Data Sync Preferences

Data Sync Preferences let you control exactly which data BalkanID extracts from an application. Instead of syncing everything an integration is capable of returning, you choose only the entities you need for governance — reducing sync time and limiting the data BalkanID stores.

Data Sync Preferences are configured per integration, so different applications can sync different data.

Data Sync Preferences are available for applications that support configurable extraction. If an application doesn't support it, the section won't appear when you configure the integration.

What you can control

Preferences are organised into groups. The entities shown depend on the application.

Entities

The core identity and access objects the application exposes — for example Users, Groups, Roles, Policies, and Generic Resources. These are what BalkanID uses for entitlement discovery, access reviews, and access requests.

Users are always synced and cannot be deselected. Every access relationship BalkanID maps is anchored to a user, so this entity is required for the integration to function.

Credentials

The authentication material the application issues — for example API keys, access keys, personal access tokens, OAuth tokens and client secrets, service account keys, SSH keys, and certificates. These belong to both human users (such as user passwords and personal access tokens) and non-human identities (such as service account keys and bot tokens). Shown as its own group when the application supports credential discovery.

Credential discovery ships as part of the Non-Human Identity (NHI) capability, so that capability must be enabled for your tenant — it covers every credential the application exposes, whether the credential belongs to a person or to a workload. If it isn't enabled, selecting credentials here will have no effect. Contact your customer success manager or [e-mail] to enable it.

Insights

Security findings BalkanID derives from the application's data, such as missing or weak MFA and over-privileged accounts. Selecting Insights enables all insight types available for that application.

Agents

AI / agent inventory when the application supports agent discovery (for example Bedrock agents or ServiceNow AI Agent Studio). Shown as its own group. Agent extraction also requires Agents (Early Access) for your tenant.

Other Data

Shown only for applications that can act as a source of truth for employee information:

• Employee / HR Data — HRIS-linked employee records.

Configuring Data Sync Preferences

1. Go to Integrations and either Add Integration to set up a new application, or open an existing integration to edit it.

1. Locate the Data Sync Preferences section on the configuration screen. The Read our guide link at the top of the section opens the setup guide for that specific application.

1. Select or deselect entities. Each group also has a checkbox to toggle the whole group at once — it reads Select all when some or none are selected, and All selected when everything in that group is on. Groups can be collapsed using the arrow on the right.

1. Review the Required API Scopes panel and make sure the credentials you provide grant those scopes.

1. Save the integration. Changes take effect on the next sync.

By default, everything supported is selected — so an integration set up without changing anything syncs all available data, exactly as before.

Required API Scopes

As you change your selection, the Required API Scopes panel updates to show only the API scopes needed for the entities you've chosen. You can use this list when creating the credentials or service account for the integration, and grant only the permissions the selected entities require.

For example, in an AWS integration the Insights entity is the only one that requires cloudtrail:LookupEvents. If you deselect Insights, that scope disappears from the list and no longer needs to be granted.

Deselecting an entity doesn't revoke permissions you've already granted in the source application. To reduce the integration's access, update its permissions in the application itself as well.

How changes are applied

Data Sync Preferences take effect on the next sync — saving them doesn't trigger an immediate re-extraction. To apply them right away, trigger a sync manually from the integration.

When a sync runs, BalkanID replaces the integration's previously extracted data with what the current sync returns. This means data for an entity you deselect is removed on the next sync — it isn't retained in a stale state. If you later re-select that entity, the data is repopulated on the following sync.

You can change preferences at any time after the integration is connected by editing it.

Things to know

• Relationships follow your selection. Relationships between selected entities (for example User → Group) are synced automatically. If you deselect either side of a relationship, that relationship is not synced — deselecting Groups, for example, also stops User → Group access from being mapped.

• Users cannot be deselected. They are required as the anchor for all access data.

• Insights are all-or-nothing per application. Selecting Insights enables every insight type available for that application; individual insight types can't be selected separately today.

• Availability varies by application. Two integrations rarely expose the same entities, so review preferences per integration rather than assuming a common set.

Because deselected data is removed on the next sync, check whether an entity is in use elsewhere in BalkanID before turning it off — for example in active access review campaigns, entitlement rules, or compliance controls.

Need Assistance? Please reach out to [e-mail] if you have any questions or need assistance configuring Data Sync Preferences. We are always available to help!