How is ip·Solis different from a full ITSM or service-management suite?

Traditional service-management suites model tickets and workflows, then bolt provisioning on through connectors and professional services. ip·Solis inverts that: the asset definition and the PowerShell runbook that fulfils it are the product. You get self-service, approval and deprovisioning without a platform team or a long integration project.

Does our IAM or identity-governance platform not already do this?

Identity governance decides who may have access. ip·Solis does the provisioning itself — it runs your scripts against AD, SCCM, XenServer and VMware to actually create, assign and reclaim the asset. Most teams run ip·Solis alongside their IdP via SCIM 2.0, not instead of it.

Do we still need a CMDB?

Keep it. A CMDB records what exists; ip·Solis is the layer that requests, provisions, assigns and retires it. It sits between your CMDB, your HR and IAM systems and your runbooks rather than replacing any of them.

Why not just script this ourselves with a runbook or orchestration tool?

You can — and ip·Solis runs exactly those scripts. What it adds around them is the employee self-service portal, one-click approvals, pooled vs. personal assignment with quota and expiry, an append-only audit log and leaver automation. That surrounding layer is usually the part teams underestimate when they build it in-house.

Features

Every feature, organised by job to be done

ip·Solis is opinionated. Here is the full surface area, grouped by the team that uses it most.

Self-service

Employee portalA "My IT" view of every asset a user holds — modify, return or cancel in one place.
Entitlement-aware catalogueRequesters see only assets they are eligible for, with PII/PHI/PCI data-class badges.
Self-service packagesCurated onboarding bundles a user requests as one package — many assets, one click.
One-click approvalSigned email links, Microsoft Teams or Slack cards — approve or decline without a portal login.
Manager order-on-behalfManagers order for their direct reports; their own approval is recorded automatically.
Order timelineA live state machine per order, with per-step runbook output for diagnosis.
Cancel and returnCancel before provisioning; Return runs the deprovision runbook — every action audited.

Lifecycle & Asset Pool

Asset definitionsOne definition holds the assignment model, runbooks, entitlements, cost and data class.
Pooled assignmentShared capacity with allocate-on-request, optional reinstall on return, and live fill dashboards.
Personal assignmentA dedicated instance per user, with per-type capacity limits and expiry.
Assignment rulesRules map AD attributes — department, cost center — to bundles for automatic provisioning.
Recycle workflowsPer-type deprovision policy: access-only removal, clean pool return, or triggering a reinstall, e.g. via SCCM.
Leaver deprovisionA SCIM or HR event revokes every asset the leaver holds — idempotent and safe to re-fire.

Automation & Runbooks

Native PowerShell 7 workerRuns any PowerShell 7-compatible script natively on Linux — bring your own, with light adaptation for how variables pass between steps.
Chained runbook stepsOrdered steps with template variables; each logs input, output, timing and errors.
Critical-step semanticsA failed critical step halts the runbook and marks the order Failed — no silent partials.
Cron schedulesStandalone runbooks on standard cron expressions (evaluated in UTC), with run history.
Overlap protectionPool reservations use row-level SKIP LOCKED so two orders never grab the same asset; a standalone runbook skips a new run while its previous one is still active.
Config export / importExport asset types and pools as portable JSON; re-import is insert-only and safe.

Compliance & Audit

Access certificationScoped review campaigns with signed-token approval and optional auto-revoke on deadline.
Append-only audit logDatabase-enforced immutability with full before/after diffs and precise actor attribution.
SCIM joiner/mover/leaverFull JML from Okta, SailPoint, Ping or Entra — provision, reconcile and revoke.
Access drift reconciliationRe-reads actual AD group membership and flags or auto-remediates out-of-band changes.
Point-in-time access reportReconstruct who had access to what on any past date by replaying the change log.
Signed attestation certificatesHandover and revocation/disposal certificates, delivered via signed-token links as ISO 27001 evidence.
Evidence exportExport the point-in-time access report and cost report to CSV for auditors.

FinOps & Cost

Per-provider cost reportProjected monthly spend per providing cost center — aggregated across all systems you operate.
Cost-center & department viewsChargeback by the requester HR attributes, snapshotted at order time.
Software contract lifecycleTrack vendor contracts, seat consumption and shelfware, with renewal reminders.
Threshold alertsPer-cost-center ceilings notify by email or Teams, with a quiet window.
CSV exportFull per-order cost breakdown, including portal, API and ServiceNow orders.

Operations & SLA

Operations dashboardFailed provisionings, overdue approvals and upcoming expirations on one board.
Batch retryMulti-select failed orders and retry them in one action, guarded to failed-only.
Fulfillment SLAConfigurable thresholds surface overdue approvals and stuck-in-progress orders.
Guided setup wizardA stepper over the setup checklist with inline connection tests for email, AD, Teams and SIEM.

Integrations

Active DirectoryLDAP/LDAPS with NTLM signing — group membership, attribute lookup and live manager lookup.
Entra ID (Microsoft Graph)App-only Graph provisioning of Entra/M365 group membership for cloud-only estates.
SCCMDevice import and collection assignment via AdminService REST (Kerberos), with async task-sequence polling.
XenServer / VMwareXenServer/XCP-ng via XenAPI; VMware via PowerCLI runbooks you author. Self-signed pool and vCenter certificates handled.
SCIM 2.0 identity providersJoiner/mover/leaver provisioning from any RFC 7644 identity provider.
Teams & SlackApprovals as Adaptive Cards or Slack Block Kit; cost-threshold alerts to Teams and email.
Generic webhookHMAC-signed ServiceNow or HRIS payloads flow through the same approval and runbook pipeline.

Security

Scoped API tokensNamed, hashed tokens with granular scopes and a role-bound mint guard.
Admin RBACFive roles, per-asset-type ACLs and a separation-of-duties check.
External secret storesIntegration credentials configured in the admin UI resolve from Vault, CyberArk, Azure Key Vault, AWS SM or Conjur at read time.
Backup encryption at restOptional AES-256 encryption of database backups, keyed by an infra secret.
TLS everywhereTLS enforced on every external HTTP endpoint (nginx 80→443, TLS 1.2/1.3); SMTP uses STARTTLS on port 587.
Accessible portalStructural BITV/EN 301 549 basics: skip links, landmarks, keyboard focus and live regions.

Where it fits