# Microsoft SharePoint Online Connector > SailPoint Microsoft SharePoint Online Connector Documentation # Documentation # Connecting SailPoint and Microsoft SharePoint Online To connect SailPoint with Microsoft SharePoint Online, perform the following tasks: ## Adding the Source in SailPoint To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs. > [!IMPORTANT] > > By default, the provisioning feature is **disabled**, and the connector only supports read-only operations. To support provisioning operations, you must manually enable the feature in the source configuration. **To configure a new source:** 1. Sign in to SailPoint. 2. Go to **Admin \> Connections \> Sources**. 3. Select **Create New**. 4. Search for the connector by entering the name in the search box, and then select **Actions**. 5. In the **Actions** dropdown list, select the setup method: - [**Express Setup**](<#configuring-a-source-using-express-setup>) - Quickly create a read-only connection to your target system by providing minimal configurations and authentication. On completion, aggregation is automatically started. > **Note** > > Express Setup supports Credential Providers. For information on supported credential providers and configuration, refer to [Credential Providers](). For more information, contact your SailPoint Customer Service Manager. - [**Standard Setup**](<#configuring-a-source-using-standard-setup>) - Provide detailed basic configuration to create the source. Once the source is created, continue with source setup. ### Configuring a Source Using Express Setup Express Setup minimizes the initial configuration process so you can quickly connect the application and immediately begin aggregating user account and entitlement data. 1. Review the directions and select **Start Express Setup**. 2. Review the pre-populated **Source Name**, **Source Owner**, and **Description**. To update, select **Edit**. > **Note** > > The source name must be unique. You can change these settings later in the source configuration. 3. Select **Virtual Appliance**. A virtual appliance is a Linux-based virtual machine that connects to your sources and apps using SailPoint APIs, connectors, and integrations. For more information about configuring and deploying virtual appliances, refer to [SailPoint Virtual Appliances](). 4. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider. > **Note** > > To add a Credential Provider in SailPoint, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](). 5. Configure the authentication to allow SailPoint to connect to the source. For more information, refer to the **Connection Settings** section. 6. Select **Finish**. After a successful test connection, the system creates your source and prompts you to run an aggregation. - If you want to aggregate now, select **Aggregate**. - To see the latest account aggregation history, go to **Account Management \> Account Aggregation**. - To see the list of aggregated source accounts, go to **Account Management \> Accounts**. - If you want to aggregate later, select **Exit**. This returns you to the **Sources** page. Your new source is listed, but contains no accounts or aggregation history yet. ### Configuring a Source Using Standard Setup Use Standard Setup to configure the connector for full feature support. 1. In the **Source Name** field, enter a unique and descriptive name for your source. Source names cannot exceed 128 characters. 2. In the **Description** field, provide additional details about the source to help distinguish it from similar sources. This field allows a maximum of 2,000 characters. 3. In the **Source Owner** field, begin typing the name of an owner. Matches appear after you type two or more letters. For more information, refer to [Assigning a Source Owner](). 4. Under **Connection Type**, select **Direct Connection** or **Flat File**. - **Direct Connection** - A direct connection fetches data from the **Virtual Appliance Cluster** you choose as the application connector for the source. A direct connection configuration allows for real-time updates. For more information about configuring and deploying virtual appliances, refer to the [Virtual Appliance Reference Guide](). - **Flat File** - Select the flat file if no connector is available, or if another system restricts the connection. This option allows only reading and aggregating data as a generic/delimited application. Provisioning activity is unsupported, and additional configuration pages like connection settings and aggregation settings are unavailable. 5. If you selected **Direct Connection**, in **Virtual Appliance Cluster**, select the virtual appliance cluster that will be used as the application connector for the source. 6. (Optional) Select a governance group to grant its members [source]() or [role]() sub-admin level oversight of the source and its access. For more information, refer to [Creating and Managing Governance Groups](). 7. If this source represents a primary system containing your organization's personnel records, select the **Authoritative Source** checkbox. For more information, refer to [Creating Identity Profiles](). 8. Select **Continue**. The source is created, and you are navigated to the **Source Setup \> Base Configuration** page. Continue to configure your connected source there. ## Base Configuration Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary. 1. Enter a unique name and description for the source. 2. In the **Source Owner** dropdown list, select the identity that owns this source. - To find a source owner, begin entering their name. 3. In the **Virtual Appliance Cluster** dropdown list, select the virtual appliance to use when communicating with your organization's systems. For more information, refer to [SailPoint Virtual Appliances](). 4. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider. > **Note** > > To add a credential provider, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](). 5. Configure the authentication to allow SailPoint to connect to the source. Refer to [Connection Settings](<#connection-settings>) for more information. 6. (Optional) In the **Governance Group for Source Management** dropdown list, select a governance group to associate with this source. For more information about governance groups, refer to [Associating Governance Groups with a Source](). 7. (Optional) Choose whether to enable or disable provisioning for the source. Provisioning is disabled by default. - **Enable Provisioning** - Set the toggle to **Enabled** to allow the source to create, update, and deactivate accounts in the connected source system. - **Disable Provisioning** - Set the toggle to **Disabled** to disable provisioning for the source. Disabling provisioning will prevent the creation, updating, or deactivating of accounts on this source. 8. Select **Save**. ## Connection Settings To configure a direct connection between the Microsoft SharePoint Online source and SailPoint, specify the authentication type and grant type. > [!NOTE] > > Microsoft recommends using JWT Certificate Credentials for authentication, as other grant types (Client Credentials, SAML Bearer Assertion, Refresh Token/Auth Code) are deprecated and will stop working after April 2, 2026. Use JWT Certificate Credentials for all new and existing source configurations. > [!NOTE] > > **JWT Certificate Credentials (Recommended)** > > The JWT Certificate Credentials method supports authentication based on a JWT assertion prepared from a certificate and private key. > > [![JWT Certificate Credentials]()]() > > 1. Select **JWT Certificate Credentials** from the **Grant Type** drop-down list. > 2. Enter the **Client ID** of the application registered in Microsoft Entra ID. For more information, refer to [Registering an Application Using the Azure AD Portal](). > 3. Enter the valid **Certificate** details of the source created on the SharePoint Online managed system. > 4. Enter the valid **Private Key** text that is used to sign the JWT assertion and the corresponding **Private Key Password**. For more information, refer to [Creating OAuth2.0 JWT Certificate Credentials](). > 5. Enter the SharePoint Online **Domain Name**. For example, `contoso.sharepoint.com`. > 6. In **Authentication Endpoint URL**, enter the URL that corresponds to the Microsoft Azure Active Directory authentication endpoint deployed on a national cloud. > > For example, for the US government, enter `https://login.microsoftonline.us`, or for China enter `https://login.partner.microsoftonline.cn`. > 7. Select **Save**. > [!NOTE] > > **Client Credentials (Deprecated)** > > Use the Client Credentials with the ID and Secret parameters. > > [![Client Credentials]()]() > > 1. Select **Client Credentials** from the **Grant Type** drop-down list. > 2. Enter the **Client ID** and **Client Secret** of the source created on the SharePoint Online managed system. For more information, refer to [Registering Application with OAuth Client Credentials from SharePoint Portal](). > 3. Enter the SharePoint Online **Domain Name**. For example, `contoso.sharepoint.com`. > 4. (*Optional*) In **Authentication Endpoint URL**, enter the URL that corresponds to the Microsoft Azure Active Directory authentication endpoint deployed on a national cloud. > > For example, for the US government, enter `https://login.microsoftonline.us`, or for China enter `https://login.accesscontrol.chinacloudapi.cn`. > 5. Select **Save**. > [!NOTE] > > **Refresh Token / Auth Code (Deprecated)** > > The Auth Code / Refresh Token grant type is a client credentials-based authentication protocol. In addition to client credentials, it uses a Refresh Token to authenticate. > > [![Refresh Token / Auth Code]()]() > > 1. Select **Refresh Token / Auth Code** from the **Grant Type** drop-down list. > 2. Enter the **Client ID** and **Client Secret** of the source created on the SharePoint Online managed system. For more information, refer to [Registering Application with OAuth Client Credentials from SharePoint Portal](). > 3. Enter the valid **Refresh Token** obtained after registering the app with the Azure Active Directory Portal. For more information, refer to [Generating a Refresh Token](). > 4. Enter the SharePoint Online **Domain Name**. For example, `contoso.sharepoint.com`. > 5. In **Authentication Endpoint URL**, enter the URL that corresponds to the Microsoft Azure Active Directory authentication endpoint deployed on a national cloud. > > For example, for the US government, enter `https://login.microsoftonline.us`, or for China enter `https://login.partner.microsoftonline.cn`. > 6. Select **Save**. > [!NOTE] > > **SAML Bearer Assertion (Deprecated)** > > The SAML Bearer Assertion method is password-based user authentication with ADFS environment. SAML assertion issued by ADFS after authentication is used to get the access token from the Azure Active Directory. > > [![SAML Bearer Assertion]()]() [![SAML Bearer Assertion]()]() > > 1. Select **SAML Bearer Assertion** from the **Grant Type** drop-down list. > 2. Enter the **Client ID** and **Client Secret** of the source created on the SharePoint Online managed system. For more information, refer to [Registering Application with OAuth Client Credentials from SharePoint Portal](). > 3. Enter the SAML **Username** and corresponding **Password** for SAML authorization. > 4. Enter the server URL for the **Authorization Endpoint**. > 5. Enter the **Request Body** details for the SAML Bearer assertion. For more information, refer to [SAML Request Body](). > 6. Enter the SharePoint Online **Domain Name**. For example, `contoso.sharepoint.com`. > 7. In **Authentication Endpoint URL**, enter the URL that corresponds to the Microsoft Azure Active Directory authentication endpoint deployed on a national cloud. > > For example, for the US government, enter `https://login.microsoftonline.us`, or for China enter `https://login.partner.microsoftonline.cn`. > 8. Select **Save**. ### OAuth 2.0 Authentication Methods The Microsoft SharePoint Online connector supports OAuth 2.0 authentication with the following grant types: > [!NOTE] > > Microsoft recommends using JWT Certificate Credentials for authentication, as other grant types (Client Credentials, SAML Bearer Assertion, Refresh Token/Auth Code) are deprecated and will stop working after April 2, 2026. Use JWT Certificate Credentials for all new and existing source configurations. - JWT Certificate Credentials *(Recommended)* - Refresh Token/Auth Code *(Deprecated)* - SAML Bearer Assertion *(Deprecated)* > [!NOTE] > > **JWT Certificate Credentials and Refresh Token/Auth Code** > > *Prerequisites* > > - Obtain the **Client ID** and **Client Secret** from Microsoft Entra ID by registering the application. For more information, refer to [Registering an Application Using the Azure AD Portal](). > > > **Note** > > > > It is mandatory to use the Global Admin and Admin of all Sites User in SharePoint Online to create the application in Microsoft Entra ID. > - If the grant type is **JWT**: > > The Certificate (self-signed or CA signed) must be uploaded and registered at the Azure Active Directory portal. To register the certificate with the Microsoft Identity Platform, complete the following: > > 1. Sign in to the **Azure Portal**. > 2. In the Azure app registrations for client application, select the client application. > 3. Select **Certificates & secrets**. > > Select **Upload certificate** and then select the certificate file that you want to upload. > 4. Select **Add**. > 5. Obtain the values for the following: > > - Private Key: The private key text file. > - Private Key Password: The password for the private key. > - Certificate: The text file of the same certificate that was uploaded to the Azure portal. > - If the grant type is **Refresh Token/Auth Code**, generate a refresh token. For more information, refer to [Generating a Refresh Token](). > > Assign the following required permissions to the application: > > 1. In the Azure Active Directory console of the registered app, select **API permissions**. > 2. Select **Add a permission**. > 3. On the **Request API permissions** page, a list of supported APIs is displayed. > > - **Microsoft Graph** is under the commonly used Microsoft API. > - **Azure Active Directory Graph** under supported Legacy API. > - **SharePoint** is under Microsoft API. > 4. Under **What type of permissions does your application require?**, select the permission type as **Delegated** or **Application**. See the following table for the type: > > | Permission | Type | Purpose | > | --- | --- | --- | > | **Microsoft GRAPH API** | | | > | Directory.ReadWrite.All | Delegated | Read, Update, and Delete Group
Add membership | > | Directory.AccessAsUser.All | Delegated | Change Password and Delete User | > | User.ReadWrite.All | Delegated | Read and Update any User | > | Group.ReadWrite.All | Delegated | Read and write all groups | > | GroupMember.ReadWrite.All | Delegated | Read and write group memberships | > | Sites.FullControl.All | Delegated | Have full control of all site collections | > | **SharePoint Online API** | | | > | AllSites.FullControl | Delegated | Have full control of all site collections | > | AllSites.Manage | Delegated | Read and write items and lists in all site collections | > | Sites.FullControl.All | Application | Have full control of all site collections | > | Sites.Search.All | Delegated | Run search queries as a user | > | User.ReadWrite.All | Delegated | Read and write user profiles | > | User.ReadWrite.All | Application | Read and write user profiles | > 5. Under **Select permissions**, select the required permissions. > 6. Select **Add permissions**. > 7. In **Grant consent**, select **Grant Admin Consent** for your configuration and directory. Select **Yes** when prompted in the pop-up dialog box. > [!NOTE] > > **SAML Bearer Assertion (Deprecated)** > > *Prerequisite* > > - Obtain the **Client ID** and **Client Secret** from Microsoft Entra ID by registering the application. For more information, refer to [Registering an Application Using the Azure AD Portal](). > > > **Note** > > > > It is mandatory to use the Global Admin and Admin of all Sites User in SharePoint Online to create the application in Microsoft Entra ID. > > Note the following: > > - The authentication user must be synchronized in Azure Active Directory. > - Assign the user the **User Administrator** permission role in Azure Active Directory. > > > **Note** > > > > It is mandatory to use the Global Admin and Admin of all Sites User in SharePoint Online to create the application in Azure Active Directory. > - You must enable the ADFS endpoint required to authenticate the user. > - The ADFS machine time zone must be in sync with Azure time zone, that is, UTC. > > Assign the following required permissions to the application: > > 1. In the Azure Active Directory console of the registered app, select **API permissions**. > 2. Select **Add a permission**. > 3. On the **Request API permissions** page, a list of supported APIs is displayed. > > - **Microsoft Graph** is under the commonly used Microsoft API. > - **Azure Active Directory Graph** under supported Legacy API. > - **SharePoint** is under Microsoft API. > 4. Under **What type of permissions does your application require?**, select the permission type as **Delegated** or **Application**. See the following table for the type: > > | Permission | Type | Purpose | > | --- | --- | --- | > | **Microsoft GRAPH API** | | | > | Directory.ReadWrite.All | Delegated | Read and write directory data | > | Group.Read.All | Delegated / Application | Read all groups | > | Group.ReadWrite.All | Delegated / Application | Read and write all groups | > | GroupMember.Read.All | Delegated / Application | Read group memberships | > | GroupMember.ReadWrite.All | Delegated / Application | Read and write group memberships | > | Sites.FullControl.All | Delegated / Application | Have full control of all site collections | > | Site.Manage.All | | | > | Site.Read.All | Delegated / Application | Read items in all site collections | > | Site.ReadWrite.All | Delegated / Application | Edit or delete items in all site collections | > | User.Invite.All | Application | Invite guest users to the organization | > | User.Read | Delegated | Sign in and read user profile | > | **SharePoint Online API** | | | > | AllSites.FullControl | Delegated | Have full control of all site collections | > 5. Under **Select permissions**, select the required permissions. > 6. Select **Add permissions**. > 7. In **Grant consent**, select **Grant Admin Consent** for your configuration and directory. Select **Yes** when prompted in the pop-up dialog box. ## Aggregation Settings Use the aggregation parameters to set up the aggregation of data from the managed sites. > [!NOTE] > > **Screenshot** > > [![Aggregation Settings]()]() [![Aggregation Settings]()]() 1. Enable **Manage All Sites** if you want to manage all the sites. 2. In **Include Site Collections**, enter the list of all the site collections that are to be managed. 3. In **Exclude Site Collections**, enter the list of all the site collections that are to be excluded. 4. Enter the **Page Size**. This is the number of objects to fetch in a single page for a Site Collection. The default size is 500. 5. Select **Save**. ## IQService Settings IQService is a native Windows service that enables SailPoint to participate in a Windows environment and access information only available through Windows APIs. It is a lightweight service that must be installed on any supported Windows Server that has connectivity to the target systems you want to manage in SailPoint. The IQService is used for the Before and After Script and connector rules for the Microsoft SharePoint Online connector. > [!NOTE] > > **Screenshot** > > [![IQService Settings]()]() #### Download IQService To download the IQService installation complete the following: 1. Select the **Download IQService** button. Download, install, and configure IQService by following the steps mentioned in the [Identity Security Cloud IQService Administrator's Guide]() for [Installing and Registering IQService](). > [!NOTE] > > **Screenshot** > > [![IQService configuration]()]() Configure the IQService details: 1. (*Optional*) In the **IQService Host** field, enter the host name or IP address of the system where IQService is installed. 2. (*Optional*) Enter the **IQService Port** number used to connect. If you enable TLS, configure the corresponding IQService TLS port. The default is 5050. 3. (*Optional*) Enter the **IQService User** for client authentication. 4. (*Optional*) Enter the **IQService Password** for the IQService user. 5. (*Optional*) Select **Enable Transport Layer Security (TLS)** if the connection is over TLS. For more information, refer to [IQService: TLS and client authentication configuration for Identity Security Cloud](). 6. Select **Save**. ## Review and Test Perform a test to confirm the connection to SailPoint. 1. Go to **Review and Test**. 2. Confirm that the entries in each field are correct. If you note any mistakes, return to the section and make corrections. 3. Select **Test Connection**. ## SailPoint Application Onboarding SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to **Discovered Applications** in the SailPoint user interface. For more information, refer to [Application Onboarding]() in the SailPoint SaaS documentation. # Integrating SailPoint with Microsoft SharePoint Online Microsoft SharePoint Online is a cloud-based service that helps organizations share and manage content, knowledge, and applications. The SailPoint Microsoft SharePoint Online connector manages SharePoint users and groups from all site collections present on the Microsoft SharePoint Online directory. This document is designed to give specific information about the requirements and field definitions needed to get a working instance of a Microsoft SharePoint Online. > [!NOTE] > > To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes]() page. ## Supported Features The Microsoft SharePoint Online connector supports the following features: > [!NOTE] > > Before you can use any of the following items marked with an asterisk (\*), SailPoint must activate the feature for your site. #### Account Management - Manage Microsoft SharePoint Online Users as Accounts - Account Aggregation and Account Refresh - Create - \*Add or Remove Entitlements (Groups from Sites and Subsites) - \*Access Certifications (certification of entitlements connected to accounts) - \*HTTP and HTTPS Proxy Configurations #### Entitlement Management - Manage Microsoft SharePoint Online Groups as Entitlements - Aggregate Groups (from Sites and Subsites) #### Supports Native Before/After Scripts for Provisioning Requests This feature requires installation and registration of IQService. For more information, refer to [IQService Administrator's Guide](). #### Supports OAuth2.0 Authentication The Microsoft SharePoint Online connector supports OAuth 2.0 authentication. For more information, refer to [OAuth 2.0 Authentication Methods](). For more information on features, refer to [Source Features](). ## Prerequisites - The SharePoint Online connector must be registered in Microsoft Entra ID with tenant level access for all the configured Site Collections. For more information, refer to [Registering an Application Using the Azure AD Portal](<#registering-an-application-using-the-azure-ad-portal-recommended>). - (*Deprecated*) The SharePoint Online connector must be registered on SharePoint Online with tenant level access for all the configured Site Collections. For more information, refer to [Registering Application with OAuth Client Credentials from SharePoint Portal](<#registering-application-with-oauth-client-credentials-from-sharepoint-portal-deprecated>). - (*Deprecated*) The SharePoint Online administrator must be the primary administrator and must have 'FullControl' permissions for all the configured Site Collections. For more information, refer to [Grant Access and Full Control Permissions](<#grant-access-and-full-control-permissions>). > [!NOTE] > > Microsoft recommends using JWT Certificate Credentials for authentication, as other grant types (Client Credentials, SAML Bearer Assertion, Refresh Token/Auth Code) are deprecated and will stop working after April 2, 2026. Use JWT Certificate Credentials for all new and existing source configurations. - You must install IQService to use this feature. For more information, refer to [IQService](). > [!IMPORTANT] > > IQService installation now enforces TLS configuration by default to improve security and safeguard your environment. To proceed with the installation, ensure you have completed the necessary prerequisites for TLS configuration. For more information, refer to [Configuring TLS and Client Authentication for IQService](). - Configure at least one virtual appliance cluster and successfully test the connection. For instructions, refer to the [Virtual Appliance Reference Guide](). - Before/After scripts can be executed by the latest version of [IQService](). You can use this feature to write custom PowerShell scripts that can be invoked before and after provisioning operations for this connector. > [!WARNING] > > To enhance security, it is mandatory to configure the TLS for IQService. If you continue using non-TLS configuration, any before and after script execution will be disabled to safeguard your environment. Remove non-TLS configuration for IQService to execute any rules and scripts. - SailPoint recommends that you secure the communication path between the connector (VA) and IQService for the overall security of the Microsoft SharePoint Online connector. For more information, refer to [TLS Configuration Between VA and IQService](). - For specific prerequisites by authentication method, refer to [OAuth 2.0 Authentication Methods](). - If you are using a custom application authentication, you must manually enable it. For more information, refer to [Enabling Custom App Authentication](<#enabling-custom-app-authentication>). ### Registering an Application Using the Azure AD Portal *(Recommended)* Register a New Application in Microsoft Entra ID: 1. Sign in to the **Microsoft Entra admin center**. 2. Go to **Identity \> Applications \> App registrations**. 3. Click on **New Registration**. 4. Fill in the application details: - Name: Give your application a descriptive name. For example, `SharePoint API Client`. - Supported account types: Select **Accounts in this organizational directory only**. 5. Click Register ### Creating OAuth2.0 JWT Certificate Credentials *(Recommended)* The following are the steps for creating JWT certificate credentials for OAuth2.0 authentication. For more information refer to [OAuth 2.0 Authentication Methods](). #### Steps for registering an application and assigning API permissions 1. Create an application in Azure and register it. For more information, refer to [register a new application]() in the Microsoft documentation. > **Screenshot** > > [![Registering an application in Azure]()]() 2. Get an Application ID (Client ID) after the app registration, and then generate a Client Secret for it. 3. Assign API permissions to the Application ID (Client ID). For more information, refer to [API permissions]() in the Microsoft documentation. > **Screenshot** > > [![Assigning API permissions]()]() If you have already completed the above steps, you can skip them and proceed directly to the steps for creating and using the certificate. #### Steps for creating and using the certificate 1. Run PowerShell as an administrator on any of the windows machine, and then generate a self-signed certificate with the following command: ```text New-SelfSignedCertificate -DnsName "SPOnline" -CertStoreLocation "cert:\LocalMachine\My" ``` > **Screenshot** > > [![Generating a self-signed certificate]()]() 2. Go to **certlm.msc \> Personal \> Certificates \> Export**, the export wizard will open and you can step through the process to export the certificate in PFX format. > **Screenshot** > > [![Exporting the certificate]()]() [![Exporting the certificate]()]() 3. Select **Include all certificates in the certification path if possible** and **Enable certificate privacy**. > **Screenshot** > > [![Certificate export options]()]() 4. Provide a password to protect the private key using AES-256-SHA256 encryption. This password will be required when you sign your applications using the PFX file you are generating. > **Screenshot** > > [![Protecting the private key]()]() 5. Save on any directory of your choice. Download [openssl]() or use Git Bash. Copy the PFX file into the same directory where the command prompt or terminal is opened as an administrator, and run the following commands one by one, pressing **Enter** after each: ```text openssl pkcs12 -in test1.pfx -nocerts -out sp.key openssl pkcs12 -in test1.pfx -clcerts -nokeys -out sp.crt openssl rsa -in sp.key -out rsasp.key ``` > **Screenshot** > > [![Extracting the key and certificate files]()]() [![Extracting the key and certificate files]()]() 6. Upload the crt file on the Azure system. > **Screenshot** > > [![Uploading the certificate]()]() 7. In the SailPoint user interface **Connection Settings** section, enter the details for SharePoint Online application in text for `rsasp.key` and `sp.crt` in **Private Key**. For more information, refer to [Connection Settings](). The **Private Key Password** is the pass-phrase you provided when generating the `sp.key`. > **Screenshot** > > [![Entering the private key and certificate]()]() ### Registering Application with OAuth Client Credentials from SharePoint Portal *(Deprecated)* > [!NOTE] > > Microsoft recommends using JWT Certificate Credentials for authentication, as other grant types (Client Credentials, SAML Bearer Assertion, Refresh Token/Auth Code) are deprecated and will stop working after April 2, 2026. Use JWT Certificate Credentials for all new and existing source configurations. For more information, refer to [Registering an Application Using the Azure AD Portal](<#registering-an-application-using-the-azure-ad-portal-recommended>). To register the SharePoint Online connector on SharePoint Online portal, complete the following: 1. Sign in to the following URL with the account that has the global administrator role and generate the **Client Id** and **Client Secret**: `https://.SharePoint.com/_layouts/15/appregnew.aspx` Enter the respective values for the following fields: | Fields | Values | | --- | --- | | Title | Add-In | | App Domain | localhost | | Redirect Url | [https://localhost]() | 2. Select **Create**. This registers the **Add-In** and returns a success message with the created information. 3. Grant permissions to the **Add-In** to access the SharePoint data. > **Note** > > Provide `Full Control` permission level to the tenant scope to enable the ability to read, write, and manage the Site Collections information. #### Grant Access and Full Control Permissions The connector you registered in the previous section must also be registered on SharePoint Online with tenant level access with `Full Control` permissions for all configured Site Collections. To register the connector with the correct access level and permissions, complete the following: 1. Enter the following URL to redirect to the Grant Permission page (where sitename is the URL of your SharePoint site): `https://-admin.sharepoint.com/_layouts/15/appinv.aspx` 2. In the **AppId** field, enter the Client ID you generated in the previous section. 3. Select **Lookup**. This populates the values in the following fields: **Title**, **App**, **Domain**, and **Redirect URL**. 4. In the **Permissions Request XML** field, enter the following permission request (in XML format): ```xml ``` 5. Select **Create**. You are redirected to a page where you must click **Trust In**. #### Enabling Custom App Authentication If you are using a custom authentication method with your application you must manually enable it using PowerShell cmdlets. Run the following PowerShell cmdlets on Windows PowerShell: 1. Install the SharePoint Online PowerShell module (if you don't have it) and execute the following command: `$orgName = ""` 2. Authenticate as the SharePoint administrator using the following command: `Connect-SPOService - Url https://$orgName-admin.sharepoint.com` 3. Enable the custom application authentication using the following command: `Set-SPOTenant -DisableCustomAppAuthentication $false` # Machine Account Attributes ## Machine Account Provisioning Attributes Machine account attributes are used in provisioning configurations for machine accounts. After you have [created the required machine account subtypes](), you can use the machine account attributes to provision machine accounts in your SailPoint tenant. Refer to [Machine Identity Security Overview]() for more information. > [!NOTE] > > Attributes marked with an asterisk (\*) are mandatory. | Create Account Attribute | Description | | --- | --- | | UserName\* | The User Principal Name (UPN) for the Microsoft Entra account. | # Provisioning The Microsoft SharePoint Online connector supports provisioning, allowing you to create and manage accounts and entitlements in Microsoft SharePoint Online directly from SailPoint. **Prerequisite:** Your system is configured for provisioning. When SailPoint provisions new accounts to the source, it uses the attributes on the **Create Account** page as instructions or a template for what to include in the account. This page is also referred to as the *provisioning policy*. When new access is granted on a source where a user does not already have an account, SailPoint automatically includes account creation in the provisioning. This applies whether provisioning is started from an access request or from an automated role or lifecycle state assignment. For direct-connect sources, SailPoint automatically creates the account from this configuration. If the source is not configured as a direct-connect source, SailPoint creates and assigns a provisioning task to the source owner and includes the values for the source owner to use in manually creating the account. > [!IMPORTANT] > > This section describes the default **Create Account** configuration. SailPoint recommends that you work with Services to define a provisioning configuration specific to your company's needs. Be sure to verify large changes to the provisioning policy before implementation. Failure to do so might cause provisioning to fail. ## Default Create Account Attributes The following generator creates required information for a new Microsoft SharePoint Online account. You might need to edit the contents. | Account Attribute | Generator | Description | | --- | --- | --- | | UserName | Identity Attribute | Enter the user name for Office 365. For example, `johnny@contoso.com`. | ## Provisioning Policy Attributes The following tables list the provisioning policy attributes for creating accounts, creating groups, and updating groups. > [!NOTE] > > Attributes marked with an asterisk (\*) are mandatory. ### Create Account | Attribute | Description | | --- | --- | | UserName\* | The user name of Office 365. For example, `johnny@contoso.com`. | ### Create Group | Attribute | Description | | --- | --- | | Title\* | The name of the group. | | SiteCollection\* | The site collection URL. | ### Update Group | Attribute | Description | | --- | --- | | OnlyAllowMembersViewMembership | Members who can view the membership list. | | AllowMembersEditMembership | Members who can edit the members. | | AllowRequestToJoinLeave | Allow request to join or leave from the group. | | AutoAcceptRequestToJoinLeave | Membership requests are automatically accepted. | | Azure AD Groups | Domain security groups. | > [!NOTE] > > You cannot add Azure Active Directory groups when creating a SharePoint Online group due to an API limitation. # Generating a Refresh Token *(Deprecated)* Before generating the refresh token, generate the client ID and client secret as described in [Registering an Application Using the SharePoint Online Portal](). To generate a refresh token, complete the following: 1. Obtain the authorization code using the following request (this process involves user consent): 1. Use the following format for the authorization URL: `https://.sharepoint.com/_layouts/15/OAuthAuthorize.aspx?client_id=client_GUID&scope=app_permissions_list&response_type=code&redirect_uri=redirect_uri` URL parameter details: ```text client_id= &response_type=code &redirect_uri= &scope=offline_access%20https://graph.microsoft.com/.default ``` Parameters details: **`client_id`** The client ID of the registered application. **`response_type`** For authorization code the value must be `code`. **`redirect_uri`** This should be the redirect URL configured while registering the application. This should be pointed to the local host and any unused port. **`scope`** You can add multiple scopes for defining the required API. You can also set the scope to `AllSites.Manage`. The default scope is `offline_access%20https://graph.microsoft.com/.default`. | Scope URI | Scope Alias | Available Rights | | --- | --- | --- | | [http://sharepoint/content/sitecollection]() | Site | Read, Write, and Manage | | [http://sharepoint/content/sitecollection/web]() | Web | Read, Write, and Manage | | [http://sharepoint/content/sitecollection/web/list]() | List | Read, Write, and Manage | | [http://sharepoint/content/tenant]() | All Sites | Read, Write, and Manage | 2. If you haven't already signed in to the SharePoint site, navigate to the URL and sign in. 3. Select **Trust It** to grant consent. The response in browser address bar will be displayed as follows: `https://localhost/?code=PAQABAAEAAAD--DLA3VO7QrddgJg7WevrYFFcg3I0SsVRqZUlJSPK7G-g4NvlX9JtK3Q5H0RTtSD0Gmowaqid9ohxQjunSukFrvIz2px9c8V1Rm9X2khsWI1Q518jTZMS6Efi9yXoBgCJ4-KvcWsSf7whcrNhgabOM9zov1YoPtx0-zidfGBwpvcuXoUCNN4osm1lv0CW2Uwh0-91SadwJkx83itzQnD9hQwGWZPVVDdg_zEYibnoZV8N1el4hfoMKrOBib6ul1vBw1rhMt7kNcrHBs_YKs9OrhvOGCSUgKvQQ9qBwNjRZYOL8M7JVrcMFCgC70QliVMgShzjOUgMOmtx0qQcVFl4IAA` 2. Copy all the code after `code=`. This is the authorization code. > **Note** > > The received authorization code can be used only once and is valid for a short duration. 3. Obtain the refresh token using the authorization code obtained in the previous step. The authorization code and other parameters must be passed in the following request: ```text curl --location --request GET 'https://accounts.accesscontrol.windows.net/dc75061d-64a1-405d-a746-465dece42192/tokens/OAuth/2' \ --header 'Content-Type: application/x-www-form-urlencoded' \ --data-raw 'client_id=cd1e9fd9-55c2-4dae-833a-fbcc150f1fad%40dc75061d-64a1-405d-a746-465dece42192&scope=offline_access%20https://graph.microsoft.com/.default&code=PAQABAAEAAAD--DLA3VO7QrddgJg7WevroypXVs207MGJClcCv_vL0wh8CzS5lXCHANO-wqepUk6_PHHTl25FiADOITB5CSwV8PGTwpLRmnQC6VN-xnXC5JVcoebz-O66U7cqIJ8i2TRQ8E2dqyeR0fYplqvwNK58xncqZNb2arXq8f50MrCYknwzkvqdkV6LXeIpDvJI4agv962w7i_NbbuPA7x8ESs0V5qgV7RcFXBFZmCU1VrvXC7KdiwKatQqRqmgXpd58gvMAX0nVy3zaRfwTw7LB5-1wccgFs4Xyx3KbfPuoBXCMTYIuEmnQK5JtdU7qXpSwmpyIcx1nfoATUkP0UXxkGR3IAA&redirect_uri=https://localhost&grant_type=authorization_code&client_secret=eroXdRLYRI3HeGksVC0n9brERZwxjqggIGv%2F%2Bcsumrk%3D&resource=00000003-0000-0ff1-ce00-000000000000%2Fsailpointdev.sharepoint.com%40dc75061d-64a1-405d-a746-465dece42192' ``` The newly added parameters are: **`code`** The authorization code obtained in previous steps. **`grant_type`** If you intend to recover the authorization code it should be `authorization_code`. **`client_secret`** The client secret of the registered application. **Response**: ```json { "token_type": "Bearer", "scope": "https://graph.windows.net/Directory.Read.All https://graph.windows.net/User.Read https://graph.windows.net/.default", "expires_in": 7199, "ext_expires_in": 7199, "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6IlNzWnNCTmhaY0YzUTlTNHRycFFCVEJ5TlJSSSIsImtpZCI6IlNzWnNCTmhaY0YzUTlTNHRycFFCVEJ5TlJSSSJ9.eyJhdWQiOiJodHRwczovL2dyYXBoLndpbmRvd3MubmV0Iiwia...", "refresh_token": "OAQABAAAAAAAm-06blBE1TpVMil8KPQ410LOG6EPVxGfgH8rHUXApUs5fPFtel9FsKTXo2oN8Rw_ngEOpKNt1hfufYyJJnG39XxfscpcW...." } ``` Copy the **Refresh Token** received in the response. # Configuring Retry Parameters The Microsoft SharePoint Online connector supports the retry mechanism for account aggregation. Add the following attributes using the REST API. > [!NOTE] > > For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community. ### retryableErrorsOnAgg Enter a list of errors that need to be retried during the aggregation operation as a string with entries separated by a comma. For example, `["Check Error 1","Authentication ticket has expired"]` ### maxRetryCount Enter the number of times to retry the request. The default is 5. ### queryTimeout Enter the time (in milliseconds) before timeout when waiting for the aggregation request to complete. For example, `45000`. ### maxThreads Enter the maximum number of threads to be created during account aggregation for optimized performance. The default is 5. # SAML Request Body *(Deprecated)* The SAML Request Body must consist of the following: - The SAML request must have Microsoft SharePoint Online as the intended audience. - The username in the request must be replaced by the `$username$` place holder. - The password in the request must be replaced by the `$password$` place holder. The following is an example of an SAML Request Body: Authorization Endpoint: `https:///adfs/services/trust/2005/usernamemixed` > [!NOTE] > > **SAML Request Example** > > ```xml > xmlns:a='http://www.w3.org/2005/08/addressing' > xmlns:u='http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd'> > http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue > http://www.w3.org/2005/08/addressing/anonymous > https:///adfs/services/trust/2005/usernamemixed > xmlns:o='http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd'> > '> > $username$ > $password$ > > > > > > > urn:federation:MicrosoftOnline > > > http://schemas.xmlsoap.org/ws/2005/05/identity/NoProofKey > http://schemas.xmlsoap.org/ws/2005/02/trust/Issue > > > > ``` # Schema Reference The application schema is used to configure the objects returned from a connector. > [!NOTE] > > - The **Account Schema** tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as **Entitlement** or **Multi-Valued**. Refer to [Managing Source Account Schemas]() for more information. > - The schema attributes that are not present by [default](<#default-account-schema>) must be defined as strings if not specified. The Microsoft SharePoint Online connector uses the following default correlation and object configurations. ## Default Account Schema Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location. The set of account attributes each source stores and how they're organized is known as the account's *schema*. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to [Managing Source Account Schemas]() for more information. ### Default Account ID SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as *account IDs*. > [!CAUTION] > > Changing the attribute marked as the account ID after aggregating accounts can result in duplicate accounts being created. To avoid this, either reset the accounts on this source before editing the account ID attribute or edit the account ID attribute before aggregating accounts. > > To resolve issues caused by changing account IDs, reconfigure them to their default values. The following table lists the default account IDs for this connector: | Account ID | Schema Object Type | | --- | --- | | LoginName | Account | | Group URL | Group | ### Default Account Attributes The Microsoft SharePoint Online connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified. | Attribute Name | Description | | --- | --- | | LoginName | The login name of the user. This is an Account ID which must not be changed. | | Name | The display name of user. | | Email | The e‐mail address of the user. | | FirstName | The first name of the user. | | LastName | The last name of the user. | | ID | The member ID of the user. | | Groups | Specifies all the groups to which the user belongs. | | SiteCollections | Specifies all the site collections to which the user belongs. | | AdminOfSites | Specifies all the site collections to which the user is an administrator of. | ## Default Entitlement Attributes Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to [Managing Entitlements]() for more information. > [!CAUTION] > > Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations. ### Default Group Attributes The Microsoft SharePoint Online connector also supports groups. The following attributes must be configured on the managed system and in the SailPoint source schema to manage groups. | Attribute Name | Description | | --- | --- | | ID | The identifier (ID) for the group. | | Group URL | The URL to the group in a site collection. This is an Account ID which must not be changed. | | Name | The display name of the group. | | Description | The description of the group. | | OwnerTitle | The owner title of the group. | | Azure AD Groups | Security domain groups for SharePoint Online. | | AutoAcceptRequestToJoinLeave | Gets (or sets) a value that indicates whether the request to join or leave the group can be accepted automatically. | | AllowMembersEditMembership | Gets or sets a value that indicates whether the group members can edit membership in the group. | | RequestToJoinLeaveEmailSetting | Gets (or sets) the email address to which the requests of the membership are sent. | | OnlyAllowMembersViewMembership | Gets (or sets) a value that indicates whether only group members are allowed to view the membership of the group. | | AllowRequestToJoinLeave | Gets (or sets) a value that indicates whether to allow users to request membership in the group and request to leave the group. | # Migrate VA-based Source to a SaaS Source Some sources that are connected to virtual appliance (VA) clusters can be migrated to SaaS connections. This ensures data (users and entitlements) remain intact and can maintains your source configurations like access profiles, roles, password settings, and correlation configurations when switching from a VA cluster to a SaaS connection. To migrate a source from a VA-based source to a SaaS source, you will provide configuration details on a draft version of the source before publishing the source. > [!NOTE] > > - You must have an Admin or Source Admin user level to migrate a source. A draft version of the source is created. As your migration process is in progress the live source will continue to work as it is. For more information on the Microsoft SharePoint Online SaaS connector, refer to the [Microsoft SharePoint Online SaaS Supported Features](). ## Important Considerations Before Migrating - You do not need to edit additional configurations (other than connection credentials) to migrate the source. - If your source migration is in progress, please do not make any configuration changes to your live source as those can be overwritten once you apply the migration your draft version. - Once you've gone ahead with your migration, it can't be rolled back. Your source is permanently migrated to a SaaS source. - Any preview operations or configuration changes on the draft source will not impact the live source until you apply the migration. ## Migrating Sources To migrate your source, complete the following: 1. Go to **Admin \> Connections \> Sources**. 2. Select or edit the VA-based source you want to migrate. 3. Open the source configuration, and select **Migrate to SaaS**. 4. When prompted, select **Continue**. A draft version of the source is created. The live source will continue to work. 5. Select **Connection Settings**. 6. Re-enter encrypted configuration details. For example, you might need to re-enter the Client Secret, Password, Refresh Token, Personal Access Token (PAT), or Certificates to migrate from the VA cluster to the SaaS connection. > **Important** > > Avoid editing the other configuration options in the draft source. 7. Select **Review and Test**. 8. Select **Test Connection**. 9. (Optional) Select **Accounts**. If you successfully tested your connection in **Review and Test**, you can select **Preview** to display a subset of accounts from the application that will be mapped to SailPoint identities. This can help ensure you are accurately connecting identity data from the application with SailPoint identities. 10. (Optional) Select **Entitlements**. If you successfully tested your connection in **Review and Test** and your source type supports entitlement type configuration, you can select **Preview** to view a preview of entitlements using the current configuration settings. 11. When you've finished reviewing your changes and successfully tested your connection, select **Apply Migration**. Your changes will be applied to the live source and the draft source will be deleted. ## Viewing Source Migration Status You can view the status and creation date of draft sources. 1. Go to **Admin \> Connections \> Sources \> Source Migration Status**. 2. Select **Source Migration Status**. 3. To view or edit the draft source, select **Actions** ![]() **\> Preview** on the draft source. 4. To delete the draft source, select **Actions** ![]() **\> Delete** on the draft source. # Enable Connector Logging This topic provides the steps needed to enable logging on SailPoint using REST APIs. > [!NOTE] > > This topic only applies to VA-based integrations. > [!NOTE] > > The examples provided might not match your configuration. Use the logging levels and logging classes reference at the bottom of the topic to configure your API responses to match your connector. This process is broken up into four steps: 1. Identify the Virtual Appliance (VA) cluster on which you want to enable logging. 2. Get the logging configuration for the existing VA cluster. 3. Update the VA cluster to enable logging levels. 4. Observe logging changes to the logging levels. ### Identify the Virtual Appliance Cluster Select the VA on which you need to enable logging using REST API. If you already know the VA application's `id`, proceed to [Get the Logging Configuration](<#get-the-logging-configuration>). 1. Make the following call to the REST API to return a list of available VA clusters: GET /v3/managed-clusters The REST API returns a response that looks similar to the following: ```json [ { "id": "2c9180866166b5b0016167c32ef31a66", "name": "Development Cluster", "description": "Development Cluster", "clientType": "CCG", "ccgVersion": "373_535_70.2.0", "pinnedConfig": true, "logConfiguration": null }, { "id": "2c9180846a93ce60016ab29f039944de", "name": "Cloud Cluster", "description": "Cloud Cluster", "clientType": "CCG", "ccgVersion": "373_535_70.2.0", "pinnedConfig": true, "logConfiguration": { "clientId": null, "durationMinutes": 60, "expiration": "2020-12-15T19:13:36.079Z", "rootLevel": "DEBUG", "logLevels": { "sailpoint.connector.ADLDAPConnector": "DEBUG" } } } ] ``` > **Note** > > The previous example code shows two VA clusters. One VA cluster has a log configuration and the other does not (refer to the `logConfiguration` value in each returned VA cluster). This is because one of the clusters already has logging enabled. This is just an example configuration, and your environment may not have logging enabled on a cluster. 2. Identify the VA cluster that you want to enable logging on by its name or description and record its `id` attribute. ### Get the Logging Configuration Get your selected VA's cluster logging configuration and identify the values you need to update. 1. Make the following call to the REST API to return the VA cluster's logging configuration. Replace `{id}` with the VA cluster's `id` attribute value recorded earlier. GET /v3/managed-clusters/{id}/log-config - If the VA doesn't have a logging configuration currently set, it returns `204 No Content` as a response. - If the VA has an existing logging configuration, it returns something similar to the following: ```json { "clientId": null, "durationMinutes": 60, "expiration": "2020-12-15T19:13:36.079Z", "rootLevel": "DEBUG", "logLevels": { "sailpoint.connector.ADLDAPConnector": "DEBUG" } } ``` You'll need to configure the following information in the response: - `durationMinutes` is the number of minutes logging should remain enabled. - `rootLevel` is the default level for all logs. For more information, refer to [Logging Levels](<#logging-levels>). - `logLevels` is a map object with logging classes as keys and logging levels as values. - For keys, refer to [Logging Classes](<#logging-classes>) for commonly used logging classes. - For a list of available values, refer to [Logging Levels](<#logging-levels>). ### Update Logging Configuration Update the VA cluster configuration returned by the REST API to update the logging settings as needed. 1. Make the following call to the REST API to update the VA cluster's logging configuration. Replace `{id}` with the VA cluster's `id` attribute value recorded earlier. PUT /v3/managed-clusters/{id}/log-config 2. Submit your configuration changes to the REST API in a JSON body. - If the VA cluster did not already have a logging configuration and you received a `204 No Content` response, you can create a new one. - If the VA returned a configuration, you can edit it to include the changes. The JSON body should be as follows: ```json { "durationMinutes": 60, "rootLevel": "DEBUG", "logLevels": { "sailpoint.connector.ADLDAPConnector": "DEBUG" } } ``` Consider the following as you edit the JSON: - `durationMinutes` is the number of minutes logging should remain enabled. - `rootLevel` is the default level for all logs. For more information, refer to [Logging Levels](<#logging-levels>). - `logLevels` is a map object with logging classes as keys and logging levels as values. - For keys, refer to [Logging Classes](<#logging-classes>) for commonly used logging classes. - For a list of available values, refer to [Logging Levels](<#logging-levels>). If the update was successful, the REST API should return a response similar to the following: ```json { "clientId": null, "durationMinutes": 60, "expiration": "2020-12-15T19:13:36.079Z", "rootLevel": "DEBUG", "logLevels": { "sailpoint.connector.ADLDAPConnector": "DEBUG" } } ``` ### Observe Logging Changes Approximately five minutes after you update the configuration, the VA cluster starts generating log files you can review. You can view the log files in **ccg.log**. ### References The tables in this reference section list information that can be helpful when creating the JSON body you'll use to configure the VA cluster's configuration file. #### Logging Levels | Logging Level | Description | | --- | --- | | ERROR | Designates error events that might still allow the connector to continue. | | WARN | Designates potentially harmful situations. | | INFO | Designates information messages that highlight process at a coarse-grain level. | | DEBUG | Very verbose. Fine grain logging levels used for development and debugging. | | TRACE | Most verbose. Finer grain logging levels than debugging. | #### Logging Classes | Connector | Logging Class | | --- | --- | | Active Directory | sailpoint.connector.ADLDAPConnector sailpoint.connector.LDAPConnector | | AIX | openconnector.connector.unix.AIXConnector openconnector.connector.unix.UnixConnector | | Amazon Web Services | logger.aws.name=openconnector.connector.aws logger.aws.level=trace logger.aws.additivity = false logger.aws.appenderRef.rolling.ref = STDOUT | | Atlassian Suite Cloud | sailpoint.connector.OpenConnectorAdapter openconnector.connector.atlassian.AtlassianConnector | | Atlassian Data Center | sailpoint.connector.OpenConnectorAdapter openconnector.connector.atlassian.AtlassianDataCenterConnector | | Microsoft Entra ID | sailpoint.connector.AzureADConnector | | Box | openconnector.connector.BoxNetConnector sailpoint.connector.OpenConnectorAdapter | | Cerner | openconnector.connector.CernerConnector sailpoint.connector.OpenConnectorAdapter | | Delimited File | logger.DelimitedFileConnector.name = sailpoint.connector.DelimitedFileConnector logger.DelimitedFileConnector.level = debug logger.DelimitedFileConnector.additivity = false logger.DelimitedFileConnector.appenderRef.rolling.ref = STDOUT | | Dropbox | openconnector.connector.DropBoxConnector sailpoint.connector.OpenConnectorAdapter | | Epic | openconnector.connector.EPICConnector sailpoint.connector.OpenConnectorAdapter | | GE Centricity | openconnector.connector.GECentricity sailpoint.connector.OpenConnectorAdapter | | Google Apps / G Suite | openconnector.connector.GoogleAppsDirect sailpoint.connector.OpenConnectorAdapter | | IBM i | openconnector.connector.IBMiConnector | | Lotus Domino | sailpoint.connector.LotusDomino | | JDBC | sailpoint.connector.JDBCConnector | | Sun One LDAP | sailpoint.connector.LDAPConnector | | Linux | openconnector.connector.unix.LinuxConnector sailpoint.connector.OpenConnectorAdapter sailpoint.connector.UnixConnector | | Microsoft Office365 | sailpoint.connector.Office365Connector | | Microsoft SQL Server | sailpoint.connector.mssql.serviceimpl.MSSQLServerConnectorV2 | | Okta | logger.openconnector.name = openconnector.connector.okta.OktaConnector logger.openconnector.level = debug logger.openconnector.additivity = false logger.openconnector.appenderRef.rolling.ref = STDOUT | | Oracle Database | sailpoint.connector.OracleDBConnector sailpoint.connector.JDBCConnector | | Oracle E-Business | sailpoint.connector.OracleEBSConnector sailpoint.connector.JDBCConnector | | Oracle Fusion HCM | openconnector.connector.oraclefusionhcm.OracleFusionHCMConnector sailpoint.connector.OpenConnectorAdapter | | Oracle HCM Cloud | sailpoint.connector.oraclehcmcloud.OracleHCMCloudConnector | | Oracle HRMS | sailpoint.connector.OracleAppsHRMSConnector sailpoint.connector.JDBCConnector | | Oracle Netsuite | openconnector.connector.netsuite.NetsuiteConnector | | PeopleSoft ERP | openconnector.connector.PeopleSoftConnector sailpoint.connector.OpenConnectorAdapter | | PeopleSoft HRMS | sailpoint.connector.PeopleSoftHRMSConnector | | RemedyForce | sailpoint.connector.ForceConnector | | RSA Authentication Manager | openconnector.connector.RSAConnector openconnector.connector.rsa.RSAHTTPClient sailpoint.connector.OpenConnectorAdapter | | Salesforce | sailpoint.connector.ForceConnector | | SAP Concur | openconnector.connector.sapconcur.SAPConcurConnector | | SAP - Direct | sailpoint.connector.SAPConnector sailpoint.connector.SAPInternalConnector | | SAP GRC | logger.SAPGRCConnector.name = sailpoint.connector.sapgrc logger.SAPGRCConnector.level = debug logger.SAPGRCConnector.additivity = false logger.SAPGRCConnector.appenderRef.rolling.ref = STDOUT | | SAP HR/HCM | sailpoint.connector.SAPHRInternalConnector | | SCIM 1.1 | openconnector.connector.SCIMConnector sailpoint.connector.OpenConnectorAdapter | | SCIM 2.0 | openconnector.connector.scim2.SCIM2Connector sailpoint.connector.OpenConnectorAdapter | | ServiceNow | openconnector.connector.servicenow.ServiceNowConnector openconnector.connector.servicenow.ServiceNowRestClient sailpoint.connector.OpenConnectorAdapter | | ServiceNow Service Desk Integration | openconnector.connector.servicedesk.ServiceNowServiceDeskConnector sailpoint.connector.OpenConnectorAdapter | | Siebel | openconnector.connector.SiebelConnector sailpoint.connector.OpenConnectorAdapter | | Snowflake | openconnector.connector.snowflake.SnowflakeConnector sailpoint.connector.OpenConnectorAdapter | | Solaris | openconnector.connector.unix.SolarisConnector openconnector.connector.unix.UnixConnector sailpoint.connector.OpenConnectorAdapter | | SuccessFactors | sailpoint.connector.SuccessFactorsConnector | | Sybase | sailpoint.connector.SybaseDirectConnector sailpoint.connector.JDBCConnector | | Webex | openconnector.connector.Webex sailpoint.connector.OpenConnectorAdapter | | Workday | openconnector.connector.WorkDay sailpoint.connector.OpenConnectorAdapter | | Workday Accounts | openconnector.connector.workdayaccounts openconnector.connector.workdayaccounts.WorkdayAccountsConnector sailpoint.connector.OpenConnectorAdapter | | Web Services | sailpoint.connector.WebServices | | XML | openconnector.connector.XMLConnector sailpoint.connector.OpenConnectorAdapter | | Yammer | openconnector.connector.YammerConnector sailpoint.connector.OpenConnectorAdapter | | Zoom | openconnector.connector.zoom.ZoomConnector sailpoint.connector.OpenConnectorAdapter | # Troubleshooting If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support. For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information: - [SailPoint Identity Services Documentation]() - [SailPoint Support Knowledge Base]() - [SailPoint Developer Community]() ## Exception During Aggregation Even Though Administrator Permissions Are Provided With Full Control Access The following error message appears in processReadRequest: `Token type is not allowed` **Resolution**: Complete the following: 1. Install SharePoint Online PowerShell module (if not already installed). 2. Open PowerShell cmdlets from Windows PowerShell as administrator and run the following commands to authenticate as SharePoint administrator: ```text $orgName = "" Connect-SPOService -Url https://$orgName-admin.sharepoint.com ``` 3. Enable Custom App Authentication using the command: ```text Set-SPOTenant -DisableCustomAppAuthentication $false ``` ## During Aggregation OneDrive Is Logging Error Messages in the Log File for OneDrive Sites Error messages are being displayed in the log from OneDrive (for example, `https://-my.sharepoint.com`) sites. **Resolution**: Add the `siteCollectionFilter` attribute using the REST API with the following value to exclude all OneDrive and personal sites: `contentclass:STS_Site Path:https://.sharepoint.com/*` For example: `contentclass:STS_Site Path:https://sailpointdev.sharepoint.com/*` The default value for the attribute is `contentclass:STS_site`. > [!NOTE] > > For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community. ## Account or Group Aggregation Fails With an Error for Some of Your Sites Account or Group aggregation fails for some of your sites, with the following error: `processReadRequest : Attempted to perform an unauthorized operation` **Resolution**: Add the `siteCollectionFilter` attribute using the REST API with the following value, which uses a wild card entry when fetching sites: `contentclass:STS_Site Path:https://.sharepoint.com/*` This only fetches sites mentioned in the filter and will not fetch any `contentstorage/personal/other` sites that are having permission issues. > [!NOTE] > > This will only work if other sites are fetched properly and the aggregation failure is caused by a subsection of the sites. - The following example payload will fetch all the sites that start with QA and are under domain/folder sites: ```json [ { "op": "add", "path": "/connectorAttributes/siteCollectionFilter", "value": "contentclass:STS_Site Path:https://sailpoint.sharepoint.com/sites/QA*" } ] ``` - The following example payload will fetch all sites under the domain/folder sites: ```json [ { "op": "add", "path": "/connectorAttributes/siteCollectionFilter", "value": "contentclass:STS_Site Path:https://sailpoint.sharepoint.com/sites/*" } ] ``` # Timeout Errors and Settings Timeout errors might occur when SailPoint is waiting for a response from the Virtual Appliance (VA). These errors are applicable to all connectors and tend to occur during the setup of sources or when sources are down. This document is designed to give specific information that can be used to resolve these errors. Each timeout attribute has a default time value that is listed in seconds or minutes. Increasing the time value may resolve the error as it will allow for longer communication time between the two systems, thus avoiding the timeout error. > [!IMPORTANT] > > Add the necessary attributes or values before performing the "replace" operation, as missing attributes will cause the operation to fail. To increase the communication time, increase the value of the appropriate timeout attribute. Then submit the change to the VA using the SailPoint REST API. > [!NOTE] > > For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community. ### aggregateTimeout **Description:** This parameter is set for the aggregation timeout, measured in seconds. **Resolution:** Increase the `aggregateTimeout` value gradually to optimize aggregation. Start with 180, then increase to 600, 900, and finally 1800. The maximum value is 3600 seconds. For example: If your current time value is 180 seconds, update the `aggregateTimeout` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/aggregateTimeout", "value": 600 } ] ``` ### healthCheckTimeout **Description:** This parameter is set for the test connection and health check timeout. **Resolution:** The default value is 30 seconds. If the timeout error continues, increase the value in 15 second increments and try again. For example: If your current time value is 30 seconds, update the `healthCheckTimeout` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/healthCheckTimeout", "value": 45 } ] ``` ### provisioningTimeout **Description:** This parameter is set for provisioning timeout. **Resolution:** Increase the `provisioningTimeout` value gradually to optimize provisioning. Start with 180, then increase to 360, and finally 600. The maximum value is 600 seconds. For example: If your current time value is 180 seconds, update the `provisioningTimeout` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/provisioningTimeout", "value": 360 } ] ``` ### timeout **Description:** This parameter is set for pass-through authentication timeout. **Resolution:** The default value is 15 seconds. If the timeout error continues, increase this value in 15 second increments and try again. For example: If your current time value is 15 seconds, update the `timeout` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/timeout", "value": 30 } ] ``` ### apiTimeout **Description:** This parameter is set for API time tracking; customers can check it using an external tool. **Resolution:** The default value is 60 seconds. If the error continues, increase the value by 15 second increments and try again. For example: If your current time value is 60 seconds, update the `apiTimeout` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/apiTimeout", "value": "75" } ] ``` ### timeoutInSeconds **Description:** This parameter helps prevent the VA from waiting indefinitely for an API response, ensuring efficient handling of API requests. For example: If your current time value is 30 seconds, update the `timeoutInSeconds` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/timeoutInSeconds", "value": "15" } ] ```