Public demo · configuration and integration

Connect what
you own.

Explore the simulator safely, or open a short-lived session against an Azure / Entra tenant you control. Real-tenant credentials never enter Redis, snapshots, events, logs, or HTML.

Security warning. Only use a temporary client secret for a tenant you own. Mutandae holds it in process memory for at most ten minutes and clears it when the session ends. After trying the demo, invalidate this client secret in Entra ID and remove its consent if you no longer need it.

Runtime

Environment contract

Environment: live
Provider: azure-entra (simulated)
Persistence: redis
Protocol: v1
Media type: application/vnd.mutandae.v1+json

Demo mode

What is enabled

Azure/Entra simulator for the public lifecycle inventory
Protocol v1
Optional ephemeral Azure Graph integration
Graph mutations constrained by Application.ReadWrite.OwnedBy
Customer credentials never persisted by Mutandae
Read-only deployment configuration
Redis snapshot persistence
Redis pub/sub change propagation
Redacted integration event receipts
Optional ephemeral Azure integration

The runtime configuration itself is read-only. The optional integration is an isolated, expiring operator session—not a deployment setting.

Optional · bring your own tenant

Try the official Azure protocol path

Mutandae uses Microsoft Graph application APIs with the least-privileged application permission required for the operations below. It checks Graph ownership before every mutation.

Required in Entra ID

Application.ReadWrite.OwnedBy

list applications and owners
create applications (the creating client becomes owner where supported)
addPassword and removePassword only on applications owned by the calling client

Optional vault retrieval

Use an existing Azure Key Vault to retrieve a generated secret after Graph's one-time response expires.

Write: Key Vault Secrets Officer (existing vault, data plane)
Read: Key Vault Secrets User (read only) or Secrets Officer
Owner-only access must be enforced by Azure RBAC/delegated identity.

⚠ The client secret is accepted only over HTTPS and held in memory for a short session.

⚠ Microsoft Graph returns a generated secret only once; without a vault you must copy it immediately.

⚠ Invalidate this integration client secret in Entra ID after the demo and remove its consent if no longer needed.

⚠ Mutandae never stores customer credentials, Graph tokens, or secret plaintext in Redis, snapshots, events, logs, or HTML.

Ephemeral session

Your owned applications

New application display name

Continue the walkthrough

Try the simulator first

Return to the dashboard to inspect synthetic identities, rotate a credential, and follow the correlated lifecycle events. The API discovery document is available at /api/v1/.

Open demo dashboard

Connect whatyou own.