# Integrating SailPoint with CyberArk Privileged Access Manager (Self-Hosted)

> [!NOTE]
>
> **Integration**
>
> This is an integration and requires additional licensing or subscriptions to utilize it. For more information, contact your customer success manager.

A SailPoint and self-hosted CyberArk Privileged Access Manager (PAM) integration provides deep governance capability for Accounts and Groups (Safes). This integration is capable of end-to-end life cycle management.

This document is designed to give information about the requirements and field definitions needed to set up a working integration of a CyberArk PAM (Self-Hosted) source in SailPoint.

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

The SailPoint CyberArk PAM (Self-Hosted) connector supports the following features:

> [!NOTE]
>
> Before you can use any item marked with an asterisk (\*), SailPoint must activate the feature for your site.

#### Account Management

- Aggregation (Internal and External Users)
- Account refresh
- Create account via provisioning (Local Users)
- Enable and disable account via provisioning
- Delete Accounts
- Add and remove entitlements (Local Groups)

  > **Note**
  >
  > The SailPoint CyberArk PAM (Self-Hosted) connector uses PUT method to add users to groups via the Groups endpoint.

#### Entitlement Management (Groups)

- Groups aggregation
- Single group aggregation
- Aggregate container or safe permissions as Direct Permissions

## Supported Use Cases

The following use cases are facilitated by the CyberArk PAM (Self-Hosted) connector:

**Read Operation**

- Fetch local and external users from the PAM system.

  Local users refers to users locally residing in PAM. External users refers to users synced from external managed system to PAM systems.
- Fetch local groups from the PAM system.
- View Safes/Containers and its permissions assigned to groups.

**Provisioning**

- Create local users on the PAM system.
- Add or remove internal and external users from local groups. This indirectly assigns and revokes Safes and its associated permissions.
- Enable or disable internal and external users residing on the PAM system.

For more information on features, refer to [Source Features](<https://community.sailpoint.com/knowledge/Identity-Security-Cloud-Source-Features>).

## Supported Managed Systems

The CyberArk PAM (Self-Hosted) connector supports the following managed system:

- CyberArk Privileged Access Manager (PAM) 13.0.0
- CyberArk Privileged Access Manager (PAM) 14.0.1

> [!NOTE]
>
> The CyberArk PAM (Self-Hosted) connector only supports interactions with a cloud-hosted SCIM server.

## Prerequisites

- Configure at least one virtual appliance cluster and successfully test the connection. For more information, refer to the [Virtual Appliance Reference Guide](<https://documentation.sailpoint.com/saas/help/va/index.html>).
- You must have CyberArk Identity SCIM Server installed on your enterprise.

  For information on configuring the CyberArk Identity SCIM Server, refer to [Configure the SCIM server](<https://docs.cyberark.com/Product-Doc/OnlineHelp/Idaptive/Latest/en/Content/Developer/scim-management/scim-server-configuration.htm>) in the CyberArk documentation or reach out to your CyberArk partner.
- For more prerequisite information for deploying CyberArk PAM (Self-Hosted), refer to [Manage privileged objects in CyberArk PAM - Self-Hosted](<https://docs.cyberark.com/Product-Doc/OnlineHelp/Idaptive/Latest/en/Content/Integrations/CyberArk-SCIM-PAS.htm?TocPath=Administrator%7CIntegrate with an IGA platform using SCIM%7C_____3>).

## Administrator Permissions

For the permissions and access details, refer to [SCIM Server Configuration](<https://identity-developer.cyberark.com/docs/scim-server-configuration>).