Connecting SailPoint and Microsoft Entra ID SaaS

To connect SailPoint with Microsoft Entra ID, perform the following tasks:

Adding the Source in SailPoint

To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs.

To configure a new source:

1. Sign in to SailPoint.
2. Go to Admin > Connections > Sources.
3. Select Create New.
4. Search for the connector by entering the name in the search box, and then select Actions.

5. In the Actions dropdown list, select the setup method:

   • Express Setup - Quickly create a read-only connection to your target system by providing minimal configurations and authentication. On completion, aggregation is automatically started.

     Note

     Express Setup supports Credential Providers. For information on supported credential providers and configuration, refer to Credential Providers. For more information, contact your SailPoint Customer Service Manager.

   • Standard Setup - Provide detailed basic configuration to create the source. Once the source is created, continue with source setup.

Configuring a Source Using Express Setup

Express Setup minimizes the initial configuration process so you can quickly connect the application and immediately begin aggregating user account and entitlement data.

1. Review the directions and select Start Express Setup.

2. Review the pre-populated Source Name, Source Owner, and Description. To update, select Edit.

   Note

   The source name must be unique. You can change these settings later in the source configuration.

3. (Optional) If enabled for your organization, select the Use a Credential Provider checkbox to manage the source's authentication using a credential provider.

   Note

   To add a Credential Provider in SailPoint, go to Admin > Connections > Credential Providers. For more information about credential providers, refer to Credential Providers.

4. Configure the authentication to allow SailPoint to connect to the source. For more information, refer to the Connection Settings section.

5. Select Finish.

   After a successful test connection, the system creates your source and prompts you to run an aggregation.

   • If you want to aggregate now, select Aggregate.

     • To see the latest account aggregation history, go to Account Management > Account Aggregation.
     • To see the list of aggregated source accounts, go to Account Management > Accounts.

   • If you want to aggregate later, select Exit. This returns you to the Sources page. Your new source is listed, but contains no accounts or aggregation history yet.

Configuring a Source Using Standard Setup

Use Standard Setup to configure the connector for full feature support.

1. In the Source Name field, enter a unique and descriptive name for your source. Source names cannot exceed 128 characters.
2. In the Description field, provide additional details about the source to help distinguish it from similar sources. This field allows a maximum of 2,000 characters.
3. In the Source Owner field, begin typing the name of an owner. Matches appear after you type two or more letters. For more information, refer to Assigning a Source Owner.
4. (Optional) Select a governance group to grant its members source or role sub-admin level oversight of the source and its access. For more information, refer to Creating and Managing Governance Groups.
5. If this source represents a primary system containing your organization's personnel records, select the Authoritative Source checkbox. For more information, refer to Creating Identity Profiles.
6. Select Continue. The source is created, and you are navigated to the Source Setup > Base Configuration page. Continue to configure your connected source there.

Base Configuration

Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary.

1. Enter a unique name and description for the source.

2. In the Source Owner dropdown list, select the identity that owns this source.

   • To find a source owner, begin entering their name.

3. (Optional) If enabled for your organization, select the Use a Credential Provider checkbox to manage the source's authentication using a credential provider.

   Note

   To add a credential provider, go to Admin > Connections > Credential Providers. For more information about credential providers, refer to Credential Providers.

4. Configure the authentication to allow SailPoint to connect to the source. Refer to Connection Settings for more information.

5. (Optional) In the Governance Group for Source Management dropdown list, select a governance group to associate with this source. For more information about governance groups, refer to Associating Governance Groups with a Source.

6. (Optional) Choose whether to enable or disable provisioning for the source. Provisioning is disabled by default.

   • Enable Provisioning - Set the toggle to Enabled to allow the source to create, update, and deactivate accounts in the connected source system.

   • Disable Provisioning - Set the toggle to Disabled to disable provisioning for the source. Disabling provisioning will prevent the creation, updating, or deactivating of accounts on this source.

7. Select Save.

Connection Settings

Provide the information required to connect to the Microsoft Entra instance based on the selected Grant Type for OAuth 2.0 authentication:

Client Credentials

1. In Client ID and Client Secret, enter the Microsoft Entra API details for OAuth2 authentication.

2. In Domain Name, enter the name of the Microsoft Entra domain to be managed. For example, contoso.onmicrosoft.com.

   Important

   If you are using SailPoint CIEM, you must add the Entra domain under Client Credentials in the Domain Name field. It must end in .onmicrosoft.com or .onmicrosoft.us. Custom domain names are not supported.

3. (Optional) Select the Use Continuous Access Evaluation checkbox to enable the connector to leverage the Microsoft Entra real-time enforcement of Conditional Access location and risk policies along with instant enforcement of token revocation events for an enterprise application (service principal).

4. Select Save.

Refresh Token

1. In Client ID and Client Secret, enter the Microsoft Entra API details for OAuth2 authentication.
2. Enter the valid Refresh Token.
3. Enter the Domain Name of the Microsoft Entra domain to be managed. For example, contoso.onmicrosoft.com.
4. (Optional) Select the Use Continuous Access Evaluation checkbox to enable the connector to leverage the Microsoft Entra real-time enforcement of Conditional Access location and risk policies along with instant enforcement of token revocation events for an enterprise application (service principal).
5. Select Save.

JWT Certificate Credentials

To generate the JWT certificate credentials, refer to Creating OAuth 2.0 JWT Certificate Credentials.

1. In the Client ID field, enter the Microsoft Entra API Client ID for OAuth2 authentication.
2. In the Certificate field, provide the unique alpha-numeric value of certificate used to sign the JWT assertion.
3. Enter the Private Key text used for encrypting the JWT assertion.
4. Enter the Private Key Password that is used for decrypting the private key.
5. In the Domain Name field, enter the name of the Microsoft Entra domain to be managed. For example, contoso.onmicrosoft.com.
6. (Optional) Select the Use Continuous Access Evaluation checkbox to enable the connector to leverage the Microsoft Entra real-time enforcement of Conditional Access location and risk policies along with instant enforcement of token revocation events for an enterprise application (service principal).
7. Select Save.

Activity Insights Settings

SailPoint pulls in activity data in the form of events like user logins, password changes, and content updates within the application. You can view an identity’s activity data within an application to discover trends for that user.

Activity Insights Settings allows you to gather account information and activity data from Microsoft Entra ID. To enable Activity Insights for the Microsoft Entra ID application, refer to Prerequisites for more information.

To configure Activity Insights, complete the following:

1. Go to Activity Insights Settings.
2. Select Enable Activity Insights to view access to data insights on source and application activity such as logins and other app-specific events.
3. Select Save.

Aggregation and Filter Settings

Aggregation Settings

This section contains the configuration parameters for aggregation and filter settings.

For more information about aggregation, refer to Loading Account Data.

For more information on the key factors to consider when choosing between Full Aggregation and Delta Aggregation, refer to FAQs.

1. Select the Aggregate All Groups checkbox to aggregate Security, Microsoft 365, Distribution List, and Mail Enabled Security Groups. If this option is not selected, only Security Groups are aggregated.
2. Select the Delta Aggregation checkbox to aggregate delta changes for accounts and groups.
3. Select the Aggregate Group Hierarchy checkbox to read the parent and child group hierarchical information for Microsoft Entra groups.
4. Select Exclude Inherited App Role Assignments to exclude inherited appRoleAssignments during account aggregation. Only application roles assigned directly to the account are aggregated.
5. Enter the value of Page Size for the number of objects to be fetched in a single page when iterating over large data sets. The default value is 100.

[
    {
        "op": "add",
        "path": "/connectorAttributes/userAggregationBatchSize",
        "value": "45"
    }
]

Filter Settings

When configuring the filters, consider that the connector prioritizes account filters over group filters during aggregation. For example, the connector aggregates groups, which fall outside of the group filter, if the group is associated with an account included within the account filter.

1. Set the User Filters to define the scope of Accounts applied during account aggregation. For example, to aggregate those Microsoft Entra ID users who are active, use accountEnabled eq true. For more information on filters, refer to the Microsoft documentation.

2. Select Advanced User Filter to include advanced filter queries such as endsWith, NOT, and NE during aggregation processes.

   To use the extension attributes from onPremisesExtensionAttributes e.g. extensionAttribute1 , extensionAttribute4 etc. as user filter, please use the below syntax: onPremisesExtensionAttributes/extensionAttribute1 eq '21'

   Screenshot

   

   Note

   Select the “Advanced User Filter” checkbox as it is advanced query filter.

3. Set the Group Filters to define the scope of Groups applied during group aggregation. Group filters apply during entitlement aggregation. For example, to only aggregate Microsoft Entra ID groups whose display name is starting with letter A, use startswith(displayName,'A'). For more information on filters, refer to the Microsoft documentation.

4. Select Advanced Group Filter to include advanced filter queries such as endsWith, NOT, and NE during group aggregation processes.

5. Select the Group Membership Filters to define the scope of the group memberships included in account aggregation. These filters apply during the account aggregation and are only applicable to memberships belonging to objectType = group. These are only applicable to the Security, Office 365, Mail Enabled Security, and Distributed type of group memberships. For more information on filters, refer to the Microsoft documentation.

   Note

   You can provide filters as mentioned in the examples above, and the connector ensures the formation of an appropriate advanced filter query. This field supports advanced filter queries such as endsWith, NOT, and NE.

   For example,

   • To aggregate only group memberships with group display name starting with 'A', use startswith(displayName,'A').
   • To aggregate only group memberships with groups not belonging to on-premises AD (or to only include cloud group memberships), use onPremisesSyncEnabled ne true.
   • To exclude dynamic group memberships during account aggregation , use NOT groupTypes/any(c:c eq 'DynamicMembership')

   Important

   SailPoint recommends excluding membership information is not a best practice from a governance and security standpoint. You should have full visibility into users and devices, including their groups, assigned permissions, and how these configurations impact access to resources. The group membership filter should be used carefully and only when necessary, ensuring that access is managed and only the right individuals have access to sensitive information or resources.

6. In the Directory Roles Filter field, when the entitlement schema "roles" is present in the source, enter filter statements to ensure that only the specified roles are aggregated during entitlement aggregation. For example, isBuiltIn eq true. For more information on filtering conditions and values, refer to the Microsoft documentation.

7. Select Save.

Machine Identity Governance Settings

To enable agents aggregation, follow these steps:

1. Go to Microsoft Entra ID SaaS source configuration page within SailPoint.
2. Select Machine Identity Governance Settings tab.
3. Select Enable Azure AI Foundry Agents. This enables Azure AI Foundry agents aggregation for your environment. For more information, refer to Azure AI Foundry Agents Management.
4. Select Always Use the Available Latest Version if you want to use the latest available version of Azure Foundry AI agents for your environment. To select this option, ensure you have selected Enable Azure AI Foundry Agents.
5. Select Enable Microsoft Copilot Studio Agents. This enables Copilot agent aggregation for your environment. For more information, refer to Microsoft Copilot Studio Agents Management.
6. Select Enable Microsoft Agent 365 when your tenant is licensed for Microsoft Agent 365. When you turn this toggle on, all catalog platform checkboxes below default to checked. If your source uses Client Credentials authentication, you need to provide a refresh token with the required permissions. For more information, refer to Microsoft Agent 365 Catalog Management.
7. Select Save.

Additional Configurations

Additional Configuration Parameters

You must add the following attributes in the connector using the SailPoint REST API. Refer to Best Practices: REST API Authentication and REST API - Update Source (Partial).

Review and Test

Perform a test to confirm the connection to SailPoint.

1. Go to Review and Test.

2. Confirm that the entries in each field are correct.

   If you note any mistakes, return to the section and make corrections.

3. Select Test Connection.

SailPoint Application Onboarding

SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to Discovered Applications in the SailPoint user interface.

For more information, refer to Application Onboarding in the SailPoint SaaS documentation.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.