# Feature Management This section describes the various features that you can enable or disable for your configuration. Feature management enables you to select or deselect features on demand as your need for their services arises. This page is broken into different functional areas. Configure each area per your requirements. ## Manage Microsoft 365 Groups and Microsoft Teams Configure these settings if you want to manage Microsoft 365 groups and enable aggregation and provisioning of Microsoft Teams channels. > [!NOTE] > > **Screenshot** > > [![alt text]()]() 1. Go to **Feature Management**. 2. Select **Manage Microsoft 365 Groups** if you want to manage Office 365 Groups. > **Important** > > If you are utilizing Data Access Services (DAS) to manage access to cloud applications like Microsoft 365, you must enable the **Manage Microsoft 365 Groups**. This ensures that DAS can properly synchronize and manage Microsoft 365 groups, which control access to various collaborative resources within the Microsoft 365 ecosystem. 3. Select **Enable Teams Governance** if you want to enable aggregation and provisioning of channels. 4. In the **Channel Filter** field, enter any filter statements used to define the scope for channels. For example if you want to add standard channels and private channels the filter would be, `membershipType eq 'standard' or membershipType eq 'private'` 5. Select **Save**. ## Cloud Resource Management Configure this feature if your application is intended to manage Azure Management Objects. This includes Management Groups, Subscriptions, Resource Groups, Role assignments, and User-Assigned Managed Identities. For additional permissions, refer to [Required Permissions](). > [!IMPORTANT] > > You must have a SailPoint Cloud Infrastructure Entitlement Management (CIEM) license to enable cloud governance features. Contact your SailPoint Customer Success Manager to request access. > > To display cloud resource data through SailPoint CIEM, you must also configure the SailPoint CIEM Azure source. Refer to [Connecting Azure and SailPoint CIEM]() to learn more. > [!NOTE] > > **Screenshot** > > [![alt text]()]() 1. Go to **Feature Management**. 2. Select the **Manage Cloud Resources** checkbox if you want to manage Azure Role Assignments (RBAC) for user-assigned managed identities. 3. Select the **Include User-Assigned Managed Identities** checkbox to manage user-assigned identities. For more information, refer to [User-Assigned Managed Identities Management](). > **Note** > > To automate the process of adding user-assigned managed identities account attributes to the account schema during Account Schema configuration, select **Include Attributes in Schema** for managing user-assigned managed identities . For more information, refer to [User-Assigned Managed Identity Attributes](). 4. In the **Azure Privileged Identity Management Setting** section, select the **Enable Privileged Identity Management** checkbox if you want to manage PIM roles (only Azure Active Roles) for user-assigned managed identities. 5. Select **Save**. ## Manage Microsoft Entra Service Principals As Accounts > [!NOTE] > > **Screenshot** > > [![alt text]()]() 1. Go to **Feature Management**. 2. Select **Manage Microsoft Entra Service Principals as Accounts** to aggregate Azure Service Principals along with Users during the account aggregation process. By default, when this is enabled, entitlements are not fetched. You must select the entitlements you want to fetch from the available list. When this is turned off, you see a black X. If it is turned on, you see a blue ✔. > **Note** > > To automate the process of adding Service Principal account attributes to the account schema during Account Schema configuration, select **Include Attributes in Schema** for managing azure Service Principal as account . For more information, refer to [Service Principal as Accounts Attributes](). 3. In the **Service Principal Account Filter** field, enter filter statements to ensure only the correct Azure Service Principals are included in the aggregation process. The default filter is `servicePrincipalType eq 'Application'` > **Note** > > Advanced queries are not supported. Example filters: - For a filter to match the Enterprise Application default view on the Azure portal use the following: `tags/Any(x: x eq 'WindowsAzureActiveDirectoryIntegratedApp')` 4. Select the **Manage Azure PIM Role Memberships** checkbox to manage Azure PIM Active Role memberships for Service Principal. 5. Select the **Manage Microsoft Entra PIM Role Memberships** checkbox to manage Microsoft Entra ID PIM Active Role memberships for Service Principal. 6. Select the **Manage Role Memberships** checkbox to manage Directory Role memberships for Service Principal. 7. Select the **Manage Application Role Memberships** checkbox to manage Azure Application Role memberships for Service Principal. 8. Select the **Manage Group Memberships** checkbox to manage Microsoft Entra Group memberships for Service Principal. 9. Select the **Manage Microsoft Entra Role Assignment Memberships** checkbox to manage Azure Cloud Group memberships for Service Principals. 10. Select **the Manage Admin Consented Permission Memberships** checkbox to manage Azure admin consented permissions for Service Principals. > **Note** > > This is for delegated permissions. 11. Select **Save**. ## Manage Exchange Online 1. Go to **Feature Management**. 2. Select **Manage Exchange Online** to enable aggregation and provisioning of Exchange mailbox attributes. This includes Shared Mailboxes, User Mailbox properties, Distribution Lists, and Mail-Enabled Security Groups. When this is turned off, you see a black X. If it is turned on, you see a blue ✔. 3. Select one of the following from the **Authentication Method** dropdown list: - **Basic Authentication** > **Screenshot** > > [![alt text]()]() 1. Select **Basic Authentication** from the dropdown list. 2. Enter the **Username** (UserPricipalName) of a user that has the Exchange Administrator role. 3. Enter the **Password** associated with the username. 4. Select **Save**. - **Certificate Based Authentication** > **Screenshot** > > [![alt text]()]() > **Note** > > IQService configuration is mandatory to support this feature. 1. Select **Certificate Based Authentication** from the drop dropdown list. 2. Enter the **Certificate Thumbprint** of the certificate that is installed on the IQService machine used for Exchange Online operation that is also uploaded on the respective Microsoft Entra ID application. 3. Select **Save**. 4. Select **Mail Contact Governance** to manage mail contacts as accounts. When this is turned off, you see a black X. If it is turned on, you see a blue ✔. For more information, refer to [Azure Mail Contact Management](). 5. In the **Mail Contact Filter** field, enter any filter statements used to define the scope of mail contacts for aggregation. For example, `startswith(displayName,'MailContact1')` ## Manage Azure Privileged Identity Management Privileged Identity Management (PIM) enables you to manage, control, and monitor access to important resources in your organization. These resources include resources in Microsoft Entra ID, Azure, and other Microsoft Online Services such as Microsoft 365 or Microsoft Intune. For more information, refer to [Azure Privileged Identity Management (PIM)](). > [!NOTE] > > **Screenshot** > > [![alt text]()]() 1. Go to **Feature Management**. 2. Select the **Enable Privileged Identity Management** checkbox to define the scope of the Microsoft Entra PIM roles (Microsoft Entra as well as Azure). For more information on privileged identity management, refer to the [Microsoft documentation](). 3. In the **Microsoft Entra PIM Active and Eligible Roles Filter** field, enter a filter to define the scope of the Microsoft Entra PIM roles aggregated during entitlement aggregation. For example, `isBuiltIn eq true` For more information on filtering conditions and values, refer to the [Microsoft Documentation](). 4. In the **Azure PIM Active and Eligible Roles Filter** field, enter a filter to define the scope of the Azure PIM roles aggregated during entitlement aggregation. For example, `type eq 'CustomRole'` For more information on filtering conditions and values, refer to the [Microsoft Documentation](). 5. In the **Microsoft Entra PIM Active and Eligible Groups Filter** field, enter a filter to define the scope of the Azure PIM groups aggregated during entitlement aggregation. For example, `securityEnabled eq true` > **Important** > > User-defined filter expressions in this field cannot be combined with the connector's internal group type filter, which restricts groups to Office 365 and Security types. The internal filter is always applied. Any value you enter in this field functions as an additional standalone filter on the PIM group catalog and does not combine with the internal filter. For more information on filtering conditions and values, refer to the [Microsoft Documentation](). 6. Select **Save**. ## Access Package Management Settings An access package is a bundle of all the resources with the access a user needs to work on a project or perform their task. Access packages are used to govern access for your internal employees, and also users outside your organization. For more information, refer to [Access Package Management](). > [!NOTE] > > **Screenshot** > > [![alt text]()]() 1. Go to Feature Management. 2. Select **Manage Access Packages** to turn this feature on or off. When this is turned off, you see a black X. If it is turned on, you see a blue ✔. The default is off. 3. Select the **Manage Hidden Access Packages** checkbox to manage access packages hidden from end users in the My Access portal. 4. Select **Save**. ## Administrative Unit Management Settings > [!NOTE] > > **Screenshot** > > [![alt text]()]() 1. Go to **Feature Management**. 2. Select **Manage Administrative Units** to manage administrative units. 3. Select **Save**. ## Account Disable Settings To configure Account Disable Settings: > [!NOTE] > > **Screenshot** > > [![Revoke Session after Disabling User Account]()]() 1. Go to **Feature Management**. 2. Under **Account Disable Settings**, select **Revoke Session after Disabling User Account** to sign the user out of all existing sessions when their account is disabled. 3. Select **Save**. > [!NOTE] > > - For existing sources, this is disabled by default. When required, ensure to enable this option. For more information about this feature, including the required permissions, refer to [Revoke Session After Disabling User Account]().