Skip to content

Integrating SailPoint with Identity Security Cloud Governance SaaS

The SailPoint Identity Security Cloud Governance connector extends governance and access management capabilities to identities in a SailPoint Human Fabric tenant. This connector treats the tenant as a governed system and manages identities as accounts. The connector also manages user levels (permissions), roles, and governance groups as entitlements.

This guide is designed to give specific information about the requirements and field definitions needed to get a working instance of the Identity Security Cloud Governance connector.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

Account Management

  • Manages identities as accounts
  • Aggregate and Refresh Accounts
  • Full Account Aggregation
  • Single Account Aggregation
  • Account Aggregation Filters (Governance Groups Aggregation)
  • Create Accounts
  • Enable/Disable Accounts
  • Add/Remove Entitlements

Entitlement Management

  • Manages Governance Groups, and User levels (Permissions) as Entitlements
  • Aggregation

Important

Due to API limitations, the Identity Security Cloud Governance connector aggregates user levels in entitlement aggregation, and these levels are predefined within the connector. However, during account aggregation, the connector retrieves all the user levels assigned to the account. For more information, refer to User Levels in Entitlement Aggregation.

  • Entitlement Aggregation Filters (Governance Groups Aggregation)

Prerequisites

The Identity Security Cloud Governance connector uses a personal access token for authentication. To use this authentication method, create a client ID and client secret in your tenant.

Steps for creating Client ID and Client Secret
  1. Select Preferences from the dropdown menu under your username, then select Personal Access Tokens. You can also go directly to the page by using this URL : https://{tenant}.identitynow.com/ui/d/user-preferences/personal-access-tokens Replace {tenant} with your tenant name.
  2. Select New Token and enter a meaningful description to help differentiate the token from others.
  3. Provide required permissions under Scopes.
  4. Select Create Token to generate and view the two components that comprises the token: Client ID and Client Secret.
  5. Copy and save Client ID and Client Secret at a safe and accessible place to retrieve later whenever needed.

For more information, refer to Authentication.

Required Permissions

A user with ORG_ADMIN user level access is required with the following scopes to perform necessary operations:

Operations Scopes
Test Connection sp:scopes:default
Aggregation idn:identity:read
idn:identity:manage
idn:workgroup:read
Enable/Disable sp:search:read
idn:accounts:read
idn:accounts:manage
idn:accounts-state:manage
idn:account-provisioning:manage
Governance Groups Aggregation idn:workgroup:read
Add/Remove Identity Security Cloud Governance Groups idn:workgroup:manage
Add/Remove User Levels sp:auth-user:manage
Add/Remove Roles idn:role-unchecked:manage
Disable with Reassign idn:access-profile:manage
idn:sources:manage
idn:workgroup:manage
idn:entitlement:manage
sp:workflow:manage
idn:campaign:manage
idn:access-request-approvals:manage

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.