# Discovering Applications with CyberArk Privilege Cloud Shared Services PAM

The SailPoint CyberArk Shared Services PAM Discovery connector retrieves application details configured in CyberArk Shared Services. The connector provides continuous application discovery and identifies inventory across the enterprise. This visibility helps you prioritize and focus governance efforts on high-impact applications. For instructions on creating a CyberArk Shared Services PAM Discovery connector, refer to [Base Configuration](<https://documentation.sailpoint.com/connectors/discovery/pam/cyberark_pam/help/connecting.html#base-configuration>).

## Supported Platforms

- CyberArk Shared Services.

## Supported Features

The CyberArk Shared Services PAM Discovery connector supports the following features:

- Test Connection.
- Discovery Application.

## Prerequisites

To use OAuth 2.0 authentication, you must create a service account in CyberArk Shared Services and assign the roles required to retrieve platforms.

### Create an OAuth Service User

1. Sign in to the CyberArk **Identity Administration** portal.
2. Go to **Core Services \> Users** and select **Add User**.
3. Enter the following credentials:

   - **Login name** - This serves as the **Client ID**.
   - **Display Name** - Enter a descriptive name for the service user.
   - **Password** - This serves as the **Client Secret**.
4. In the **Status** checklist section, select **Is OAuth confidential client**.
5. Verify that the following options are automatically selected:

   - **Is Service User**
   - **Password never expires**
6. Select **Create User**.

> [!NOTE]
>
> Securely store the **Login name** and **Password**. You will need these values to generate the OAuth token.

### Assign Privilege Cloud Roles

1. Go to **Core Services \> Roles**.
2. Select the appropriate Privilege Cloud role based on the required access level (for example, an administrative or read-only role).
3. Go to the **Members** section and select **Add**.
4. Search for and select the service user you created in the previous section.
5. Select **Save**.

## Required Permissions

The CyberArk Shared Services PAM Discovery connector requires specific permissions to retrieve platform and application data. Assign the OAuth 2.0 service user to the **Privilege Cloud Users** role in CyberArk to ensure it has the necessary access.

Add the connector user to each Safe (required for `GET/Accounts`).

1. In **Privilege Cloud**, go to **Policies \> Safes**.
2. Open the **Safe** that contains the accounts you want to discover.
3. Select **Members** and then select **Add Member**.
4. Search for and select the connector service user (or a group that contains that user).
5. In **Set Permissions**:

   1. Set the permission preset to **Read only**.
   2. Enable **Access** so the member can access accounts in this **Safe**.
6. Select **Save**.
7. Repeat these steps for each **Safe** whose accounts should appear in account discovery.