Skip to content

CyberArk Privilege Cloud Onboarding

This section describes how to connect CyberArk Privilege Cloud to SailPoint Entro. Once connected, Entro reads the identities, groups, Safe permissions, and audit activity from your CyberArk Privilege Cloud and surfaces the service principals it discovers in the NHI Inventory.

Management → Accounts & Integrations → Add New Account (top right) → CyberArk Privilege Cloud

Prerequisites

  • Administrator access to your CyberArk Privilege Cloud, sufficient to create a user and assign permissions

  • Network reachability from the Entro Worker Group (Connector) to your Privilege Cloud REST API endpoint

  • The Privilege Cloud REST API available (standard on Privilege Cloud)

Authentication

Entro authenticates to CyberArk Privilege Cloud using basic authentication (username and password). On each scan, Entro obtains a session token from the Privilege Cloud logon API and refreshes it automatically on expiry. No long-lived shared secret is stored.

Entro supports the following authentication types. Choose the one that matches how the dedicated Entro user is configured in your environment:

Authentication Type When to use
CyberArk The Entro user is a CyberArk-internal user.
Windows The Entro user authenticates against a Windows domain.
LDAP The Entro user is authenticated via an LDAP directory.
RADIUS The Entro user is authenticated via a RADIUS server.

Whichever type you choose when creating the dedicated Entro user in step 1 is the same type you will select on the Entro connection form in step 4.

Connect CyberArk Privilege Cloud to SailPoint Entro

  1. Create a Dedicated CyberArk User for Entro

    • In the Privilege Cloud Portal, create a new user named svc_entro_audit. Refer to the CyberArk documentation for Add and Manage Users.

    • Set the authentication source to match your environment - CyberArk-internal, Windows, LDAP, or RADIUS. This is the Authentication Type you will select when connecting CyberArk Privilege Cloud to Entro.

    • Apply your standard service-account password policy.

    • Do not assign Vault Admin or any write-capable role. Entro requires read and audit access only.

    Important

    Use a dedicated user. Do not reuse an existing admin account - Entro's activity must be auditable as a distinct principal.

  2. Grant the Audit Users Permission

    • Grant the Audit Users vault-level entitlement to svc_entro_audit. This grants the audit privileges Entro needs to enumerate PAM users, groups, and AAM applications, so that GET /API/Users works for ownership correlation.

    • Scoped alternative (if you do not want Entro to see every Safe): Grant Audit Users to svc_entro_audit for user and ownership correlation, then configure Safe-level permissions only on the specific Safes you want Entro to monitor. There is a trade-off for using this method where Service Principals whose access is scoped exclusively to Safes outside of your chosen subset will not appear in the NHI Inventory.

  3. Grant Safe-Level Permissions

    For every Safe Entro should monitor, add svc_entro_audit as a Safe member with the following permission set:

    Permission Purpose
    List Accounts Enumerate the accounts in the Safe so per-account audit activity can be retrieved.
    View Safe Members Discover the users and groups that have access to the Safe and their permissions.
    View Audit Log Retrieve account activity history for service-principal reconstruction.
    Access Safe without confirmation Allow audit operations to proceed without dual-control approval gating.

    To apply at scale, run POST /API/Safes/{SafeUrlId}/Members/ against each Safe, or apply via a CyberArk Safe Membership Policy if your environment supports it.

  4. Connect CyberArk Privilege Cloud to Entro

    In SailPoint Entro, go to Management > Accounts & Integrations > Add New Account > CyberArk Privilege Cloud and complete the following fields:

    • Enter a descriptive Nickname for this integration. For example, CyberArk-PROD.
    • Enter the Base URL of your Privilege Cloud tenant. For example, https://<subdomain>.privilegecloud.cyberark.cloud.
    • From the Authentication Method drop-down, select CyberArk, Windows, LDAP, or Radius. This must match the authentication method you chose when you configured svc_entro_audit.
    • Enter the Domain for the selected authentication method. This is required for Windows, LDAP, and RADIUS; leave empty for CyberArk-internal.
    • In the Username field, enter svc_entro_audit.
    • Enter the Password for the dedicated Entro user.
    • Enter the Worker Group (Connector) that will run the CyberArk Privilege Cloud scans.
    • Select Create Account. Entro validates the connection and begins its first scan.

    Entro authenticates against the Privilege Cloud logon endpoint that corresponds to the selected authentication method:

    Authentication Method Logon endpoint
    CyberArk https://<base-url>/PasswordVault/API/auth/Cyberark/logon/
    Windows https://<base-url>/PasswordVault/API/auth/Windows/logon/
    LDAP https://<base-url>/PasswordVault/API/auth/LDAP/logon/
    RADIUS https://<base-url>/PasswordVault/API/auth/RADIUS/logon/

  5. Validate the Integration

    Within 2-5 minutes of configuring the integration:

    • Go to Management > Accounts & Integrations > CyberArk Privilege Cloud and confirm the integration status displays Verified.

    • Go to Inventory > NHIs and confirm that filtering by integration CyberArk Privilege Cloud shows your discovered service principals, with permissions, vault access, activity, and ownership populated in the drawer.