Entitlements refer to the access rights an account has on a source. They're a key part of identity governance, and they feed into almost everything you do in IdentityNow.
You can run entitlement aggregations to load entitlements into IdentityNow.
Creating and Managing Entitlement Schemas
Each entitlement type has a schema that is used to record its attributes. Most direct connect sources have an entitlement type, complete with a schema, configured by default.
You can edit this schema to better fit the data in your source. If your direct connect source doesn't have an entitlement schema by default, you can create a new one.
Some direct connect sources can support multiple types of entitlements. You can create and manage multiple entitlement types on the following direct sources:
- Web Services
- One or more direct connect sources has been created in your org.
To create a new entitlement type and manage its schema:
From the Admin interface, go to Connections > Sources and select the direct connect source you want to edit.
Go to the Import Data tab and select Entitlement Types.
If you already have one or more types of entitlements for this source, they are listed here.
To create a new entitlement type for this source, select + Create Entitlement Type.
This button is only available for sources without any entitlement types, with the exception of sources that support multiple entitlement types.
Enter the Name of your entitlement type and add a Description.
The name you give your entitlement type should exactly match the name of the entitlement type as it appears on the source. This is sometimes called the native object type.
If you want to include direct and indirect permissions in aggregations that include this type of entitlement, check the box beside Include permissions in aggregations.
If you use Cloud Access Management in your site, and this entitlement type can grant access to a cloud resource, select the Cloud Enabled checkbox.
Your new entitlement type is added to the list.
Select + Add New Attribute to add one or more attributes to this entitlement type's schema.
Add a Name and a Description for this attribute.
The attribute's name should exactly match the value of the entitlement type's attribute on the source.
Under Type, choose the type of value that this attribute will contain.
You can choose string, long, int, or boolean. You can also choose to specify that this entitlement attribute is another entitlement, and if applicable, choose the type of entitlement it is from the types available for this source.
If you choose an entitlement type under Type, the Entitlement checkbox is automatically selected.
To configure this attribute to support multiple values, select the Multi-Valued checkbox.
If you want to add another attribute after saving this one, select the Add Another checkbox.
- When you create the first attribute in an entitlement schema, it is automatically marked as both the Entitlement Name and Entitlement ID. This can be edited later.
- Be sure to select the correct entitlement name and ID before aggregating any entitlements of this type. Changing these attributes later can cause duplicate entitlements to be aggregated.
Repeat step 4 for each attribute you want to include in this entitlement schema.
If necessary, edit which attributes are listed as the Entitlement Name and ID by editing the entitlement type.
To edit an entitlement type:
From the list of entitlement types, select the name of the entitlement type you want to edit to open it.
Select Options > Edit Type.
Make any necessary changes.
On this page, you can select which attributes are used as the Entitlement ID and the Entitlement Name.
If you updated the attributes marked as the Entitlement ID and Name, you'll be asked to confirm your selections. Updating these attributes after aggregating your entitlements can cause duplicate entitlements to be aggregated.
Your entitlement type has been updated.
To delete an entitlement type and its associated schema, select the Delete icon in the Options menu or in the Edit Type overlay.
Deleting an entitlement type does not delete the associated entitlements. Entitlements of that type will not be aggregated or updated until another type is created for them.
Creating an Entitlement Catalog for a Direct Connect Source
If you've already loaded account information into IdentityNow from a source, you've also aggregated all types of entitlements associated with users. To make sure your users have access to everything they need, you should also run an entitlement aggregation separately.
An entitlement aggregation:
- Defines the entire catalog of entitlements associated with the source, regardless of whether they're already associated with accounts.
- Aggregates each entitlement's additional attributes, such as raw entitlement data and relationships with other entitlements.
- Updates entitlements that have already been aggregated.
If an entitlement is aggregated as part of an account aggregation, but IdentityNow doesn't detect it in any entitlement aggregations, the entitlement will be deleted from your site.
Creating an Entitlement Catalog for a Direct Connect Source
You can aggregate entitlements from a direct connect source just as you can aggregate accounts. You can also configure IdentityNow to aggregate entitlements on a schedule.
Prerequisite: Load accounts from a supported source.
To aggregate entitlements from a direct connect source:
In the Admin interface, go to Connections > Sources.
Select a direct connect source.
Go to Import Data > Entitlement Aggregation.
Complete the steps below depending on which type of aggregation you want to perform.
Complete a Manual Aggregation
If your source only has a single type of entitlement, select Start beside Manual Aggregation.
Your aggregation begins immediately and occurs once.
If your source has more than one entitlement, there are additional actions you'll need to take.
- Choose whether to aggregate all types of entitlements or only specific types.
- If you want to aggregate all types of entitlements in your site, select the All Types radio button and select Start. Your aggregation begins immediately.
- If you choose to aggregate specific types of entitlements, select the types of entitlement to aggregate and select the Add button beside the type name. Repeat this process for every type of entitlement you want to aggregate.
- Select Start beside Manual Aggregation. The process begins immediately and occurs only once.
Schedule Recurring Aggregations
From the Entitlement Aggregation page, select the Enable Schedule checkbox.
Choose how often the aggregation should run. You'll see the following options:
If you choose the Daily option, select a time period in the Recurring Every field. This field determines how often the aggregation occurs after the time selected. For example, if you schedule a daily aggregation for 5pm to recur every 4 hours, the aggregation will run only at 5pm and 9pm, depending on the load.
Make the additional required selections under the scheduling option you chose.
If your source has more than one type of entitlement:
- Choose whether you want to aggregate all types of entitlements or only specific types.
- To aggregate all types of entitlements during a scheduled aggregation, select the All Types button and select Save.
- If you chose to aggregate specific types of entitlements, select the type of entitlement to aggregate from the dropdown list and select the Add button beside the dropdown. When you're finished configuring which types of entitlements to aggregate, select Save.
This source will automatically run an entitlement aggregation on the schedule you configured for the entitlement types you selected.
Creating an Entitlement Catalog for a Flat File Source
You can aggregate entitlements from a flat file source by uploading a flat file containing your entitlement data.
It is not possible to schedule recurring entitlement aggregations or configure multiple entitlement types for a flat file source.
Prerequisite: Load accounts from a flat file.
To upload entitlements from a flat file source:
In the Admin interface, go to Connections > Sources.
Select a source that uses a flat file feed.
Go to Import Data > Import Entitlements.
Select Download to download the template.
The file you upload for a source must use the column headings included in the entitlements file template for that source. Column headings differ based on the type of source you're downloading entitlements from.
The most common type of flat file source is a delimited file.
The following columns are required regardless of source type:
- id - the technical ID for the entitlement
- name - the technical name for the entitlement
- displayName - the name for the entitlement that displays in the IdentityNow UI
- description - the description of the entitlement visible in the UI and during certifications
If you need help filling in these columns, contact SailPoint Expert Services.
Either edit your existing entitlements file to include the column headings from the template or populate the entitlements data into the template.
- Entitlements might be aggregated with names and descriptions that are difficult for end users to understand. You can make changes to those fields to enable users to make better decisions when reviewing access requests or certifications.
- The use of emojis in entitlement names and descriptions is not supported – only string values are accepted.
- Multiple entitlement types are not supported in flat file sources.
Save the file.
In the SailPoint Admin interface, select Import.
Select the file from step 6.
Screenshots related to these files are examples only. Excel is not required.
Information about the file is loaded into the Current File section.
After uploading this file, you can download it again to make changes as needed. Go to the Entitlements tab on a source and select Download CSV to download IdentityNow's latest version of the entitlements for this source.
To configure parent/child relationships between entitlements in a CSV file, use the
hierarchyAttribute of the replaceSchema API.
There are a number of places in IdentityNow where you can view the entitlements in your system.
- View all entitlements - To view all the entitlements for all sources in your system, go to Search. Search on the * wildcard, and go to the Entitlements tabs. A complete list of entitlements in your site is displayed.
- View a source's entitlements - In the Admin interface, go to Connections > Sources and select the source you want to view. Go to the Entitlements tab to see a complete list of all entitlements from that source.
- View an identity's entitlements - In the Admin interface, go to Identities > Identity List and select the name of the identity you want to view. On the Accounts tab, select the source you want to view. The identity's entitlements from that source are displayed in the Entitlements tab at the bottom of the page.
Entitlements are an important way of quantifying access in IdentityNow. Because of this, they're used in many features.
You can also mark an entitlement as privileged to draw attention to it during certification campaigns. This flag appears everywhere the entitlement is displayed, including Search and certifications.
Any access profiles that contain a privileged entitlement are also marked as privileged.
To mark an entitlement privileged:
In the Admin interface, go to Connections > Sources, and select the source that contains the entitlements you want to edit.
In the Entitlements tab, select the checkbox next to the entitlements you want to mark as privileged.
Select the Actions dropdown menu and select Mark as Privileged.
This entitlement will display a Privileged flag everywhere it appears in the product.
If you’re seeing an entitlement that doesn’t contain the correct group name or is missing the display name or description, there was probably a problem connecting to the source during an aggregation.
You have the following options for resolving this problem:
- Perform an entitlement aggregation for your source to pull in the display names and descriptions for all entitlements.
- Using the Update Schema API, modify the attribute used as the description attribute for your entitlements. The next time you run an entitlement aggregation for this source, IdentityNow will use the data in this attribute to populate the entitlements' description field.
- Edit the CSV file in the Entitlements tab for your source to fix any incorrect or incomplete entitlement data, and reupload it into IdentityNow.