Skip to content

Integrating SailPoint with Cloudiway

Cloudiway is a cloud migration and coexistence platform used to move and synchronize mail, files, sites, Teams, and groups between Microsoft 365, Google Workspace, and other tenants. Customers work inside the Cloudiway portal: they create a collection (the account workspace), create migration projects under that collection, and invite team members to run and monitor those migrations. Cloudiway exposes portal operators and the role catalog through the Cloudiway REST API. This document provides the instructions required to configure a new direct connection between SailPoint and Cloudiway. For a reference to the terminology specific to SailPoint products, refer to Source and Connector Definitions.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

The Cloudiway connector supports the following:

Account Management

  • Aggregate Users

Entitlement Management

  • Aggregate Roles

Important

Quick Compliance connectors have the following manual aggregation limits within a 24-hour period:

  • Organization Admins: Limited to 3 manual account or entitlement aggregations per day per source. This limit is cumulative across all admins in the organization.
  • Regular Users: Limited to 1 manual account or entitlement aggregation per day per source.

These limits ensure that individual compliance statuses are kept up to date while maintaining continuous compliance monitoring. If you need to run additional aggregations beyond these limits, contact SailPoint Support.

Prerequisites

Before you configure the Cloudiway connector, ensure the following requirements are met:

  • Sign in to the Cloudiway portal.
  • Create a Personal Access Token (PAT):
    1. Go to Account > APIs.
    2. Select New Token, and enter a name for it. This name is required at configuration time - Cloudiway authenticates on the name and the token value together.
    3. Select a project from the dropdown. The token is created in the context of that project.
    4. Set an expiry. Choose a date far enough out that scheduled aggregations keep working.
    5. Copy the token value. Cloudiway shows it once.
  • Copy the Collection ID. Cloudiway does not show the collection id as a labeled field in the UI. To get it:
    1. In the portal, select Create Project.
    2. Look at the browser address bar. The URL includes collectionId, for example: https://portal.cloudiway.com/homepage/project-edit?collectionId=11320
  • Copy and securely store the following details, which are required during connector configuration:
    • Base URL
    • PAT Name
    • PAT Token
    • Collection ID

Note

  • The Cloudiway connector uses Custom Authentication. You do not paste a bearer token into the source. The connector posts the PAT name and PAT token to POST /ap1/Authentication/TechnicalLogin, receives a short-lived JWT, and sends that JWT as Authorization: Bearer <token> on every subsequent call. The connector re-authenticates on each run, so there is no manual JWT refresh - the PAT itself is the credential you maintain, until the expiry date you set when creating the token.
  • All API requests must use HTTPS; unencrypted HTTP calls are not supported and will fail.
  • Credentials should be stored securely and treated like a password.

For more detailed information on Cloudiway API authentication, refer to the official Cloudiway documentation.

Note

The linked document is not maintained by SailPoint and is subject to change without notice.

Required Permissions

Cloudiway uses role-based access at the collection level. Available roles:

  • Viewer - Read-only access. Can view project details, license summary, and migration logs, and monitor progress.
  • Contributor - Can run migrations. Includes everything a Viewer can do, plus start and manage migrations, configure migration settings, and run audits and preprocessing.
  • Administrator - Full access to the collection.
  • SuperAdminCloudiway - Internal Cloudiway role. Not assigned when you invite operators.
  • SalesAdminCloudiway - Internal Cloudiway role. Not assigned when you invite operators.
  • SupportAdminCloudiway - Internal Cloudiway role. Not assigned when you invite operators.
  • ProductionAdminCloudiway - Internal Cloudiway role. Not assigned when you invite operators.
  • SupportCloudiwayL2 - Internal Cloudiway role. Not assigned when you invite operators.