Azure PIM and Cloud Object Attributes

Azure PIM Attributes

Add the following attributes to connector Account Schema:

Name	Type	Details
azureEligibleRoles	String : Multivalued : Entitlement	List of Azure Roles for which user is eligible
azureADEligibleRoles		List of Microsoft Entra ID Roles for which user is eligible
azureActiveRoles		List of Azure Roles assigned to user
azureADActiveRoles		List of Microsoft Entra ID Roles assigned to user
azureADEligibleGroups		List of groups for which the account has PIM eligible membership.
azureADActiveGroups		List of groups for which the account has PIM active membership.

Membership Aggregation

Membership Aggregation is part of account aggregation. PIM Membership aggregation will be added to existing membership aggregation flow and will be triggered only if flag is ON and required attributes are present in account schema Memberships will be aggregated if flag is true and account attributes are present in schema.

For example:

If the enablePIM attribute is true and only Microsoft Entra ID Roles : Active is present in schema, only Microsoft Entra ID Roles membership for active assignments are aggregated.
PIM Memberships are aggregated per page. For example, membership is fetched for users aggregated in a page.
PIM Memberships for Azure resources are aggregated if Azure Management is enabled and respective attributes are present in the schema.

Membership Aggregation of PIM Roles for Microsoft Entra ID Groups

Azure / Microsoft Entra ID PIM Role assignments / membership for Microsoft Entra ID groups will be visible as entitlement attributes after running group / entitlement aggregation ONLY when relevant role attributes (mentioned above as Azure PIM attributes) are added to group schema and PIM flag is true.

Note

The PIM membership for such groups would show only the native identity of the assigned PIM roles.

Group Schema Objects

The following new group schema objects are supported.

Microsoft Entra ID Eligible Role

Object Type is azureADEligibleRole, Identity Attribute is id, and the Display Attribute is displayName.

Attribute Name	Description
displayName	Eligible role display name.
id	Microsoft Entra ID eligible role ID.
isBuiltIn	Indicates whether role is custom or built-in.
roleName	Name of the role.
scope	Scope at which role can be assigned.

Microsoft Entra ID Active Role

Object Type is azureADActiveRole, Identity Attribute is id, and the Display Attribute is displayName.

Attribute Name	Description
displayName	Active AD role display name.
id	Microsoft Entra ID active role ID.
isBuiltIn	Indicates whether role is custom or built-in.
roleName	Name of the role.
scope	Scope at which role can be assigned.

Azure Active Role

Object Type is azureActiveRole, Identity Attribute is id, and the Display Attribute is displayName.

Attribute Name	Description
displayName	Active role display name.
id	Azure active role ID.
isBuiltIn	Indicates whether role is custom or built-in.
roleName	Name of the role.
scope	Scope at which role can be assigned.

Azure Eligible Role

Object Type is azureEligibleRole, Identity Attribute is id , and the Display Attribute is displayName.

Attribute Name	Description
displayName	Eligible role display name.
id	Azure eligible role ID.
isBuiltIn	Indicates whether role is custom or built-in.
roleName	Name of the role.
scope	Scope at which role can be assigned.

Azure AD Eligible Group

Represents a group for which a principal holds a time-bound eligible PIM membership (the principal must activate the membership before it becomes active).

Object Type is azureADEligibleGroup, Identity Attribute is id , and the Display Attribute is displayName.

Attribute Name	Description
id	Native ID. The unique identifier (object ID) of the group.
displayName	Display name of the group.
description	Description of the group.
securityEnabled	Indicates whether the group is a security group.
groupTypes	Type of the group. Blank for Security groups; Unified for Microsoft 365 groups.

Azure AD Active Group

Represents a group for which a principal holds a time-bound active PIM membership.

Object Type is azureADActiveGroup, Identity Attribute is id , and the Display Attribute is displayName.

Attribute Name	Description
id	Native ID. The unique identifier (object ID) of the group.
displayName	Display name of the group.
description	Description of the group.
securityEnabled	Indicates whether the group is a security group.
groupTypes	Type of the group. Blank for Security groups; Unified for Microsoft 365 groups.

Group Attributes for Azure Cloud Objects

Note

The schema for the following mentioned Group objects is not available with the included Microsoft Entra ID SaaS connector. You must purchase a CIEM license in order to enable the Cloud Governance features of the connector.

To manage the following Azure Management Objects, ensure that the attributes present in the respective sections are present in the group schema:

Azure Role Assignments

Add the following attributes to your schema using the Create New Schema REST API.

Note

For more information on SailPoint's REST APIs, refer to Best Practices: REST API Authentication and REST API - Update Source (Partial) in the SailPoint Developer Community.

Attribute Name	Description
displayName	Display name.
id	Azure Role Assignment ID.
resource	Display name of the resource on which role can be assigned.
roleName	Display name of the role which can be assigned on resource.

Example schema:

<Schema displayAttribute="displayName" identityAttribute="id" nativeObjectType="azureRoleAssignment" objectType="azureRoleAssignment">
    <AttributeDefinition name="id" type="string">
        <Description>Azure Role Assignment ID</Description>
    </AttributeDefinition>
    <AttributeDefinition name="displayName" type="string">
        <Description>Display Name</Description>
    </AttributeDefinition>
    <AttributeDefinition name="resource" type="string">
        <Description>Display name of the resource on which role can be assigned</Description>
    </AttributeDefinition>
    <AttributeDefinition name="roleName" type="string">
        <Description>Display name of the role which can be assigned on resource</Description>
    </AttributeDefinition>
</Schema>

The following is the corresponding sample entry of this entitlement in the account schema (if needed):

<AttributeDefinition entitlement="true" managed="true" multi="true" name="azureRoleAssignments" schemaObjectType="azureRoleAssignment" type="string">
    <Description>azureRoleAssignments</Description>
</AttributeDefinition>

Management Groups

Add the following attributes to your schema using the Create New Schema REST API.

Note

For more information on SailPoint's REST APIs, refer to Best Practices: REST API Authentication and REST API - Update Source (Partial) in the SailPoint Developer Community.

Attribute Name	Description
displayName	Friendly name of the management group.
id	Fully qualified ID for the management group.
type	Type of resource.
name	Name of the management group.

Example schema:

<Schema displayAttribute="name"  identityAttribute="id" nativeObjectType="managementGroup" objectType="managementGroup">
    <AttributeDefinition name="id" type="string">
        <Description>Fully qualified ID for the management group</Description>
    </AttributeDefinition>
    <AttributeDefinition name="displayName" type="string">
        <Description>Friendly name of the management group</Description>
    </AttributeDefinition>
    <AttributeDefinition name="name" type="string">
        <Description>Name of the management group</Description>
    </AttributeDefinition>
    <AttributeDefinition name="type" type="string">
        <Description>Type of the resource</Description>
    </AttributeDefinition>
</Schema>

Resource Groups

Add the following attributes to your schema using the Create New Schema REST API.

Note

For more information on SailPoint's REST APIs, refer to Best Practices: REST API Authentication and REST API - Update Source (Partial) in the SailPoint Developer Community.

Attribute Name	Description
id	ID of the resource group.
name	Name of the resource group.
type	Type of the resource group.
location	Location of the resource group.
provisioningState	Provisioning state of the resource group.

Example schema:

<Schema displayAttribute="name" identityAttribute="id" nativeObjectType="resourceGroup" objectType="resourceGroup">
    <AttributeDefinition name="id" type="string">
        <Description>ID of the resource group.</Description>
    </AttributeDefinition>
    <AttributeDefinition name="name" type="string">
        <Description>Name of the resource group</Description>
    </AttributeDefinition>
    <AttributeDefinition name="type" type="string">
        <Description>Type of the resource group</Description>
    </AttributeDefinition>
    <AttributeDefinition name="location" type="string">
         <Description>Location of the resource group</Description>
    </AttributeDefinition>
    <AttributeDefinition name="provisioningState" type="string">
        <Description>Provisioning state of the resource group</Description>
    </AttributeDefinition>
</Schema>

Subscriptions

Add the following attributes to your schema using the Create New Schema REST API.

Note

For more information on SailPoint's REST APIs, refer to Best Practices: REST API Authentication and REST API - Update Source (Partial) in the SailPoint Developer Community.

Attribute Name	Description
displayName	Display name of the subscription.
id	Fully qualified ID for the subscription.
authorizationSource	Authorization source of the request.
managedByTenants	List of tenants managing subscription.
subscriptionId	Object ID for the subscription.
tenantId	Tenant ID with which subscription has trust relationship.
state	State of subscription, that is, it is enabled or disabled.

Example schema:

<Schema displayAttribute="name" identityAttribute="subscriptionId" nativeObjectType="subscription" objectType="subscription">
    <AttributeDefinition name="subscriptionId" type="string">
        <Description>Object Id of the subscription</Description>
    </AttributeDefinition>
    <AttributeDefinition name="displayName" type="string">
        <Description>Subscription display name.</Description>
    </AttributeDefinition>
    <AttributeDefinition name="state" type="string">
        <Description>Subscription state</Description>
    </AttributeDefinition>
    <AttributeDefinition name="authorizationSource" type="string">
        <Description>Authorization source of request</Description>
    </AttributeDefinition>
    <AttributeDefinition name="id" type="string">
        <Description>Fully qualified ID for the subscription</Description>
    </AttributeDefinition>
    <AttributeDefinition name="tenantId" type="string">
        <Description>Subscription tenant ID</Description>
    </AttributeDefinition>
    <AttributeDefinition multi="true" name="managedByTenants" type="string">
        <Description>List of tenants managing subscription</Description>
    </AttributeDefinition>
</Schema>

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.