Skip to content

Integrating SailPoint with Celonis

Celonis is a process mining and execution management platform that helps organizations analyze, monitor, and optimize their business processes. This document provides instructions to configure a new direct connection to a Celonis source. For a reference to the terminology specific to SailPoint products, refer to Source and Connector Definitions.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

The Celonis connector supports the following:

Account Management

  • Aggregate Users

Important

Quick Compliance connectors have the following manual aggregation limits within a 24-hour period:

  • Organization Admins: Limited to 3 manual account or entitlement aggregations per day per source. This limit is cumulative across all admins in the organization.
  • Regular Users: Limited to 1 manual account or entitlement aggregation per day per source.

These limits ensure that individual compliance statuses are kept up to date while maintaining continuous compliance monitoring. If you need to run additional aggregations beyond these limits, contact SailPoint Support.

Prerequisites

Ensure the following prerequisites are met before proceeding with the configuration:

  • A Celonis Platform team with the Team API enabled and an OAuth 2.0 client application created from Team Settings > Applications.
  • The OAuth client must be configured for the Client Credentials grant type.
  • The OAuth client must be granted the team.user-group-info:read and team.login-history:read scope and assigned a platform role that allows reading the team’s members (for example, a member role on the team).
  • The following credentials and URLs are required to set up the source:
    • Base URL of the Celonis team.
    • Token URL of the Celonis team.
    • Client ID of the OAuth 2.0 application.
    • Client Secret of the OAuth 2.0 application.
  • An administrator account in your SailPoint tenant to create and configure the source.
  • For more information about OAuth client registration and Team APIs, refer to the following resources:

Required Permissions

  • Only a Celonis Platform team administrator can go to Admin & Settings > Applications to create a new OAuth client (Add new application > OAuth Client) and obtain the Client ID and Client Secret.
  • The connector calls the Celonis Team API, which requires the OAuth client to request the team.user-group-info:read and team.login-history:read scope at token-generation time. Without this scope on the issued access token, the Celonis Team API returns HTTP 403 and account aggregation cannot proceed.
  • In the Celonis Platform, assign the OAuth client the User Group Info API permission so the team.user-group-info:read scope can actually access the underlying members data.
  • For convenience, the connector ships with the scope value team.user-group-info:read team.login-history:read, so granting team.login-history:read (Team Login History API) in addition to User Group Info is optional but supported.
  • For more information about authentication and API endpoints, refer to the following resources:

Note

The linked document is not maintained by SailPoint and is subject to change without notice.