same preferred name. Joining on Lina alone could connect the wrong account. A stable identifier and reviewed exception handling are more appropriate than treating a display name as a unique identity key.
Illustrative case study
Fictional case: Directory Meadow connects its staff system to a new project application. The initial mapping writes every source field over the destination's corresponding field. Application-specific contact preferences disappear after the first synchronization.
The team identifies authority separately for each attribute and limits outbound changes to the approved scope. It tests a name change, duplicate display names, missing employee identifiers and a temporarily unavailable destination.
It also distinguishes a staged account change from a confirmed application update. The revised monitoring shows where failures occur along the integration path. This fictional case demonstrates rule design and verification; it does not report a real deployment or claim that synchronization alone establishes secure access.
Common misconceptions and mistakes
Synchronization does not imply instantaneous agreement. Import, processing, export and destination handling may occur at different times.
A single consolidated identity view does not mean every source has equal authority. Conflicting values require precedence or an explicit resolution process.
Metadirectory integration is not identical to single sign-on. A person may sign in through one mechanism while account attributes are synchronized through another.
It is also different from querying multiple directories through a virtual view without necessarily synchronizing stored copies. Products can combine these approaches, so inspect behavior rather than relying on labels.
Business use
Start with the identity lifecycle: joining the organization, changing responsibilities and leaving. Define authoritative sources, matching rules and destination responsibilities for each stage.
Monitor failed joins, rejected exports and the time until changes appear where they matter. Preview potentially broad updates and keep an accountable change process. A technically successful sync job is not sufficient evidence that every intended account state is correct; sample the actual destinations and test exceptions that resemble real business situations.
People also ask
Must all connected systems use the same schema?
No. Mapping and transformation are important parts of integration, although not every mismatch has a safe automatic conversion.
Does a metadirectory have to synchronize everything both ways?
No. Direction, attributes and scope depend on configured rules. Uncontrolled two-way updates can create conflicts.
Is Microsoft's synchronization metaverse a virtual-world platform?
No. In that identity product context, it means a consolidated representation of joined identities, not an immersive environment.
Check your understanding
A source record was imported successfully, but its destination attribute has not changed. Has the full synchronization workflow necessarily finished?
Answer: No. Mapping, synchronization, export or destination processing may still be pending or have failed. Trace the attribute through each stage before concluding that the destination is current.
Related terms
- Provisioning
- Synchronization
- Virtual directory
- Directory service
- identity management
- attribute mapping
- authoritative source
- connector
Learn next
Learn identity matching and authoritative-source design next. Then trace one attribute through import, transformation and export. Finally, compare provisioning, authentication and authorization so that each lifecycle responsibility has a clear owner and a testable outcome.
More in Data engineering and architecture
- Metadata repository - A metadata repository is an organized store of information describing data, systems and their relationships.
- Metadata structure definition - A metadata structure definition, commonly abbreviated MSD in SDMX, specifies the organization and allowed content of a reference metadata set.
- Metadatabase - A metadatabase is a database organized around metadata: descriptions of other data, models and relationships.
- Metastore - A metastore is a repository or service that holds metadata describing data objects, rather than simply storing their business records.
- Micro-thread (multi-core) - A micro-thread, in this multicore context, is a lightweight software execution unit used to interleave small pieces of work within a processor core.
- Microparallelism - Microparallelism means exploiting parallel work at a small scale, close to individual instructions, packed values or short sections of code.
Sources
Microsoft, Entra Connect Sync Technical Concepts: https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-sync-technical-concepts — Primary documentation read for connectors, joined identities, attribute flow and staged operations.
Oracle, Introduction to Directory Integration Platform: https://docs.oracle.com/middleware/11119/dip/administer/odip_intro.htm — Historical primary documentation read for directory synchronization and mapping concepts. Product examples explain mechanisms, not universal naming or current deployment recommendations. The scenario and timeline are original.
Previous: Metadatabase Next: Metalevel learning