Integrating SailPoint with Microsoft SharePoint Server

Microsoft SharePoint Server is a web-based collaborative platform that integrates with Microsoft Office products.

This document is designed to give specific information about the requirements and field definitions needed to getting a working instance of a Microsoft SharePoint Server source.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

The Microsoft SharePoint Server connector supports the following features:

Note

Before you can use any item marked with an asterisk (*), SailPoint must activate the feature for your site.

Load and *Provision SharePoint Server Accounts
*Access Certifications (certification of entitlements connected to accounts)

For more information on features, refer to Source Features.

Important

This instance of IQService is configured to listen on a TLS port by default to improve security and safeguard your environment. To establish a secure connection, ensure to follow the following steps:

Enable the TLS configuration flag in your source.
Refer to Configuring TLS and Client Authentication for IQService for detailed instructions on configuring TLS for IQService, including client authentication.

Ensuring proper TLS configuration is crucial for maintaining the security of your IQService deployment.

Warning

To enhance security, it is mandatory to configure the TLS for IQService. If you continue using non-TLS configuration, any before and after script execution will be disabled to safeguard your environment. Remove non-TLS configuration for IQService to execute any rules and scripts.

Prerequisites

Configure at least one virtual appliance cluster and successfully test the connection. For more information, refer to the Virtual Appliance Reference Guide.
Before you can use any of the features of the connector, IQService must be installed on the computer with the same domain as that of SharePoint Server. For more information about installing IQService, refer to the IQService guide.

Important

IQService installation now enforces TLS configuration by default to improve security and safeguard your environment. To proceed with the installation, ensure you have completed the necessary prerequisites for TLS configuration. For more information, refer to Configuring TLS and Client Authentication for IQService.
Install PowerShell version 3.0 or later on the SharePoint Server.
To enable the connector to remotely communicate with the SharePoint Server using PowerShell commands, complete the following on the SharePoint Server computer:
1. Ensure that the WinRM service is running on the SharePoint Server and on the IQService system.
2. Run the following command to enable PowerShell remoting:
```
Enable-PSRemoting -Force
```
3. Run the following command on the SharePoint Server to configure trust between the SharePoint Server system and the IQService system:
```
Set-Item wsman:\localhost\client\trustedhosts "<IQService Host>"
```
4. When IQService establishes a remote PowerShell session with the SharePoint Server, it uses the CredSSP authentication mechanism by default.
  
  Run the following command to set CredSSP as the authentication type for the remote PowerShell session to work on respective computers:
  
  On the SharePoint Server:
```
Enable-WSManCredSSP -Role Server
```
  On the IQService System:
```
Enable-WSManCredSSP -Role client -DelegateComputer "<SharePoint Server System Name>"
```
  With the authentication mechanism set as default, add the Authentication attribute using the REST API.
  
  Note
  
  For more information on SailPoint's REST APIs, refer to Best Practices: REST API Authentication and REST API - Update Source (Partial) in the SailPoint Developer Community.
  
  Note
  
  SailPoint only supports the CredSSP and Default authentication mechanisms.
5. On the SharePoint Server and IQService system, restart the WinRM service for the new settings to take effect:
```
Restart-Service WinRM
```

Supported Managed Systems

The Microsoft SharePoint Server connector supports the following Microsoft SharePoint server versions:

Microsoft SharePoint Server Subscription Edition
Microsoft SharePoint Server 2019
Microsoft SharePoint Server 2016

Required Permissions

User must be a part of the following groups on the SharePoint Server system:
- Remote Desktop Users
- WinRMRemoteWMIUsers
- WSS_ADMIN_WPG
User must have SPShellAdmin access role on all the content databases from the SharePoint Server that this connector must manage. This allows the connector to execute SharePoint cmdlets. Run the following command on the SharePoint Server to give the SPShellAdmin role to the application user:
```
Add-SPShellAdmin -UserName <DOMAIN\UserName> -Database (Get-SPContentDatabase -Identity "WSS_Content")
```
To grant access to all content databases use the following command:
```
Get-SPDatabase | Add-SPShellAdmin DOMAIN\UserName
```
On the SharePoint Server and IQService host, the Application User must have Read and Execute permissions for Microsoft.PowerShell32 and Microsoft.PowerShell. Run the following command on the SharePoint Server and IQService host systems to enable that permission:
```
Set-PSSessionConfiguration -Name "Microsoft.PowerShell32"–ShowSecurityDescriptorUI
Set-PSSessionConfiguration -Name "Microsoft.PowerShell" –ShowSecurityDescriptorUI
```
On the SharePoint Server and IQService system, restart the WinRM service for the new settings to take effect:
```
Restart-Service WinRM
```
The Application User must have access to all SharePoint Web Applications that must be managed by the connector. Create a PowerShell script as follows and execute on SharePoint Management Shell:
```
$webApp = Get-SPWebApplication -Identity "Web App Url"
$webApp.GrantAccessToProcessIdentity("Domain\UserName")
```
Add the above lines for each web application.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.