# Integrating SailPoint with Delinea Secret Server Cloud

> [!NOTE]
>
> **Integration**
>
> This is an integration and requires additional licensing or subscriptions to utilize it. For more information, contact your customer success manager.

The SailPoint connector for Delinea Secret Server Cloud provides deep governance for Accounts and Groups (Safes). This integration is capable of end-to-end life cycle management.

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

The Delinea Secret Server Cloud source supports user (account) and entitlement (group and roles) management.

### User Management (Accounts)

- Aggregation of internal and external users
- Refresh users
- Create user provisioning for local users
- Enable / Disable users with provisioning
- Add users to groups

  > **Note**
  >
  > The Delinea Secret Server Cloud connector uses the PATCH method to add and remove users in groups via the group endpoints.
- Remove users from groups
- Assign roles to users

  > **Note**
  >
  > The Delinea Secret Server Cloud connector uses the PATCH method to assign roles to users, remove roles from users, fetch roles, and fetch users assigned to roles via the users' endpoints.
- Remove roles from users

### Group Management (Entitlements)

- Group aggregation
- Single group aggregation
- Aggregate container permissions as direct permissions
- Roles aggregation
- Single role aggregation

### Supported Use Cases

The following use cases are facilitated by the Delinea Secret Server Cloud connector.

**Read Operation**

- Fetch local and external users from the PAM system.
- Fetch local groups from the PAM system.
- View Safes / Containers and view how their permissions are assigned to groups.
- Fetch roles from the PAM system.

**Provisioning**

- Create local users on the PAM system.
- Add or remove internal and external users from local groups. This indirectly assigns and revokes Safes and their associated permissions.
- Enable or disable internal and external users residing on the PAM system.
- Assign roles to users, and remove roles from users.

For more information on features, refer to [Source Features](<https://community.sailpoint.com/knowledge/Identity-Security-Cloud-Source-Features>).

## Prerequisites

Complete the following necessary tasks before configuring SailPoint Delinea Secret Server Cloud connector.

> [!CAUTION]
>
> The Delinea Secret Server Cloud documentation referenced in this page is not managed by SailPoint, and is subject to change without notice.

- Configure at least one virtual appliance cluster and successfully test the connection. For instructions, refer to the [Virtual Appliance Reference Guide](<https://documentation.sailpoint.com/saas/help/va/index.html>).
- Configure a SCIM connector for Delinea Secret Server.

  For more information, refer to [SCIM Connector for Secret Server](<https://docs.delinea.com/online-help/products/int/current/scim>) in the Delinea Secret Server documentation.
- Configure an Application User account.

  For more information, refer to [Account Permissions](<https://docs.delinea.com/online-help/products/int/current/scim/setup#account_permissions>) in the Delinea Secret Server documentation.
- Generate a token for authorization.

  For more information, refer to [SCIM Connector Endpoint Information](<https://docs.delinea.com/online-help/products/int/current/scim/config/connector-config.md>) in the Delinea Secret Server documentation.
- The Delinea Secret Server Cloud connector requires Delinea SCIM Connector version 4.4.4 or later to assign roles to users, remove roles from users, fetch roles, and fetch users assigned to roles.

## Required Permissions for Managing Roles

Specific permissions must be set in the source to enable SailPoint to manage roles. The following table lists the features that rely on which required permissions found in the Delinea Secret Server source.

| Feature | Required Permission | Description |
| --- | --- | --- |
| Fetch roles | View Roles | Allows a user to view roles in the system. Also allows a user to see which groups are assigned to which roles. |
| View the roles assigned to a user or a group | View Group Roles | Allows a user to see which groups and users are assigned to which roles. Does not allow a user to change these assignments. |
| Edit the roles assigned to a user | Administer Role Assignment | Allows a user to view which users and groups are assigned to which roles. Also allows users to assign users and groups to different roles. |

## Supported Managed Systems

The Delinea Secret Server Cloud source supports the following managed systems:

- Delinea Secret Server Cloud with Delinea SCIM Connector 4.4.4

  > **Note**
  >
  > This managed system is required to manage roles.
- Delinea Secret Server Cloud with Delinea SCIM Connector 4.6.0
- Delinea Secret Server Cloud with Delinea SCIM Connector 4.7.0