# Integrating SailPoint with Dropbox SaaS

The SailPoint Dropbox SaaS connector manages enterprise users of Dropbox for Business.

This document is designed to give specific information about the requirements and field definitions needed to get a working instance of a Dropbox SaaS connector.

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

The Dropbox SaaS connector supports the following features:

> [!NOTE]
>
> Before you can use any feature marked with an asterisk (\*), SailPoint must activate the feature for your site.

- Load and provision(\*) Dropbox users as Accounts
- Enable and disable Accounts
- Dropbox groups as Account - Groups
- \*Access certifications (certification of entitlements connected to accounts)
- Delete Accounts

### Activity Insights

Activity Insights supports activity from Dropbox and its associated accounts. This allows you to gather account information and activity data from Dropbox.

> [!IMPORTANT]
>
> Contact your SailPoint Customer Success Manager (CSM) for more information on Activity Insights. For more information on configuring Activity Insights, refer to Activity Insights Settings.

Refer to [Source Features](<https://community.sailpoint.com/knowledge/Identity-Security-Cloud-Source-Features>) for more information on features.

## Supported Managed System

The Dropbox SaaS connector supports Dropbox Business API Version 2 supported by Dropbox server managed system.

## Prerequisites

- The Dropbox managed system should be running.
- You must generate the access token for the Dropbox SaaS application. The Dropbox SaaS administrator acquires it from the Dropbox business server using the OAUTH2 mechanism to allow SailPoint to interact with the Dropbox server. Access tokens are valid until the user uninstalls the application or explicitly revokes the grant through the Dropbox SaaS page.

> [!NOTE]
>
> Refer to the [OAuth Guide](<https://developers.dropbox.com/oauth-guide>) in the Dropbox documentation for more information.

Following are the steps to generate a refresh token:

1. Construct authorization URL for the required app using the following example:

   ```text
   https://www.dropbox.com/oauth2/authorize?client_id=<APP_KEY>&response_type=code&token_access_type=offline
   ```

   where `<APP_KEY>` is the Dropbox App Key. For the URL drop application, use admin credentials to sign in. After signing in, it provides the authorization code as a result.
2. Use the following token API to get the refresh token:

   ```text
   curl https://api.dropbox.com/oauth2/token \
   -d code=<AUTHORIZATION_CODE> \
   -d grant_type=authorization_code \
   -u <APP_KEY>:<APP_SECRET>
   ```

   Where:

   - `<AUTHORIZATION_CODE>` - The construct authorization code received earlier
   - `<APP_KEY>` - The Dropbox App Key
   - `<APP_SECRET>` - The Dropbox App Secret

## Required Permissions

Applications created in Dropbox SaaS require the following permission, which has read and update rights:

- Team member management - Team information, and the ability to add, edit, and delete team members

> [!NOTE]
>
> The default role for any user in the Dropbox SaaS source is **Members\_only** and it cannot be deleted.

### For Activity Insights

An administrator requires the following additional permissions to utilize the Activity Insights:

| Scope | Description |
| --- | --- |
| team\_data.member | View structure of your team's and members' folders. |
| events.read | View your team's activity log. |

Refer to [Activity Insights Settings](<https://documentation.sailpoint.com/connectors/dropbox/saas/help/connecting.html#activity-insights-settings>) for more information on configuring Activity Insights.