Integrating SailPoint with Slack SaaS

Slack is a proprietary business communication platform developed by Slack Technologies. Slack allows communities, groups, or teams to join a workspace through a specific URL or invitation sent by a workspace administrator or owner.

Connecting SailPoint to your Slack system allows you to manage the Slack user accounts. This guide is designed to provide information about the necessary requirements and definitions needed to get a working instance of a Slack SaaS source.

The connector also aggregates Slack Bots as machine accounts on this source when your organization is entitled to Machine Identity Security and you configure a Bot User OAuth Token. The connector discovers the bots from the Slack Web API. Human Slack users, groups, channels, and workspaces continue to use the existing SCIM connection. The connector does not aggregate Slackbot (USLACKBOT), and it does not support create, update, or delete operations for Slack bots.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

The Slack source supports the following features:

Important

Before you can use any of the following items marked with an asterisk (*), SailPoint must activate the feature for your site.

Aggregate Slack users, groups, and channels
*Provision Slack users
*Access Certifications (certification of entitlements connected to accounts)
*Password Management
API Rate Limit: Imposed rate limits with a retry mechanism are supported. The aggregation and provisioning operations continue after reaching the rate limit of the Slack API.

For more information on features, refer to Source Features.

The Slack source supports multiple group objects. The group objects are groups and channels.

Accounts

Feature	Users
Create, Update, Delete	✔
Aggregate	✔
Password Management	✔
Enable, Disable	✔
Group Entitlements (Read, Request, Revoke)	Groups, Channels

Group Entitlements

Group Entitlements are the entitlement types for which SailPoint provides the ability to aggregate additional details (of the entitlement types) from the managed system. These objects have a separate schema defining list of attributes that the aggregation task fetches (as additional details) when aggregation is run for the Group Entitlement type.

Feature	Groups	Channels
Aggregation	✔	✔

Slack 'Group' group object: a group of users.

User Group: a group of members in a single workspace that need to be notified.

Channel: consists of details such as the number of members, ID, and name of the channel along with the timestamp of when the channel is created.

Channel management: involves actions such as viewing a list of channels in a workspace and taking action, if required.

Non-Human Identity Discovery

Slack Bots (machine accounts)

The connector uses native Dataset 2.0 aggregation to collect Slack app bot users as machine accounts in the Slack Bots dataset. This aggregation is read-only, so the connector does not create, update, or delete Slack bots.

To aggregate Slack Bots, your organization requires Machine Identity Security. Select the Enable Slack Machine Accounts toggle and enter a Bot User OAuth Token. For more information, refer to Machine Identity Governance Settings and Supported Datasets.

Refer to Dataset Management for more information.

Refer to Discovering Potential Non-Human Accounts for more information.

Exposed Credentials

The Slack SaaS connector supports scanning for exposed credentials on Slack Business Plus.

Configure the Slack SaaS source with the User OAuth Token and Bot User OAuth Token from a private Slack app that has the required user and bot scopes. For the required scopes, refer to Required Permissions.

Supported Slack Platforms

Slack Business Plus Plan
Slack Enterprise Grid Plan

Activity Insights

Activity Insights supports activity from Slack and its associated accounts. This allows you to gather account information and activity data from Slack.

Important

Contact your SailPoint Customer Success Manager (CSM) for more information on Activity Insights. For more information on configuring Activity Insights, refer to Activity Insights Settings.

Password Management

If Password Management is enabled for your organization, you can change the password for a user of the source. After enabling password management on the source, be aware of the following:

The password policy defined in SailPoint applies to accounts on this source.
If you change the password for an application connected to this source, the change will automatically be made to the source itself.

For more information on configuring password management, refer to Password Management Overview.

Required Permissions

The Slack Connector requires the following permissions and considerations:

The service account that accesses the Slack APIs must be an administrator user in the Slack managed system.
On Slack-Plus, only the Slack owners can generate a token to use the SCIM API. The account that generates a token must remain an owner to make SCIM updates.
Org-wide apps must be installed by an administrator or owner of an Enterprise Grid organization. Additionally, the app must be installed on the entire org, not just an individual workspace.

Slack Business Plus Requires the Following Permissions

User token scopes:

admin - Administrator of a workspace.
channels:read - View basic information about public channels in a workspace.
channels:write - Manage a user's public channels and create new ones on a user's behalf.
groups:read - View basic information about a user's private channels.
groups:write - Manage a user's private channels and create new ones on a user's behalf.
im:read - View basic information about a user's direct messages.
mpim:read - View basic information about a user's direct messages.
users:read - View the people in a workspace.
users:write - Set a user's presence.

Bot token scopes:

users:read - View the people in a workspace.
users:read.email - View email addresses of the people in a workspace.

Slack Bots Aggregation Permissions

The existing SCIM and administrator scopes remain unchanged. To aggregate Slack Bots as machine accounts, grant the Slack app the following bot token scopes:

Scope	Purpose
`users:read`	List workspace members and identify bots through `is_bot` and `profile.bot_id`.
`users:read.email`	Read the workspace administrator email for `slackAdministratorEmail`.
`team:read`	Read the workspace name and domain through `team.info`.

Important

Reinstall the Slack app after you add these scopes. Slack reissues the tokens, so update the source with the new Bot User OAuth Token.

Slack Enterprise Grid Requires the Following Permissions

Channel management requires the following permissions:

An account must be a Workspace owner or administrator.
OAuth requires the following for an account to manage channels:
- admin
- admin.users:write
- channels:read
- channels:write
- admin.conversations:read
- admin.conversations:write
- users:read.email
Note

The channels:write and admin.conversations:write permissions are required only for provisioning operations.

Workspace management requires the following permissions:

An account must be a Workspace owner or administrator.
Bot and OAuth requires the following for an account to manage Workspaces:
- admin.teams:read
- admin.teams:write - Required to make changes on a Workspace.
- admin.users:read - Required to access a Workspace's profile information.

Prerequisites

You have the Slack-Plus plan (single workspace).

Note

SCIM APIs for Slack are available only with the Slack-Plus plan.
Generating an OAuth Token Required to Access the Slack API: For the Slack source, users are the members of a workspace and must have a valid OAuth token with required permissions. All the operations by users are performed through SCIM based APIs. An OAuth token with admin level privileges must be used to access the APIs. For more information, refer to API Token Generation.
Make sure you select org-wide while installing the Slack app to have permissions on the org level.
The App should have admin permissions on the User token.
Perform the following steps to provide access for all workspaces to the issued user token:
1. Go to Enterprise Grid > Manage Organization > Installed Apps > Add to more workspaces.
2. Select all the workspaces and then select Save.

Generating an OAuth API Token

An OAuth API token with the admin scope is required to access the Slack SCIM API.

To acquire the OAuth API token an organization owner must:

create a new Slack application
add the admin OAuth scope
install the application
use the generated token

Perform the following steps to generate an OAuth API token:

Create a new Slack application as an admin on a Workspace. For more information, refer to Creating, managing, and building apps.
Configure the permissions to allow your application to interact with the Slack API by adding the admin OAuth scope in the User Token Scopes.
Install the Slack application. For more information, refer to Installing and distributing apps.
Use the generated OAuth Access token.

Note

If you intend to build a Slack application for other teams to install, your application will be required to properly handle the OAuth flow to generate the correct token.

Additional Information

The API token must be included through an Authorization header with a type of Bearer when calling any of the SCIM methods. Provide a JSON request body for POST, PUT, and PATCH write operations, and then set HTTP Content-type header to application/json.

For example, the SCIM call can be as follows:

GET /scim/v1/Users?count=1000 HTTP/1.1
Host: api.slack.com
Accept: application/json
Authorization: Bearer xoxp-4956040672-4956040692-6476208902-xxxxxx

Slack Bots Aggregation

Keep the existing SCIM API Token (xoxp-) steps, and then complete the following prerequisites to aggregate Slack Bots as machine accounts.

Use a Slack app that includes a bot user.
Grant the bot the scopes listed in Required Permissions.
If the app already exists with only the SCIM user token, reinstall the app after you change the scopes, and then consent again. Slack reissues the tokens, so update the source with the new Bot User OAuth Token.

Copying the Bot User OAuth Token

To copy the Bot User OAuth Token:

Go to https://api.slack.com/apps, and then open your Slack app.
Go to Features > OAuth & Permissions.
Install the Slack app to the workspace.
Copy the Bot User OAuth Token. The value starts with xoxb-.
Keep the existing User OAuth Token (xoxp-) in the API Token field of the source. SCIM still requires this token.

Caution

Treat the Bot User OAuth Token as a secret. Do not paste the token into tickets or screenshots.

If your organization is entitled to Agentic Identity Governance, you can enter the token during Express Setup or on Machine Identity Governance Settings. Both locations use the same configuration keys.

Enterprise Grid: Workspace Approval

On Enterprise Grid, approve the Slack app in every workspace whose bots you want to aggregate. The connector does not aggregate bots in workspaces where the app is not approved.

Onboard Slack SaaS with SailPoint Agentic Fabric (SAF)

SailPoint Agentic Fabric (SAF) provides an automated, guided onboarding experience to connect your Slack environment to SailPoint. SAF automatically creates, deploys, and configures the Slack SaaS source in SailPoint, reducing the manual setup steps. After onboarding, the source is ready for aggregation and governance.

For detailed onboarding instructions, prerequisites, and supported deployment models, refer to Connecting Sources.

Important

To enable advanced governance capabilities for Slack resources and AI agents, an active SailPoint Agentic Fabric Advanced Governance license is required. Contact your SailPoint Customer Success Manager to request access and for more information.

Generating an OAuth API Token Integrating Password Management Prerequisites Required Permissions SaaS Slack SaaS Supported Features

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.