Identity management at terminal speed

id9s

A terminal UI for hybrid identity — Active Directory, Entra ID, and Microsoft 365 — inspired by k9s.

Active development v0.7.1
Install See what it does Read the docs
id9s — :users — corp-hq
id9s :users view listing hybrid identity accounts, with per-context keyboard shortcuts grouped by purpose: navigate, lifecycle (onboard/offboard), access & security, and session

What it does

Built for the keyboard

Every action is a keystroke away from whatever's selected — no page reloads, no click-throughs.

u

Unlock account

Unlock an Active Directory account instantly, without handing off to a console.

r

Reset password

Reset credentials on the spot, gated behind a required confirmation step.

k

Kill sessions

Revoke a compromised user's Entra ID sessions in a single motion.

n

Onboard wizard

Guided account creation with a suggested username from accent transliteration — on-prem AD only, or straight into Entra ID.

o

Offboard wizard

A filterable checklist of retirement actions, pre-checked from what's actually found on the account, run best-effort behind a typed confirmation.

R

Reset MFA

Clear a user's registered authentication methods and force re-enrollment on Entra ID.

v

Revoke device

Pick a registered device from a filterable list and revoke it in a couple of keystrokes.

l

Assign licenses

Toggle Microsoft 365 licenses on an Entra ID user from a filterable picker, with a clear confirmation before saving.

Why not another web console

Speed is the feature

Terminal speed

Every action is a key you already know. When you manage identities daily, the gap between a web console and a terminal is minutes versus seconds.

No middleware

id9s is a single standalone binary. It speaks LDAPS (or plain LDAP, opt-in) to your domain controllers and HTTPS/REST to Microsoft Graph directly — no server to run, no dashboard to keep alive, and credentials never leave your OS keyring.

Multi-context

Define your AD domains and Entra tenants once, kubeconfig-style, then switch context on the fly — no restart, no re-entering credentials.

Get started

Up and running in a minute

No config file to hand-write first — id9s walks you through it.

01

Install

On macOS and Linux, install with Homebrew:

brew install lazy-admins/id9s/id9s

Prebuilt binaries for macOS, Windows, and Linux are also on GitHub Releases. Free to use under the Apache License 2.0.

02

Launch and pick a command

id9s opens on a simple command menu — use, add, edit, delete, or clone a context, or jump straight to :users.

id9s welcome screen with a COMMANDS menu: use, add, edit, delete, clone context, or continue to users
03

Point it at AD or Entra ID

Add a context: on-prem Active Directory over LDAPS, or Entra ID via interactive browser SSO. Secrets never touch config.yaml — they live in your OS keyring.

id9s context type picker: Active Directory (LDAPS, bind_user) or Entra ID (Microsoft Graph, login SSO via browser)
04

Drill into any user

Hit d on any row for the full picture — groups, licenses, MFA methods, passkeys, registered devices, recent sign-ins — without leaving the keyboard.

id9s user details view showing identity, groups, licenses, account security, and recent sign-ins for a selected user

Roadmap

Shipped, and what's next

Shipped v0.7.1

  • Active Directory via LDAPS (default) or plain LDAP — unlock, enable/disable, password reset, profile editing, group membership, move OU
  • Entra ID via Microsoft Graph — browser SSO login, enable/disable, password reset, profile editing, group membership
  • Kill sessions, reset MFA, revoke passkey, and revoke device (Entra ID)
  • License assignment and removal (Entra ID), with a filterable multi-select picker
  • Group type (Security / Distribution / Microsoft 365) shown for AD and Entra ID
  • Account source, mailbox presence, and license visibility
  • Multi-context switching, in-app, no restart
  • Re-authenticate a context in place, without deleting and re-adding it
  • Built-in, filterable audit log viewer
  • Onboarding wizard — guided account creation, AD (on-prem only) or Entra ID (cloud), with a suggested username from accent transliteration
  • Offboarding wizard — filterable checklist of retirement actions, executed best-effort, with a typed-UPN confirmation
  • Bulk actions — select many users and act on all of them (including offboarding), with a per-user review screen and a random-word confirmation
  • Inactive accounts — last sign-in column and a filter for users with no sign-in for 30 to 365+ days
  • Sort by any column, with company and department shown next to each user
  • Automated builds — every release tag publishes prebuilt binaries for macOS, Windows, and Linux
  • Homebrew formula — brew install lazy-admins/id9s/id9s

Planned

  • LDAPS certificate validation — system trust store by default, plus an optional custom CA per context
  • Richer audit log — every entry records the operator and the context it ran against
  • Scoop bucket for Windows
  • RBAC baseline

Exchange Online mailbox management is a deliberate non-goal: mailbox permissions/delegates (Full Access, Send As, Send on Behalf) have no Graph REST endpoint at all, and even read-only mailbox settings only work for an operator's own mailbox via delegated Graph permissions — reading other users' would need an app-only permission, which requires a stored client secret and conflicts with id9s's standalone, no-secret design.