Privileged Access and Azure Cloud Governance

Azure Cloud Object Management

Important

If you want to enable additional cloud governance features for your Entra Cloud Objects (for example, visualization of effective access,Azure Cloud Object Management, such as, Management Groups, Subscriptions, Resource Groups and Role Assignment), you must have SailPoint CIEM. Contact your SailPoint Customer Success Manager to request access and for more information.

To display cloud resource data through SailPoint CIEM, you must also configure the SailPoint CIEM Azure source. Refer to Connecting Azure and SailPoint CIEM to learn more.

The Microsoft Entra ID connector provides support for access management of the following Azure Management Objects:

Management Groups
Subscriptions
Resource Groups
Role Assignment (RBAC role assignments. This is a custom group object)

The newly supported group objects (Azure Management objects) and operations are:

Operations	Group Objects
Aggregation	Management Groups, Subscriptions, and Resource Groups
Aggregation and Add / Remove Entitlement	Role Assignment (RBAC role assignments. This is a custom group object.)

The following attributes can be configured in the source XML using the REST APIs in accordance with your requirements:

Parameter	Description
managementGroup-api-version	API version to be used for management group API. Type: String Default value: 2020-02-01
subscription-api-version	API version to be used for subscription API. Type: String Default value: 2020-01-01
resourceGroup-api-version	API version to be used for resource group API. Type: String Default value: 2020-06-01
role-assignment-api-version	API version to be used for Role Assignments API. Type: String Default value: 2018-07-01
azure-management-resource-base	Azure management API resource base in case of Entra Gov or another private instance. Type: String Default value: https://management.azure.com
fetch-azure-roleassignment-getobject	Specify if role assignments need to be fetched during Get Account call. Type: boolean Default value: False

Prerequisites

The Microsoft Entra ID connector supports the following grant types for OAuth2 authentication:
- Client Credentials
- Auth Code / Refresh Token
- Certificate Credentials
Ensure that the appropriate permissions are granted as mentioned in the Administrator Permissions section below.
Existing clients must be modified for supporting management.azure.com as the scope.

Administrator Permissions

Based on the supported operations (Aggregation and Add/ Remove Entitlements), the following are the required permissions:

Parameter	Description
Object Aggregation	Permission: Microsoft.Management/managementGroups/read Or Role: Reader Scope: Management Group
Role Assignment Aggregation	Permission: Microsoft.Authorization/roleAssignments/read Or Role: Reader Scope: Management Group / Subscription
Role Definition Aggregation	Permission: Microsoft.Authorization/roleDefinitions/read Or Role: Reader Scope: Management Group / Subscription
Add Role Assignment	Permission: Microsoft.Authorization/roleAssignments/write Or Role: User Access Administrator Scope: Management Group / Subscription
Remove Role Assignment	Permission: Microsoft.Authorization/roleAssignments/delete Or Role: User Access Administrator Scope: Management Group / Subscription

API Permissions

OAuth2.0 Authentication	Type	API	Permission
Client Credentials	Delegated	Azure Service Management	user_impersonation
Client Credentials	Application	Microsoft Graph	Directory.ReadWriteAll
Refresh Token / AuthCode	Delegated	Azure Service Management	user_impersonation
JWT Certificate Credentials	Delegated	Azure Service Management	user_impersonation

Refer to the following table to learn more about object management when SailPoint CIEM license is enabled (Cloud Governance) and otherwise (Identity Governance).

Management Type	Object	Identity Governance	Cloud Governance
Account Management	User	Yes	Yes
Account Management	B2B Guest User	Yes
Account Management	B2C User	Yes
Account Management	Federated User (Synchronized with On-Prem AD)	Yes
Entitlement Management	Groups	Yes
Entitlement Management	License Plan (Service Plan)	Yes
Entitlement Management	Administrator Roles	Yes
Entitlement Management	Service Principal Names	Yes
Entitlement Management	Management Groups	No
Entitlement Management	Subscriptions	No
Entitlement Management	Resource Groups	No
Entitlement Management	Roles Assignment (RBAC)	No

Azure Government Endpoint Configuration

Important

When SailPoint CIEM is enabled for MS Entra source that uses GCC High, ensure azure-management-resource-base attribute is set to https://management.usgovcloudapi.net so that entitlement aggregation works correctly.

To meet security and compliance needs of federal agencies, state and local governments, Microsoft provides a separate instance of the Azure service. A few example of such instances are Azure Government, and Azure China. As these instances are separated from general Azure services, endpoint (host address) for such instances might also be different.

With endpoint configuration functionality, the Microsoft Entra connector can be configured to communicate with these instances.

The following attributes must be configured in the source XML using the REST APIs:

Note

For more information on SailPoint's REST APIs, refer to Best Practices: REST API Authentication and REST API - Update Source (Partial) in the SailPoint Developer Community.

Parameter	Description
msGraphResourceBase	Base resource URL to be used for Microsoft Graph API rest calls. The following example points base to default Microsoft Graph resource base: key: `msGraphResourceBase` value: `https://graph.microsoft.us`
msGraphTokenBase	Base token URL to be used to get access token for Microsoft Graph API rest calls The following example points base to default Microsoft Graph token base: key: `msGraphTokenBase` value: `https://login.microsoftonline.us`
azure-management-resource-base	Base resource URL to be used for Microsoft Graph API rest calls when CIEM is enabled. The following example points base to default Microsoft Graph resource base: key: azure-management-resource-base value: https://management.azure.com

Note

The actual values of endpoints can be found in Microsoft documentation for specific instance. For connector operation, the values for the above attributes must be provided.

Azure Privileged Identity Management (PIM)

The Microsoft Entra ID connector supports Privileged Identity Management (PIM) as a service in Microsoft Entra ID. PIM enables you to manage, control, and monitor access to important resources in your organization.

Azure PIM for Roles

The Microsoft Entra ID connector supports Privileged Identity Management (PIM) as a service in Microsoft Entra ID. PIM enables you to manage, control, and monitor access to important resources in your organization.

These resources include resources in Microsoft Entra ID, Azure, and other Microsoft Online Services such as Microsoft 365 or Microsoft Intune.

PIM provides time-based and approval-based role activation to mitigate the risks of excessive, unnecessary, or misused access permissions on resources. It reduces the chance of a malicious actor getting access to the resource or an authorized user accidentally impacting a sensitive resource.

Supported Features

Aggregation of PIM Role Assignment objects for Azure and Microsoft Entra ID during entitlement aggregation of type "Groups"
Aggregation of PIM Role Assignment objects for Azure and Microsoft Entra ID during Account aggregation
Aggregation of Azure and Microsoft Entra ID PIM roles during Entitlement Aggregation
Provisioning of eligible role assignment on user for Azure or Microsoft Entra ID PIM role

Operations	Group Objects
Entitlement Aggregation of type "Groups"	The following group objects are aggregated as entitlements: Azure Eligible Roles, Microsoft Entra ID Eligible Roles, Azure Active Roles, and Microsoft Entra ID Active Roles.
Entitlement Aggregation	Azure Eligible Roles, Microsoft Entra ID Eligible Roles, Azure Active Roles, and Microsoft Entra ID Active Roles (These are custom group objects)
Account Aggregation	The following group objects are aggregated as entitlements: Azure Eligible Roles, Microsoft Entra ID Eligible Roles, Azure Active Roles, and Microsoft Entra ID Active Roles.
Add or Remove or Delete Entitlement	Azure Eligible Roles, Microsoft Entra ID Eligible Roles , Azure Active Roles, Microsoft Entra ID Active Roles

Required Permissions

Microsoft Entra ID Roles (azureADActiveRoles and azureADEligibleRoles)

To communicate with the PIM Graph API for Microsoft Entra ID roles, you must have at least one of the following permissions:

RoleManagement.ReadWrite.Directory
RoleManagement.Read.Directory

To grant these permissions to the client application, refer to the steps in the Required Permissions topic.

Azure Resource Roles (azureActiveRoles and azureEligibleRoles

The PIM API for Azure resource roles is developed on top of the Azure Resource Manager framework. You will need to give consent to Azure Resource Management but won’t need any Graph API permission. You must ensure that the user or the service principal communicating with the API has at least the Owner or User Access Administrator role on the resource.

To assign the Owner or User Access Administrator role, complete the following:

Login to portal.azure.com and go to All Services > Management Groups or <CU Subscription> (CU tenant).
On the left-hand side of the screen, select Access Control (IAM).
Select Role Assignments and then the +Add button to assign the Owner or User Access Administrator role on the resource.

PIM Aggregation

For sources with Privileged Identity Management (PIM) enabled, SailPoint recommends using full aggregation without partitioning.

Aggregation Method	Reason
Without Partitioning	The connector uses a caching mechanism to fetch all PIM memberships, improving performance.
With Partitioning	The connector must make individual API calls for each user to fetch PIM memberships, which can slow down aggregation.

PIM with Single Account Aggregation

If PIM is enabled, use full aggregation only.

Single Account Aggregation is not recommended, as processing the PIM membership cache for one user can be time-consuming and may lead to a timeout, especially with large amounts of PIM data.

Azure PIM for Groups

The Microsoft Entra ID connector now supports Privileged Identity Management (PIM) for Groups. This includes time-bound eligible and active group memberships managed through Microsoft Entra PIM.

Aggregation of PIM Group Assignment objects (azureADEligibleGroup and azureADActiveGroup) for Microsoft Entra ID during entitlement aggregation.
Aggregation of PIM Group Assignment objects (azureADEligibleGroups and azureADActiveGroups) for Microsoft Entra ID during Account aggregation.
Provisioning of Group Assignment on Users for Microsoft Entra ID PIM Group.

Prerequisites

Azure AD Premium P2 license.
Required to use Privileged Identity Management for Groups.
Enable Privileged Identity Management

The Enable Privileged Identity Management checkbox must be selected in the connector's Azure Privileged Identity Management Settings section. For more information, refer to Manage Azure Privileged Identity Management.
Microsoft Graph API permissions

The Enterprise Application used for the integration must have the permissions granted (Application type).

Microsoft Graph API Permissions

Permission	Purpose
PrivilegedEligibilitySchedule.Read.AzureADGroup	Read PIM eligible group schedule instances
PrivilegedEligibilitySchedule.ReadWrite.AzureADGroup	Assign/revoke eligible group memberships
PrivilegedAssignmentSchedule.Read.AzureADGroup	Read PIM active group schedule instances
PrivilegedAssignmentSchedule.ReadWrite.AzureADGroup	Assign/revoke active group memberships

Important

Microsoft Graph returns a Request_UnsupportedQuery error (filter height 4, max 3) when you combine the PIM groups filter field value with the connector's internal group type filter. The internal filter always takes precedence. The user-defined filter applies independently.
The Graph API for eligibility and assignment schedule instances accepts principalId as a filter. The system fetches membership per account, not in bulk.

Azure PIM Configuration

Attribute	Details
enablePIM	Select the Enable Privileged Identity Management checkbox to define the scope of the Microsoft Entra ID PIM roles (Microsoft Entra ID as well as Azure).
eligibleRoleExpiresAfter	Specifies the default duration for which Azure and Microsoft Entra ID eligible roles must be assigned to user. The values must be in the ISO_8601 duration format. For example, if eligible role needs to be assigned for 180 Days, use <entry key="eligibleRoleExpiresAfter" value="P180D" />
activeRoleExpiresAfter	Specifies the default duration for which Azure and Microsoft Entra ID Active roles must be assigned to user. The values must be in the ISO_8601 format. For example, if eligible role must be assigned for 10 Hours, use <entry key="activeRoleExpiresAfter" value="PT10H" />

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.