Dataset Management
Dataset Management lets you review the object types a source collects and control how the source aggregates those objects into SailPoint. Use Dataset Management to view and manage resource attributes, datasets and their resources, enable dataset aggregation schedules, perform manual aggregation, and view aggregation history.
Note
Datasets are also available in SailPoint Agentic Fabric. Contact your Customer Success team and refer to SailPoint Agentic Fabric for more information.
For more information, refer to Managing Datasets and Resources for datasets, resources, owner correlation, and aggregation.
Datasets
A dataset is a named group of one or more related resources that the source aggregates together.
When aggregation runs for a dataset, the source collects all resources in that dataset from the managed system in one aggregation job. Activate or deactivate aggregation at the dataset level, not for individual resources.
Note
Each resource belongs to exactly one dataset for that source. The source defines which resources belong to each dataset. You can enable aggregation and review associated resources, but you cannot create or delete datasets or move resources between them.
Dataset Aggregation
Configure aggregation on the Dataset Aggregations tab for each dataset. Configure each dataset separately. During aggregation, your owner correlation rules are automatically applied to link machine identities to their human owners. For more information, refer to Configuring Dataset Aggregations.
Resources
A resource defines an object type from the managed system. It specifies the kind of object, the attributes the source collects, and how the source identifies and displays each object. Resources form the building blocks of the data model.
In the UI, each resource appears under Dataset Management > Resources with its schema. A resource does not run aggregation by itself. The dataset that owns the resource collects it during aggregation.
For more information, refer to Managing Resources.
Owner Correlation
Configure owner correlation on each resource to link aggregated objects to human owners. If you do not configure owner correlation, or if the mapping produces no match, an owner is not assigned. For more information, refer to Configuring Owner Correlation.
Supported Datasets
Go to Dataset Management > Datasets on your Google Workspace SaaS source to view the datasets the connector aggregates. Select a dataset to review its associated resources and configure aggregation.
Note
Configure aggregation for each dataset separately. For more information, refer to Dataset Aggregation.
The connector uses datasets to schedule aggregation of the following resource types:
| Dataset | Resource Type | Associated Resources |
|---|---|---|
| Google API Key | Credential | Google API Key |
| Google API Key Credential | Credential | Google API Key Credential |
| Google Service Account | Credential | Google Service Account |
| GCP Workload Identity Federation | Credential | GCP Workload Identity Federation |
| GCP Workforce Identity Federated Principals | Account | GCP Workforce Identity Federated Principal, GCP Workforce Principal Has Role |
| GCP Workload Identity Federated Principals | Account | GCP Workload Identity Federated Principal, GCP Workload Principal Has Role |
| GCP Vertex | Agent | GCP Vertex AI Agent |
| GCP Agent Registry | Agent | GCP Agent Registry Agent, GCP Agent Registry Skill, GCP Agent Registry Agent Uses Skill |
Supported Resources
A resource represents a type of object the connector collects from the connected system, such as service accounts, bots, or agents. Each resource defines the attributes collected for that object type and how each object appears in SailPoint.
For more information, refer to Managing Resources.
Note
When you enable dataset aggregation for a selected dataset, all resources in that dataset are collected at once. Activate or deactivate aggregation at the dataset level, not for individual resources.
Google API Key
| Field | Value |
|---|---|
| Resource ID | gcp:google-api-key |
| Resource type | std:credential |
| Identity attribute | id |
| Display attribute | id |
The following table lists schema attributes for the Google API Key resource:
| Attribute | Description | Type | Entitlement | Multi-valued |
|---|---|---|---|---|
| complianceBreach | Compliance control IDs that have been breached. | string | No | Yes |
| exposed | Indicates whether the key is externally exposed. | boolean | No | No |
| id | Stable token identifier from SailPoint NHI Discovery. | string | No | No |
| lastUsedService | The Google API service most recently used by this key. | string | No | No |
| ownerEmail | Flattened primary owner email used for owner correlation. | string | No | No |
| riskSeverity | Severity band from SailPoint NHI Discovery. | string | No | No |
| suspiciousActivity | Whether SailPoint NHI Discovery has flagged suspicious activity for this key. | boolean | No | No |
| tags | Tags carried through from the source. | string | No | Yes |
Google API Key Credential
| Field | Value |
|---|---|
| Resource ID | gcp:api-key-credential |
| Resource type | std:credential |
| Identity attribute | sailpointId |
| Display attribute | sailpointId |
The following table lists schema attributes for the Google API Key Credential resource:
| Attribute | Description | Type | Entitlement | Multi-valued |
|---|---|---|---|---|
| accountType | The source account type (GCP). | String | No | No |
| allowedAndroidApps | The allowed Android package names from Android key restrictions. | String | No | Yes |
| allowedIosBundleIds | The allowed iOS bundle IDs from iOS key restrictions. | String | No | Yes |
| allowedIps | The allowed IP addresses from server key restrictions. | String | No | Yes |
| allowedReferrers | The allowed HTTP referrers from browser key restrictions. | String | No | Yes |
| androidApplications | The Android application restrictions, including the package name and SHA-1 fingerprint. | Object | No | Yes |
| annotations | The unstructured key-value annotations stored on the API key. | Object | No | No |
| apiTargets | The Google APIs the key is allowed to call. | String | No | Yes |
| createTime | The timestamp when the API key was created. | String | No | No |
| creatorEmail | The primary creator email used for owner correlation. | String | No | No |
| deleteTime | The timestamp when the key was soft-deleted. This value is populated for deleted keys and omitted for active keys. | String | No | No |
| environment | The environment label derived from project labels, when present. | String | No | No |
| etag | The server checksum of the Key resource. | String | No | No |
| hasApiRestrictions | Indicates whether the key lists specific API targets (true or false). |
Boolean | No | No |
| identity | The unique identifier for the API key, in the format {projectId}:{uid}. |
String | No | No |
| locationId | The Google Cloud location of the API key. API keys are global. | String | No | No |
| name | The display name of the API key. | String | No | No |
| nhiType | The non-human identity classification. Always set to GOOGLE_API_KEY. |
String | No | No |
| owners | The owner emails from project and organization IAM. | String | No | Yes |
| projectDisplayName | The display name of the Google Cloud project that owns the API key. | String | No | No |
| projectId | The ID of the project that owns the API key. | String | No | No |
| projectNumber | The numeric Google Cloud project number parsed from the key resource name. | String | No | No |
| resourceName | The Google Cloud resource name, in the format projects/{projectNumber}/locations/global/keys/{uid}. |
String | No | No |
| resourceUrl | The deep link to the API key credential in the Google Cloud console. | String | No | No |
| restrictionType | The client restriction type (browser, server, android, ios, or none). |
String | No | No |
| riskSeverity | The restriction-based risk band (HIGH, MEDIUM, LOW, or UNKNOWN). |
String | No | No |
| riskSummary | A short explanation of why the risk severity was assigned, based on API targets and client restrictions. | String | No | No |
| sailpointId | The native identity of the API key credential, in the format {projectId}:{uid}. |
String | No | No |
| serviceAccountEmail | The service account the key is bound to, when present. | String | No | No |
| Status | The reserved NHI status. Active applies to enabled keys. Deleted applies to soft-deleted keys. Enabled credentials must have the value Active. |
String | No | No |
| tags | The project labels, stored as key-value strings. | String | No | Yes |
| uid | The Google Cloud API key UID. | String | No | No |
| updateTime | The timestamp when the key was last updated. | String | No | No |
Google Service Account
| Field | Value |
|---|---|
| Resource ID | gcp:service-account |
| Resource type | std:credential |
| Identity attribute | id |
| Display attribute | id |
The following table lists schema attributes for the Google Service Account credential resource:
| Attribute | Description | Type | Entitlement | Multi-valued |
|---|---|---|---|---|
| complianceBreach | Compliance control IDs that have been breached. | string | No | Yes |
| exposed | Whether the service account key is externally exposed. | boolean | No | No |
| id | Stable token identifier from SailPoint NHI Discovery. | string | No | No |
| lastUsedService | Downstream service most recently used by the key. | string | No | No |
| ownerEmail | Flattened primary owner email used for owner correlation. | string | No | No |
| riskSeverity | Severity band from SailPoint NHI Discovery. | string | No | No |
| suspiciousActivity | Whether SailPoint NHI Discovery has flagged suspicious activity for the key. | boolean | No | No |
| tags | Tags carried through from the source. | string | No | Yes |
GCP Workload Identity Federation
| Field | Value |
|---|---|
| Resource ID | gcp:service-account-wif |
| Resource type | std:credential |
| Identity attribute | id |
| Display attribute | id |
The following table lists schema attributes for the GCP Workload Identity Federation resource:
| Attribute | Description | Type | Entitlement | Multi-valued |
|---|---|---|---|---|
| complianceBreach | Compliance control IDs that have been breached. | string | No | Yes |
| exposed | Whether the workload identity federation binding is exposed. | boolean | No | No |
| id | Stable token identifier from SailPoint NHI Discovery. | string | No | No |
| lastUsedService | Downstream service most recently used by the binding. | string | No | No |
| ownerEmail | Flattened primary owner email used for owner correlation. | string | No | No |
| riskSeverity | Severity band from SailPoint NHI Discovery. | string | No | No |
| suspiciousActivity | Whether SailPoint NHI Discovery has flagged suspicious activity for the binding. | boolean | No | No |
| tags | Tags carried through from the source. | string | No | Yes |
GCP Workforce Identity Federated Principal
| Field | Value |
|---|---|
| Resource ID | gcp:workforce-principal |
| Resource type | std:account |
| Identity attribute | sailpointId |
| Display attribute | sailpointId |
The following table lists schema attributes for the GCP Workforce Identity Federated Principal resource:
| Attribute | Description | Type | Entitlement | Multi-valued |
|---|---|---|---|---|
| classification | The account classification. Always set to machine. | string | No | No |
| externalIdentityRef | The external subject, group, or attribute reference. This field is empty for wildcards. | string | No | No |
| impersonatedServiceAccounts | The email addresses of the service accounts this principal can impersonate. | string | No | Yes |
| isAdmin | Indicates whether the principal holds an owner, editor, or administrator role (true or false). | boolean | No | No |
| location | The location of the identity pool, typically global. | string | No | No |
| poolId | The identity pool ID derived from the IAM member path. | string | No | No |
| poolResourceName | The full Google Cloud resource name of the identity pool. | string | No | No |
| poolType | The type of the identity pool. | string | No | No |
| principalScheme | The principal scheme format (principal or principalSet). | string | No | No |
| sailpointId | The full IAM member URI starting with principal:// orprincipalSet://. |
string | No | No |
| selectorType | The selector type (subject, group, attribute, or wildcard). | string | No | No |
| selectorValue | The selector value extracted from the IAM member. | string | No | No |
GCP Workforce Principal Has Role
| Field | Value |
|---|---|
| Resource ID | gcp:workforce-principal-has-role |
| Resource type | std:access |
The following table lists schema attributes for the GCP Workforce Principal Has Role resource:
| Attribute | Description | Type | Entitlement | Multi-valued |
|---|---|---|---|---|
| identity | The unique identifier for the access link, in the format {resourceId}#{principal}#{resource}#{role}. |
string | No | No |
| linkResolvedBy | The service that resolved this access link. | string | No | No |
GCP Workload Identity Federated Principal
| Field | Value |
|---|---|
| Resource ID | gcp:workload-principal |
| Resource type | std:account |
| Identity attribute | sailpointId |
| Display attribute | sailpointId |
The following table lists schema attributes for the GCP Workload Identity Federated Principal resource:
| Attribute | Description | Type | Entitlement | Multi-valued |
|---|---|---|---|---|
| classification | The account classification. Always set to machine. | string | No | No |
| externalIdentityRef | The external subject, group, or attribute reference. This field is empty for wildcards. | string | No | No |
| impersonatedServiceAccounts | The email addresses of the service accounts this principal can impersonate. | string | No | Yes |
| isAdmin | Indicates whether the principal holds an owner, editor, or administrator role (true or false). | boolean | No | No |
| location | The location of the identity pool, typically global. | string | No | No |
| poolId | The identity pool ID derived from the IAM member path. | string | No | No |
| poolResourceName | The full Google Cloud resource name of the identity pool. | string | No | No |
| poolType | The type of the identity pool. | string | No | No |
| principalScheme | The principal scheme format (principal or principalSet). | string | No | No |
| projectNumber | The numeric Google Cloud project that owns the workload identity pool. | string | No | No |
| sailpointId | The full IAM member URI starting withprincipal:// or principalSet://. |
string | No | No |
| selectorType | The selector type (subject, group, attribute, or wildcard). | string | No | No |
| selectorValue | The selector value extracted from the IAM member. | string | No | No |
GCP Workload Principal Has Role
| Field | Value |
|---|---|
| Resource ID | gcp:workload-principal-has-role |
| Resource type | std:access |
The following table lists schema attributes for the GCP Workload Principal Has Role resource:
| Attribute | Description | Type | Entitlement | Multi-valued |
|---|---|---|---|---|
| identity | The unique identifier for the access link, in the format {resourceId}#{principal}#{resource}#{role}. |
string | No | No |
| linkResolvedBy | The service that resolved this access link. | string | No | No |
GCP Vertex AI Agent
Vertex AI agents discovered through Agent Registry are aggregated in the GCP Agent Registry dataset. Refer to GCP Agent Registry Agent for more information.
| Field | Value |
|---|---|
| Resource ID | gcp:vertex-agent |
| Resource type | std:agent |
| Identity attribute | identity |
| Display attribute | name |
The following table lists schema attributes for this resource:
| Attribute | Description | Type | Entitlement | Multi-valued |
|---|---|---|---|---|
| identity | Unique identifier for the agent. | string | No | No |
| name | The name assigned to the agent. | string | No | No |
| projectId | The ID of the project under which the agent resides. | string | No | No |
| locationId | The GCP region ID in which the agent resides. | string | No | No |
| createTime | The timestamp when the agent was created. | string | No | No |
| updateTime | The timestamp when the agent was last updated. | string | No | No |
| agentFramework | The open-source agent framework used to develop the agent. | string | No | No |
| effectiveIdentity | The resolved runtime identity that the agent executes as. | string | No | No |
| spBusinessApplication | Details of the business application linked to the agent. | string | No | No |
| serviceAccount | The configured runtime service account for the agent. This field is empty when the default Google Reasoning Engine service agent is used. | string | No | No |
| spDescription | The description of the Vertex AI agent. | string | No | No |
GCP Agent Registry Agent
| Field | Value |
|---|---|
| Resource ID | gcp:agent-registry-agent |
| Resource type | std:agent |
| Identity attribute | identity |
| Display attribute | agentKey |
The following table lists schema attributes for this resource:
| Attribute | Description | Type | Entitlement | Multi-valued |
|---|---|---|---|---|
| identity | The unique identifier of the agent. | string | No | No |
| agentKey | The name shown for the agent. For Gemini Enterprise agents, the name also includes the region and application ID. For other agents, it is the agent name. | string | No | No |
| name | The name assigned to the agent. | string | No | No |
| agentSource | The application the agent comes from. For example, Google Vertex AI, Gemini Enterprise, or UNKNOWN. | string | No | No |
| spBusinessApplication | Details of the business application linked to the agent. | string | No | No |
| effectiveIdentity | The resolved runtime identity that the agent executes as. | string | No | No |
| uid | The unique ID of the agent in Agent Registry. | string | No | No |
| agentId | The permanent identifier of the agent. | string | No | No |
| spDescription | The description of the agent. | string | No | No |
| projectId | The ID of the project under which the agent resides. | string | No | No |
| location | The location where the agent is registered. | string | No | No |
| version | The version of the agent. | string | No | No |
| protocols | The protocols used to call the agent, with their versions and addresses, as a JSON string. | string | No | No |
| skills | The identities of the skills of the agent. | string | No | Yes |
| runtimeReference | The resource where the agent runs. | string | No | No |
| runtimeIdentity | The identity the agent runs as. | string | No | No |
| framework | The framework used to build the agent. | string | No | No |
| createTime | The timestamp when the agent was created. | string | No | No |
| updateTime | The timestamp when the agent was last updated. | string | No | No |
Example protocols value:
[{"type":"A2A_AGENT","protocolVersion":"0.3","interfaces":[{"protocolBinding":"JSONRPC","url":"https://example.com/a2a"}]}]
Refer to GCP Agent Registry Skill for skill attributes.
GCP Agent Registry Skill
| Field | Value |
|---|---|
| Resource ID | gcp:agent-registry-skill |
| Resource type | std:capability |
| Identity attribute | identity |
| Display attribute | name |
The following table lists schema attributes for this resource:
| Attribute | Description | Type | Entitlement | Multi-valued |
|---|---|---|---|---|
| identity | The unique identifier of the skill, in the format {agent identity}#{skill ID}. |
string | No | No |
| skillId | The ID of the skill on the agent card. | string | No | No |
| name | The name of the skill. | string | No | No |
| type | Capability type: SKILL. | string | No | No |
| spDescription | The description of the skill. | string | No | No |
| tags | The tags of the skill. | string | No | Yes |
| examples | Example requests the skill handles. | string | No | Yes |
| projectId | The ID of the project under which the agent resides. | string | No | No |
| location | The location where the agent is registered. | string | No | No |
Documentation Feedback
Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.