# Integrating SailPoint with Identity Security Cloud Governance SaaS

The SailPoint Identity Security Cloud Governance connector extends governance and access management capabilities to identities in a SailPoint Human Fabric tenant. This connector treats the tenant as a governed system and manages identities as accounts. The connector also manages user levels (permissions), roles, and governance groups as entitlements.

This guide is designed to give specific information about the requirements and field definitions needed to get a working instance of the Identity Security Cloud Governance connector.

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

#### Account Management

- Manages identities as accounts
- Aggregate and Refresh Accounts
- Full Account Aggregation
- Single Account Aggregation
- Account Aggregation Filters (Governance Groups Aggregation)
- Create Accounts
- Enable/Disable Accounts
- Add/Remove Entitlements

#### Entitlement Management

- Manages Governance Groups, and User levels (Permissions) as Entitlements
- Aggregation

> [!IMPORTANT]
>
> Due to API limitations, the Identity Security Cloud Governance connector aggregates user levels in entitlement aggregation, and these levels are predefined within the connector. However, during account aggregation, the connector retrieves all the user levels assigned to the account. For more information, refer to [User Levels in Entitlement Aggregation](<https://documentation.sailpoint.com/connectors/identity_security_cloud_governance/saas/help/user_levels.html>).

- Entitlement Aggregation Filters (Governance Groups Aggregation)

## Prerequisites

The Identity Security Cloud Governance connector uses a personal access token for authentication. To use this authentication method, create a client ID and client secret in your tenant.

> [!NOTE]
>
> **Steps for creating Client ID and Client Secret**
>
> 1. Select **Preferences** from the dropdown menu under your username, then select **Personal Access Tokens**. You can also go directly to the page by using this URL : `https://{tenant}.identitynow.com/ui/d/user-preferences/personal-access-tokens` Replace `{tenant}` with your tenant name.
> 2. Select **New Token** and enter a meaningful description to help differentiate the token from others.
> 3. Provide required permissions under **Scopes**.
> 4. Select **Create Token** to generate and view the two components that comprises the token: `Client ID` and `Client Secret`.
> 5. Copy and save **Client ID** and **Client Secret** at a safe and accessible place to retrieve later whenever needed.

For more information, refer to [Authentication](<https://developer.sailpoint.com/docs/api/authentication/#generate-personal-access-token>).

## Required Permissions

A user with ORG\_ADMIN user level access is required with the following scopes to perform necessary operations:

| Operations | Scopes |
| --- | --- |
| Test Connection | sp:scopes:default |
| Aggregation | idn:identity:read<br>idn:identity:manage<br>idn:workgroup:read |
| Enable/Disable | sp:search:read<br>idn:accounts:read<br>idn:accounts:manage<br>idn:accounts-state:manage<br>idn:account-provisioning:manage |
| Governance Groups Aggregation | idn:workgroup:read |
| Add/Remove Identity Security Cloud Governance Groups | idn:workgroup:manage |
| Add/Remove User Levels | sp:auth-user:manage |
| Add/Remove Roles | idn:role-unchecked:manage |
| Disable with Reassign | idn:access-profile:manage<br>idn:sources:manage<br>idn:workgroup:manage<br>idn:entitlement:manage<br>sp:workflow:manage<br>idn:campaign:manage<br>idn:access-request-approvals:manage |