# SailPoint CyberArk Privilege Cloud Shared Services PAM Discovery Connector Documentation > CyberArk Privilege Cloud Shared Services PAM Discovery Connector Documentation # Documentation # Additional Settings Schedule discovering applications connected to the CyberArk Privilege Cloud Shared Services PAM instance on these configuration pages. You can modify and manage scheduling aggregation directly within the interface. ## Discovery Settings 1. In the **Additional Settings** section, select **Discovery Settings**. 2. To aggregate enterprise applications that are connected to your discovery source, select **Start Discovering**. The aggregation begins immediately and occurs once. 3. Select **Enable Schedule** to schedule recurring aggregations. > **Screenshot** > > [![Discovery Settings]()]() 4. Select the **Frequency** from the dropdown, and enter the time of day. - **Daily** - Aggregation occurs once per day at the time selected. 1. Select the clock icon to choose a **Start Time (GMT - 6:00)** from the dropdown. - **Weekly** - Aggregation occurs once per week on the day and time selected. 1. Select a **Day** of the week, Sunday - Saturday, from the dropdown. 2. Select the clock icon to choose a **Start Time (GMT - 6:00)** from the dropdown. - **Monthly** - Aggregation occurs once per month on the date and time selected. 1. Select a **Date** of the month, 1 - 28, from the dropdown. 2. Select the clock icon to choose a **Start Time (GMT - 6:00)** from the dropdown. > **Note** > > The time zone (GMT offset) for the entitlement aggregation schedule is determined by the time zone set for the connected virtual appliance cluster. 5. Select **Save**. ## Latest Application Discovery Information about the most recent application discovery is displayed under **Latest Application Discovery**. ## Discovery Activity To view the list of all enterprise application aggregations on this source, select **Discovery Activity**. When applications are being aggregated, an entry is added to the Discovery Activity section. This includes information like the admin who started the aggregation (for manual aggregations), the date and time the aggregation occurred, the number of objects scanned, and its current status. Aggregations are ordered by most recent aggregation task. You can also sort by status to quickly find success, warning, error, and terminated tasks. > [!NOTE] > > **Screenshot** > > [![Discovery Activity]()]() # Connecting SailPoint and CyberArk Privilege Cloud Shared Services PAM To connect SailPoint and CyberArk Shared Services PAM, perform the following tasks: ## Adding Discovery Connector in SailPoint Discovery connectors have categories that encompass a group of discovery sources to find enterprise applications. You can automatically discover enterprise applications using discovery sources, which search for applications your organization has on-boarded or can on-board. For more information, refer to [Discovering Enterprise Applications](). 1. Go to **Admin \> Connections \> Discovery Connectors**. 2. Select **Create Connector**. 3. Select **Connector Category**. 4. Select **Continue**. 5. Search for a source type and select **Configure**. 6. Review the directions and select **Start Connector Setup**. 7. Review the pre-populated source name, source owner, and description. To update, select **Edit**. > **Note** > > Source name must be unique. 8. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider. > **Note** > > To add a Credential Provider in SailPoint, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](). 9. Configure the authentication to allow SailPoint to connect to the source. For more information, refer to the **Connection Settings** page. 10. Select **Finish**. A test connection is performed in the background. 11. If the test connection is successful, your source is created, and you are prompted to run a discovery. - If you want to discover applications now, select **Discover**. - **Additional Settings \> Discovery Settings** - The latest application discovery history is shown. - **Additional Settings \> Discovery Activity** - Discovered applications are listed. - If you want to discover applications later, select **Cancel**. As no discovery has taken place, in the source details: - **Additional Settings \> Discovery Settings** - The latest application discovery history is blank. - **Additional Settings \> Discovery Activity** - No discovered applications are listed. You are navigated to the **Sources** page, where the source created is listed. ## Base Configuration Provide the base configuration parameters. Information you entered in the Connector Setup dialog is automatically entered into the fields in the Base Configuration page. You can edit this information, if necessary. > [!NOTE] > > Ensure that the name and description of each connector is unique. 1. Enter a descriptive **Connector Name** for the connection. 2. Enter the **Description** that provides details necessary to distinguish it from similar connection sources. 3. In **Connector Owner**, enter the name of the owner responsible for administrating, operating and managing the source system. 4. Select **Save**. ## Connection Settings The connector must authenticate with CyberArk Shared Services to access and manage data. ### OAuth 2.0 Authentication The connector uses OAuth 2.0 as the default authentication method to connect to CyberArk Shared Services. Use the credentials generated during the Service User creation process to configure the connection. > [!NOTE] > > **Screenshot** > > [![Connection Settings]()]() 1. Enter the **Identity Tenant URL**. 2. Enter the **PVWA Tenant URL**. 3. Enter the **Client ID**. 4. Enter the **Client Secret**. 5. Select **Save**. ## Review and Test Perform a test to confirm the connection to SailPoint. 1. Go to the **Review and Test** page. 2. Review the configuration details for accuracy. 3. If any information is incorrect, return to the relevant section and update the fields. 4. Select **Test Connection**. A success message appears if the connection is established. If the test fails, review your **Authentication and Base Configuration** settings. # Discovering Applications with CyberArk Privilege Cloud Shared Services PAM The SailPoint CyberArk Shared Services PAM Discovery connector retrieves application details configured in CyberArk Shared Services. The connector provides continuous application discovery and identifies inventory across the enterprise. This visibility helps you prioritize and focus governance efforts on high-impact applications. For instructions on creating a CyberArk Shared Services PAM Discovery connector, refer to [Base Configuration](). ## Supported Platforms - CyberArk Shared Services. ## Supported Features The CyberArk Shared Services PAM Discovery connector supports the following features: - Test Connection. - Discovery Application. ## Prerequisites To use OAuth 2.0 authentication, you must create a service account in CyberArk Shared Services and assign the roles required to retrieve platforms. ### Create an OAuth Service User 1. Sign in to the CyberArk **Identity Administration** portal. 2. Go to **Core Services \> Users** and select **Add User**. 3. Enter the following credentials: - **Login name** - This serves as the **Client ID**. - **Display Name** - Enter a descriptive name for the service user. - **Password** - This serves as the **Client Secret**. 4. In the **Status** checklist section, select **Is OAuth confidential client**. 5. Verify that the following options are automatically selected: - **Is Service User** - **Password never expires** 6. Select **Create User**. > [!NOTE] > > Securely store the **Login name** and **Password**. You will need these values to generate the OAuth token. ### Assign Privilege Cloud Roles 1. Go to **Core Services \> Roles**. 2. Select the appropriate Privilege Cloud role based on the required access level (for example, an administrative or read-only role). 3. Go to the **Members** section and select **Add**. 4. Search for and select the service user you created in the previous section. 5. Select **Save**. ## Required Permissions The CyberArk Shared Services PAM Discovery connector requires specific permissions to retrieve platform and application data. Assign the OAuth 2.0 service user to the **Privilege Cloud Users** role in CyberArk to ensure it has the necessary access. Add the connector user to each Safe (required for `GET/Accounts`). 1. In **Privilege Cloud**, go to **Policies \> Safes**. 2. Open the **Safe** that contains the accounts you want to discover. 3. Select **Members** and then select **Add Member**. 4. Search for and select the connector service user (or a group that contains that user). 5. In **Set Permissions**: 1. Set the permission preset to **Read only**. 2. Enable **Access** so the member can access accounts in this **Safe**. 6. Select **Save**. 7. Repeat these steps for each **Safe** whose accounts should appear in account discovery. # Troubleshooting If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support. For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information: - [SailPoint Identity Services Documentation]() - [SailPoint Support Knowledge Base]() - [SailPoint Developer Community]() ## Debug Logs For information about managing additional source settings, including debug logging and downloading connector logs, refer to [Managing Additional Settings]().