Skip to content

Required Permissions

Service Account Permissions

A service account is a special user account that is created for the sole purpose of running a particular service or application on the Windows operating system. Services use the service accounts to log on and interact with the operating system. The service account must have appropriate permissions on Active Directory. The Domain Controller must be accessible from the IQService host computer.

Note

The permissions discussed in the following section grant limited account creation privileges to a user. This user can create and modify most accounts. It cannot manage the administrator user account, the user accounts of administrators, the server operators, account operators, backup operators, and print operators. To manage these user types, you must assign the appropriate security permissions or add the user to groups having higher permissions. For example, domain administrators.

The service account specified in the application must be the member of the Account Operators group.

More granular permissions can be assigned to users for specific portions of the directory, but this is discouraged by Microsoft best practices for Active Directory access control.

The required permissions depend on the use cases that are implemented, but could include:

Operations Service Account Permissions
Load Accounts Read All Properties
Read Members
Provision Accounts Write All Properties
Write Members
Create User Objects
Password Management Change Password
Reset Password
Read pwdLastSet
Write pwdLastSet
Enable/Disable Accounts Read userAccountControl
Write userAccountControl
Unlock Accounts Read lockoutTime
Write lockoutTime

Permissions for Special Operations

Some special operations need additional permissions.

Operations Service Account Permissions
Delta Aggregation Additional permissions are required for "Replicating directory changes" and "Read permissions on the Deleted Object Container". For more information, refer to Required Permissions for Delta Aggregation.
Provision Exchange Mailbox Must be a member of Exchange Recipient Management group.

Microsoft Skype for Business Server

For the Active Directory source, there are updated service account permissions to load and provision Microsoft Lync/Skype for Business. One of the following permissions is required, depending on the service account type:

  • For Microsoft Skype for Business Server user management, the service account must be a member of the RTCUniversalServerAdmins and CSUserAdministrator domain groups. The account must also be a member of the local Administrator group on the system running IQService.
  • For Microsoft Skype for Business Server user management, a service account must be a member of a custom group with SQL permission and the CSUserAdministrator domain group. The account must also be a member of the local Administrator group on the system running IQService.

  • The account must also be a member of local Administrator group on the system running IQService and ensure that:

    • IQService can access the Lync/Skype for Business Server through port 1433 of the SQL Server.
    • IQService accounts have direct access to the database to successfully provision the account.

The required permissions for the Custom group and CSUserAdministrator domain group in SQL are:

Database Instance Security login Database Role Membership Databases
RTCLOCAL Group required to be added in SQL server: Custom Group and CSUserAdministrator DB_Owner RTC, XDS, RTCDYN
RTC Group required to be added in SQL server: Custom Group and CSUserAdministrator DB_Owner RTCXDS, XDS

Permissions for Managing Group Managed Service Accounts (gMSA)

For managing Managed Service Accounts and Group Managed Service Accounts (gMSA), the following permissions are required:

  • Aggregation and Refresh Account: Member of account operators group.
  • Create: In addition to account operators, service accounts must have full permission on the Active Directory container from which service account is to be managed.

Foreign Security Principals Permissions

For Foreign Security Principals (FSP) to be aggregated, created, or modified a single service account must have full delegated permissions on the FSP container. Use the Delegation Control Wizard to delegate permissions to the service Account.

To delegate permissions using the Delegation Control Wizard, complete the following:

  1. Open Active Directory Users and Computers.
  2. Right-click on the ForeignSecurityPrincipals container, select Delegate Control, and then select Next.
  3. Select the Add button to add a service account user and then select Next.
  4. Select Create a custom task to delegate and then select Next.
  5. Select This folder, existing objects in this folder and creation of objects in this folder.
  6. On the next screen, select Full Control under Permissions, and then select Next.
  7. Select Finish.

Permissions for Managing Contact Objects

For managing contacts, the contacts must be delegated to Account Operators group. Use the Delegation Control Wizard to delegate permissions to the contact.

To delegate permissions using the Delegation Control Wizard, complete the following:

  1. Open Active Directory Users and Computers.
  2. Right-click on the domain and select Delegate Control.
  3. Select Next.
  4. Select Account Operators group.
  5. Select Next.
  6. Select Create a custom task to delegate.
  7. Select Next.
  8. Select Only the following objects in the folder option, then select Contact Objects and Create and Delete selected objects in the folder.
  9. On the next screen, select Full Control under Permissions, and then select Next.
  10. Select Finish.

Required Permissions for Delta Aggregation

You must give the service account both of the additional permissions to support delta aggregation.

To provide the additional permissions, complete the following:

  1. To provide Replicating directory changes permissions to the service account.

    1. In the Active Directory Users and Computers browser menu, select View, and then right-click and select the Advanced features checkbox.
    2. Right-click the domain node and select property, and then open the Security tab.
    3. Add the user to the list of Security Principals.
    4. Select the user and select the Allow checkbox for Replicating Directory Changes permission.

  2. To provide Read permissions on the Deleted Object Container to the service account.

    1. Log on to any domain controller in the target domain with a user account that is a member of the Domain Administrators group.
    2. Open a command prompt. Enter the following command: dsacls "<Deleted objects container DN>" /takeownership. In the above command, the Deleted objects container DN is the distinguished name of the deleted objects container. For example, dsacls "CN=Deleted Objects,DC=SailPoint,DC=Com" /takeownership
    3. Press the Enter key.
    4. To grant Read permission to the objects in the Deleted Objects container to a user type, enter the following command: dsacls "<Deleted objects container DN>" /G <domainName>\<userName>:LCRP. In the above command, LCRP stands for the list object and read properties permission. For example, dsacls "CN=Deleted Objects,DC=SailPoint,DC=Com" /G SailPoint\John:LCRP
    5. Press the Enter key.

Permissions for Shared Mailbox Management

For aggregation of Shared Mailboxes and user's Shared Mailbox Membership, the service account must be a member of the Account Operator Group and Recipient Management Group.

For the Create or Update operation on a Shared Mailbox and when assigning a Shared Mailbox to a user account:

  • The service account must be a member of Account Operator Group and Recipient Management Group.
  • Update the Send As permission of the Shared Mailbox, the service account must have the Active Directory Permissions Exchange Role. By default, every member of the Organization Management group has Exchange Role with higher capabilities, which is not required for this operation. Hence SailPoint recommends creating a custom Exchange Admin Role Group.

To create a custom Exchange admin role group, complete the following:

  1. On the Exchange admin center page, select Permissions in the left pane.
  2. Under the admin roles tab, select the + icon to create a new Role Group.
  3. On the Role Group window, enter the Name and Description.

  4. From the list of Roles that are displayed, search and select Active Directory Permissions Role and then select Save.

    This creates a Universal Security Group with the given name under the Microsoft Exchange Security Groups organization unit. Add the service account to this group.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.