Four Ways In: How ConnectAny Reaches Every Identity in Your Estate

See every identity, and what it can really do. That's the promise of complete identity visibility and control, and it starts with one capability: reaching every system where access lives.

ConnectAny is Oak's AI-born connector engine, the first layer of the Identity Operating System. It brings any identity source into one activity-based identity graph, whether it runs in SaaS, the cloud, your data center, or code your own team wrote a decade ago.

The app that never made the roadmap

Every enterprise has one. Call it the claims system: built in-house years ago, running on a server in the data center, with its users in its own database tables. It has no SCIM endpoint and no modern API, and half the finance team logs in every day.

Access is granted inside the app, out of band. Two service accounts run its nightly batch jobs. A few contractors still hold accounts from a project that ended months ago. And last quarter, an automation team added an AI agent that pulls claims for triage.

It has sat on the integration backlog for three years, governed the way these systems always are: a quarterly export, a spreadsheet, and a reviewer approving names they can't put in context. A large estate runs dozens like it. ConnectAny was built so none of them has to wait.

Watch ConnectAny that enables rapid integration of any new source into Oak.

Four ways in, one graph

ConnectAny has four ways into a system, chosen by where it lives and what it exposes. All four end in the same graph, where Oak models every identity and what it can really do.

1. Native connectors: authorize and sync

For the major identity providers, SaaS, cloud and developer platforms, ConnectAny ships out-of-the-box connectors. You authorize with OAuth or an API key, and Oak syncs on a schedule.

2. Build with Oak: we build the connector

No out-of-the-box connector for an app? Oak builds one. Oak's Connector Factory reads the vendor's API documentation, understands the data and what it means, and ingests it safely, so it's useful in the graph. New connectors are built in days, not a year per system, so you get full coverage instead of a backlog.

3. File ingestion: when the data lives in files

Some systems are easiest to reach through the files and reports they already produce. ConnectAny ingests identity and access data as files, from many sources and in both directions:

• You send: a file upload (CSV, JSON and more), scheduled reports emailed to a dedicated Oak inbox, or a push from the source.
• Oak collects: on a schedule, from an S3 bucket, an SFTP drop or file share, a reporting database, or a generic REST API.

4. On-prem runner: inside your network

For systems Oak's cloud can't reach, Oak installs a lightweight runner on one server in your network. The runner hosts Oak collectors for whatever runs there: databases, ERP, and homegrown or off-the-shelf applications.

This is the route the claims system takes. A collector on the runner connects to its database over JDBC and reads the user and permission tables. The system that waited three years on the backlog joins the graph.

And keep the IGA you run today. ConnectAny connects to it as one more source, so Oak adds the coverage and context it's missing, without a migration.

Four layers deep, from every app

Connecting is half the job. The other half is depth. From every source, Oak collects identity data in four layers, as deep as the source allows.

Every identity: human, machine and AI agent

Employees and contractors, service accounts, API keys and other non-human identities, and AI agents with credentials of their own. In the claims system, that's the finance users, the contractors, the two batch accounts and the triage agent. Each lands in the graph with its owner, whether or not it maps to a person in HR.

Entitlements and permissions

What each identity holds, including access granted directly inside the app and never requested through a workflow. Those out-of-band grants are exactly what an export-and-spreadsheet process misses.

Resource-level, fine-grained detail

What each permission actually reaches. A role called "Claims Reviewer" says little. The tables, records and actions it opens say everything. Oak reads past the role label to the resource itself.

Activity and runtime usage

Wherever the source records it: logs and runtime usage that show what was used, by whom and when. No one else has an activity-based identity graph. In Oak, every entitlement sits beside the evidence of whether it's needed.

Put the four layers together and the claims system stops being a list of names. This is where findings surface: a batch account holding admin rights it hasn't used in a year, contractors who kept write access after their project ended, an agent that can read far more than it touches.

{{small-cta}}

Complete identity visibility and control

Coverage is the precondition. Once every system is in the graph, your team moves from seeing, to understanding, to acting.

• See every identity. Every human, non-human identity and AI agent across every connected app, with ownership, access and real activity in one graph.
• Understand what it can really do. Reviews arrive with last use, peer comparison and a recommendation. Least privilege becomes a number: what was granted, what was used, what can be removed.
• Act on it. Issues are closed through a ticket, or fixed directly where you grant write access. Every change is explained, approved by your team, reversible and on record.
• Govern every identity the same way. Apps your IGA never onboarded get the same reviews as everything else, and every AI agent is governed like any other identity.

Every app connected in days

ConnectAny is the first step towards an Autonomous Identity Governance Program, and Oak White Glove makes it fast: a dedicated identity services team builds connectors alongside you, starting with the systems that never made the roadmap.

See it, understand it, act on it, with every action on record.

Name the system that has waited longest on your backlog. We'll show you how it gets in.

Built for giants. Born complete.

‍