# SailPoint Identity Services > SailPoint Identity Services Documentation # Identity Security Cloud # SailPoint Identity Services Identity governance is about enforcing and maintaining least privilege access, where every identity has the access needed, when it’s needed. Explore the administrator help for our SaaS products to get the most out of your identity governance practice and meet your security and compliance needs. We also provide [user documentation](https://documentation.sailpoint.com/saas/user-help/index.html) to support your non-admin users. You can use the SailPoint Solutions Center icon in the upper-left corner to quickly access your other SailPoint products. Access Requests Access\ Certifications Password\ Management Provisioning Separation of\ Duties Recommendations Access\ Insights Access\ Modeling Application\ Onboarding Machine Identity\ Security Agent Identity\ Security Identity Graph # Getting Started in Identity Security Cloud Welcome to SailPoint! To get the most out of SailPoint's SaaS offerings, review the following information about setting up your site for the first time. Note Identity Security Cloud is SailPoint’s next-generation identity security solution. It encompasses and builds on features and functions from IdentityNow. The product documentation covers both Identity Security Cloud and IdentityNow features. ## Register a Device If you are signing into Identity Security Cloud using an identity provider (IdP) for the first time, you will be asked to configure an external authenticator immediately after signing in. This is a one-time requirement that will ensure you can access SailPoint if you need to bypass SSO, like with [emergency admin accounts](https://documentation.sailpoint.com/saas/help/setup/ea_admin.html). Refer to [Registering a Time-Based One-Time (TOTP) Device](https://documentation.sailpoint.com/saas/help/common/strong_auth.html#registering-a-time-based-one-time-password-totp-device) for more information. ## Add Initial Administrators Before you can begin setting up your site, you'll need one or more emergency access administrators. - [**Updating Emergency Access Administrators**](https://documentation.sailpoint.com/saas/help/setup/ea_admin.html) Emergency access administrators can sign in to your site even if your connectivity is interrupted, which allows them to make changes and troubleshoot your site to get it working again. When you're first given access to your new tenant, SailPoint has already created one of these administrators for you, which you'll use to sign in and add more admins. ## Load Data Identity Security Cloud manages your identity and access data, but that data comes from sources. You can connect those sources to Identity Security Cloud and link together accounts that belong to the same person in the form of an identity. - [**Identity Security Cloud SaaS Connectors**](https://documentation.sailpoint.com/connectors/isc/landingpages/help/landingpages/isc_landing.html) If you want to upload data to Identity Security Cloud from a source without a virtual appliance cluster, use a SaaS connector. - [**Create Virtual Appliances**](https://documentation.sailpoint.com/saas/help/va/get_started_va.html) If you want to directly connect to any of your sources to load account data, you'll need a virtual appliance (VA). Virtual appliances allow you to connect your tenant to your sources without compromising your firewall. ### Create Identities An identity serves as a way to store all of a user's account and access data in a single place. - [**Create Initial Sources**](https://documentation.sailpoint.com/saas/help/sources/config_sources.html) Many organizations have a few sources that, together, have records for every user in the organization. These might be HR or directory sources, and they should be created first so that their data is considered the highest priority. You can create other sources later. Review our [supported sources](https://documentation.sailpoint.com/connectors/isc/landingpages/help/landingpages/isc_landing.html) so you can choose the best sources for your environment. - [**Create Identity Profiles**](https://documentation.sailpoint.com/saas/help/setup/identity_profiles.html) Creating an identity profile turns a source into an authoritative source. It also means that any accounts aggregated from this source become identities, and any other accounts aggregated for those users can be associated with their identities. - [**Load Initial Accounts**](https://documentation.sailpoint.com/saas/help/accounts/loading_data.html) Load accounts from those sources. This is also known as an aggregation. ### Load Other Account and Access Data Once you've created the identities for your organization, you can add information about their other accounts and access. - [**Create Additional Sources**](https://documentation.sailpoint.com/saas/help/sources/config_sources.html) Configure connections to the rest of the sources in your environment and [load accounts](https://documentation.sailpoint.com/saas/help/accounts/loading_data.html) from those sources. - [**Correlate Accounts to Identities**](https://documentation.sailpoint.com/saas/help/accounts/correlation.html) Each account you aggregate can be associated with one of the identities you created earlier, so all of their accounts and access can be viewed in one place. - [**Load Entitlement Data**](https://documentation.sailpoint.com/saas/help/access/entitlements.html) Aggregate the access data from each of your sources so that those entitlements can be managed. ## Configure Security Settings You'll want to make sure that every time an identity in your site signs in, they're the right person and they're allowed to do so. You can configure any or all of the following measures to help keep your site safer: - [**Set Up Strong Authentication**](https://documentation.sailpoint.com/saas/help/common/strong_auth.html) Strong authentication, sometimes called multifactor authentication, requires users to prove their identity before they can change their password. - [**Configure Network and Location Settings**](https://documentation.sailpoint.com/saas/help/access/restrict_access.html) You can block or allow users who are signing in from specific locations or from outside of your network. - [**Configure Lockout Settings**](https://documentation.sailpoint.com/saas/help/setup/lockout.html) Decide how many times a user can enter an incorrect password before they're locked out of the system. - [**Configure Session Lengths**](https://documentation.sailpoint.com/saas/help/setup/lockout.html) Decide how long a user can stay signed in to your tenant without reauthenticating, and how long they can be idle before they're signed out. ## Configure SailPoint’s Cloud Services Now that the framework of your site has been set up, review the documentation about each cloud service you've subscribed to for more information about configuring each feature. - [**Access Request**](https://documentation.sailpoint.com/saas/help/requests/index.html) - [**Certifications**](https://documentation.sailpoint.com/saas/help/certs/index.html) - [**Password Management**](https://documentation.sailpoint.com/saas/help/pwd/index.html) - [**Separation of Duties**](https://documentation.sailpoint.com/saas/help/sod/index.html) You can track the status of Identity Security Cloud and its services at [status.sailpoint.com](https://status.sailpoint.com/). You can also review the documentation for some of SailPoint's other products that can be integrated with Identity Security Cloud. - [**Access Risk Management**](https://documentation.sailpoint.com/access-risk-mgmt/help/) - [**AI-Driven Identity Security**](https://documentation.sailpoint.com/saas/help/ai/index.html) ## Invite Users Finally, if you've decided that your users should have access to your site to review certifications, manage their passwords, or complete other tasks, you can [invite them](https://documentation.sailpoint.com/saas/help/common/users/inviting_users.html) to Identity Security Cloud. After you've completed your initial setup, you're ready to dive into the more detailed aspects of [managing identities](https://documentation.sailpoint.com/saas/help/identities/identity_mgmt.html) and [governing their access](https://documentation.sailpoint.com/saas/help/access/index.html). ## Using the Resource Center The Resource Center provides a collection of resources to help administrators learn about, set up, and use the features and capabilities of Identity Security Cloud. The **Resource Center** icon is displayed at the top right of the screen. Select the icon to open the Resource Center to: - Access product documentation. - View product tours with in-app guides for common features. - Access the customer support portal to view knowledge articles and report issues with your service. - Find announcements about new product updates. A badge is displayed when new announcements are available. - View other helpful resources including service health status and training. Tip To dismiss the announcements badge, open the Request Center and view the product updates. ## Monitoring Your Tenant Once your site has been set up, you can track the activity that takes place in your tenant in a variety of places. You can review your options for monitoring your site's activity in [Audit Reports and Monitoring](https://documentation.sailpoint.com/saas/help/common/audit-reports.html). Some basic information also appears on your [home page](https://documentation.sailpoint.com/saas/help/getting_started/dashboard.html). ## Viewing Organization Details and Licensed Features Once your site has been set up, go to **Admin > System Settings > Product Licenses** to view licensing and organization details about your tenant, including: - **Organization Details - Identities** - Lists the total number of identities permissible in the tenant. This includes identities in all [lifecycle states](https://documentation.sailpoint.com/saas/help/provisioning/lifecycle.html). - **Organization Details - Org Name** - The identifier for your org. The org name is unique to your tenant. - **Organization Details - Region** - The location of your org. Several individual orgs may share regions. - **Active Licenses** - Lists all features licensed for use in the tenant. This includes enabled and disabled features. - **Inactive Licenses** - List all features available in the tenant that are not licensed. For more information about product licensing, including enabling additional features, contact your Customer Success Manager. # Managing Dashboards When you first authenticate into Identity Security Cloud, you see MySailPoint, a landing page where you can track important information about your account and tenant. The Home dashboard is displayed. The Home dashboard is your default dashboard. All users have access to a personal Home dashboard that can be customized. Refer to [Understanding Dashboards](https://documentation.sailpoint.com/saas/user-help/getting_started/dashboard.html) in the user documentation for more information about how non-admins can interact with their dashboards. Administrators can create an additional personal dashboard to track important information. You might have access to additional personal or shared dashboards based on your [license](https://documentation.sailpoint.com/main_landing_page/customer_agreements.html). What is displayed on each dashboard depends on the user's permissions and the type of dashboard. | | Home | Personal | Shared | | ----------------- | ------------- | ------------- | ---------------------------------------------------------- | | Visible to Users | Tiles Widgets | N/A | Tiles Widgets, if the dashboard has been shared with them. | | Visible to Admins | Tiles Widgets | Tiles Widgets | Tiles Widgets | Caution [Data segmentation](https://documentation.sailpoint.com/saas/help/segmentation/index.html) does not apply to the [Identity Graph](https://documentation.sailpoint.com/saas/help/identity_graph/index.html) dashboard widget. Users with access to the Identity Graph widget will be able to view all access objects and identities in your tenant, even if data segmentation is enabled. ## Using Personal Dashboards You can add and remove widgets from all of your personal dashboards, including the Home dashboard. You can also edit the tiles that are displayed on your Home dashboard. Notes - Tiles can't be added to personal dashboards besides the Home dashboard. - End users can't see widgets on the Home dashboard or create additional personal dashboards. You can move the tiles and widgets on all personal dashboards, including the Home dashboard. Drag and drop the widget or tile to where you want it to be on the page. ## Managing the Home Dashboard When you first authenticate into Identity Security Cloud, the Home dashboard is displayed. This is a type of personal dashboard. The Home dashboard is the default page users see when they initially sign in. Administrators can update the default Home Page available to everyone. Administrators can also customize the Home Page that displays by default to everyone, and all users can customize their view of the Home Page. ### Editing Your Home Dashboard At the top of the dashboard, you can see a set of tiles representing basic information about your work in Identity Security Cloud. Administrators can also see a set of widgets on your Home dashboard. These widgets contain details about the features you use in Identity Security Cloud. Widgets can contain actions you can take, a history of recent activity, or statistics about your tenant. Administrators can edit their Home dashboards using the steps below. For more details about the customizations end users can make to their Home dashboards, refer to [Understanding Dashboards](https://documentation.sailpoint.com/saas/user-help/getting_started/dashboard.html). Editing your personal Home dashboard doesn't change other users' dashboards. Refer to [Using Default Home Pages](#using-default-home-pages) for details on customizing the default home pages available to users. Note End users cannot see widgets on their Home dashboard. You can add widgets and tiles to your Home dashboard to see the information most relevant to you. 1. From the Home dashboard, select the **Edit** icon . The Home dashboard can't be deleted. Its name and description can't be changed. 1. On the **Available Tiles** tab, choose any additional tiles to add to your Home dashboard. 1. On the **Available Widgets** tab, choose any additional widgets to add to your Home dashboard. Select a product name on the left side of the panel to review the widgets available with information related to each product. Your changes are saved automatically as you edit the dashboard. You can see the widgets and tiles that you have added to the Home dashboard by selecting **Current Tiles and Widgets**. When you are finished making changes, you can display this dashboard on MySailPoint by selecting **View**. ### Creating Personal Dashboards You can create up to 4 custom personal dashboards. Note Only the Home dashboard can contain tiles. **To create a new personal dashboard:** 1. On the Home dashboard, select **Dashboards**. 1. On the My Dashboards page, select **Create Dashboard**. 1. Enter a Name and Description for your dashboard. 1. Select **Save**. 1. Select **Continue**. 1. Select the **Add** button beside the widgets you want to add to this dashboard. Select a product name on the left side of the panel to review the widgets available with information related to each product. As you make your selections, your dashboard is saved automatically. 1. When you are finished adding widgets to your dashboard, select **View** to see the dashboard in its entirety. You can change which dashboard you are viewing by selecting a dashboard beside Current Dashboard in MySailPoint. ### Viewing and Editing Personal Dashboards You can view and edit the personal dashboards you've created. 1. From MySailPoint, select **Dashboards**. 1. Select **Edit** beside the dashboard you want to edit. You can also select **View** to display the dashboard on MySailPoint, or select the **Delete dashboard** to delete any personal dashboard besides the Home dashboard. 1. Make any necessary changes to the details of the dashboard. 1. Select **Save**. 1. You can also add new widgets from the **Available Widgets** tab, or remove widgets on the **Current Widgets** tab. Your changes are saved automatically as you edit the dashboard. When you are finished making changes, you can display this dashboard on MySailPoint by selecting **View**. ## Using Default Home Pages Default home pages are pre-configured dashboards available to users depending on their user level. The following default home pages are available: - **Home Page** - The default landing page for end users when they sign in, unless they have marked a different dashboard as a [favorite](https://documentation.sailpoint.com/saas/user-help/getting_started/dashboard.html#using-managed-dashboards). - **Admin Overview Dashboard** - General information for administrators, with widgets that match the information found on the Admin Overview page. You can access this dashboard by [selecting](https://documentation.sailpoint.com/saas/user-help/getting_started/dashboard.html) it from the list of dashboards within MySailPoint. You can customize what is displayed on your default home pages. Refer to [Using Your Home Dashboard](https://documentation.sailpoint.com/saas/user-help/getting_started/dashboard.html#using-managed-dashboards) for more information. ## Using Shared Dashboards You can have up to 20 shared dashboards in your tenant. Shared dashboards are assigned to end users through an entitlement associated with the dashboard. Shared dashboards can be accessed and edited by any administrator. ### Creating Shared Dashboards Shared dashboards can be assigned to end users to give them access to important information. **To create a shared dashboard:** 1. On the Home dashboard, select **Dashboards**. 1. Select **Shared Dashboards > Create Shared Dashboard**. 1. Enter a Name and Description for your dashboard. 1. Select **Save**. Identity Security Cloud begins generating an entitlement for this dashboard so that it can be shared. This might take several minutes. 1. Select **Continue**. 1. On the Available Widgets page, select **+ Add** beside the widgets you want to add to this dashboard. 1. When you are finished adding widgets to your dashboard, select **View** to see the dashboard in its entirety. The dashboard has been created and it can be [shared](#granting-access-to-shared-dashboards) with other users once its associated entitlement has been created. ### Granting Access to Shared Dashboards To grant end users access to a shared dashboard, assign them the entitlement that was generated when the dashboard was first created. Note All users that are granted the entitlement associated with a dashboard can see all widgets contained in the dashboard, regardless of their user level. The entitlement is given the same name as the dashboard. This can be edited later. The entitlement can also be accessed from the Shared Dashboards list by selecting **View Entitlement** beside the dashboard. Users can be assigned this entitlement in any way that entitlements are granted. For example: - The entitlement can be added to an access profile that is marked as [requestable](https://documentation.sailpoint.com/saas/help/requests/config_ap_roles.html#configuring-access-profiles-for-requests), and users can request access to it. - The entitlement can be added to a [role](https://documentation.sailpoint.com/saas/help/access/roles.html) that is [assigned](https://documentation.sailpoint.com/saas/help/provisioning/role_assignment.html) to users automatically. - The entitlement can be added to an access profile that is added to a [lifecycle state](https://documentation.sailpoint.com/saas/help/provisioning/lifecycle.html) and assigned to users automatically. ### Editing Shared Dashboards You can edit shared dashboards after they've been created. 1. On the Home dashboard, select **Dashboards**. 1. Select **Shared Dashboards**. 1. Find the dashboard you want to edit and select **Edit**. 1. In **Details**, make the necessary changes to your dashboard's name and description. 1. Select **Save**. 1. Use the **Available Widgets** tab to add new widgets to the dashboard. Use the **Current Widgets** tab to remove widgets from the dashboard. Note Your widget changes are saved as you edit and are visible to users the next time they view or refresh the dashboard. If you want to delete a dashboard, select the **Delete** icon from the list of shared dashboards. If you delete a shared dashboard, the entitlement associated with it is also deleted and removed from users. ## Dashboard Templates Dashboard templates are pre-built dashboards that you can edit to change the default home pages displayed to end users or create new personal or shared dashboards. ### Customizing Default Home Pages The default home pages can be customized by creating a dashboard from the home page templates. Dashboards created from these templates overwrite the default Home Page available to users or the Admin Overview Dashboard. Refer to [Using Default Home Pages](#using-default-home-pages) for information on the available home pages. **To customize the default home pages:** 1. From MySailPoint, select **Dashboard Manager**. 1. Select **Templates > Home Page Templates**. 1. Select **Create Dashboard** beside the home page you want to customize. 1. A preview of the dashboard is displayed. You can reorder widgets and tiles by dragging and dropping them. You can also add and remove widgets and tiles by selecting **Edit**. 1. Select **Save**. Caution Changes to a default home page overwrite the configuration for all assigned users, including their personal customizations. Users can customize the dashboard again after you update it. Your edits to the selected default home page are applied to all users who can access it. You can make additional changes to this home page by going to **Managed Dashboards > Default Home Pages** and editing the applicable dashboard, or by editing the home page template and overwriting the default dashboard. ### Using Feature Templates You can also create personal or shared dashboards starting from a defined set of widgets using templates. Feature templates contain widgets related to a specific feature. You can create a dashboard based on these templates and add or remove widgets to meet your needs. **To create a dashboard based on a template:** 1. From MySailPoint, select **Dashboard Manager**. 1. Select **Templates > Feature Templates**. A list of dashboard templates is displayed. You can select **Preview** to view the template before using it to create a dashboard. 1. Select **Create Dashboard** beside a template and choose whether to create a personal dashboard or a shared dashboard. 1. Enter a name and description for your new dashboard and select **Save**. 1. Select **Available Widgets** and select **Add** beside the widgets you want to add to your dashboard. You can select additional SailPoint products to see widgets related to those products. Your changes are saved as you work. 1. Select **View** to go to your new dashboard, or select the **Close** icon to return to MySailPoint. 1. (Optional) If you created this dashboard as a shared dashboard, [edit the entitlement](#granting-access-to-shared-dashboards) used to share this dashboard with users. # SailPoint Virtual Appliances In order to securely communicate with your organization's systems, SailPoint uses Virtual Appliances (VAs) to connect your tenant and on-premises applications. A VA is a Linux-based virtual machine that connects to your sources and apps using SailPoint APIs, connectors, and integrations. Note Cloud applications are considered "on-premises" because they are private clouds reserved for use only by your organization. The VA is provided as a virtual disk image. Each VA is deployed on your infrastructure and managed by SailPoint. SailPoint maintains, patches, and upgrades the VA software. SailPoint doesn’t connect directly to the VA, so each VA must be able to make continuous outbound-only calls to the cloud environment to execute actions such as: - Polling the cluster queue for requested actions like data aggregation and access provisioning - Installing patches - Updating images To use SailPoint VAs, you must: - Procure the hardware or hypervisor necessary to host the VA image - Ensure proper connectivity to the cloud - Monitor your VA health Note For a list of the services that run on the virtual appliance, refer to the [Virtual Appliance Troubleshooting Guide](https://community.sailpoint.com/t5/IdentityNow-Connectors/Virtual-Appliance-Troubleshooting-Guide/ta-p/78735) using your SailPoint Compass login. # Configuring Virtual Appliances There are three virtual appliance (VA) configuration options: standard, HTTP proxy, and network tunnel. You can also optionally enable transport layer security for encrypted communication. ## Standard VA Configuration Standard is the default VA configuration option, as it allows the VA to connect to SailPoint and other required endpoints directly through the firewall. ### Standard VA Considerations - There is no additional setup required to achieve connectivity after the network requirements are met. - You will have to [add URLs to the allow list](https://documentation.sailpoint.com/saas/help/va/requirements_va.html#allowing-va-traffic-to-required-urls). - SailPoint reserves the 10.255.255.241/28 IP range. If any sources reside in this range, traffic will not route properly. ### Configuring Standard VAs To configure standard VAs, refer to [Creating Virtual Appliances](https://documentation.sailpoint.com/saas/help/va/deploy_va.html#creating-virtual-appliances). ## HTTP Proxy VA Configuration This configuration option requires additional setup to achieve connectivity through a previously configured proxy service. The VA connects to SailPoint and other required endpoints through the proxy. ### HTTP Proxy VA Considerations - All HTTP/HTTPS traffic (VA communication, updates, internal or external) is routed through the proxy. - SailPoint reserves the 10.255.255.241/28 IP range. If any sources reside in this range, traffic will not route properly. - This configuration is not compatible with the network tunnel configuration. - Traffic to external sources such as Salesforce, Box, ServiceNow, Office365, GoogleApps, GoToMeeting, WebEx, and Workday is also routed through the proxy. You may be able to allow traffic to these external sources; consult your network administrator for more information. - The connection from the VA to the proxy can be authenticated only if your proxy supports basic authentication over the connection string. If not, the connection must be unauthenticated. We do not currently support other authentication mechanisms. However, adding IP address sources to the allow list may be used. - You will have to [add URLs to the allow list](https://documentation.sailpoint.com/saas/help/va/requirements_va.html#allowing-va-traffic-to-required-urls). ### Configuring HTTP Proxy VAs After you have downloaded the VA image and copied it to your virtualization platform, complete the following steps to configure the HTTP proxy and create a VA: 1. Start the VA image. 1. [Download the `proxy.yaml` file](https://community.sailpoint.com/t5/IdentityNow-Connectors/Virtual-Appliance-HTTP-Proxy-Configuration-proxy-yaml-File/ta-p/74866) (SailPoint Compass login required), and copy it to `/home/sailpoint/`. 1. Uncomment the https and http lines and replace the `` and `` values. A space is required after `https_proxy:` and `http_proxy:` but before the URL. `https_proxy: http://:/` `http_proxy: http://:/` Where `` is either a host name or IP address. Typically both the http and https lines will point to a single server. Important If you choose to use the HTTP proxy VA configuration in a cloud environment, be sure to allow traffic to all required URLs and avoid connectivity to the cloud environment's metadata API. The typical metadata IP address is 169.254.169.254, but it is not standard across cloud environments. Important If you have a host that needs to be reached directly over HTTP/HTTPS, you can bypass the proxy configuration by adding an exception to the `proxy.yaml` file. For example, you might have a custom connector that needs to reach locally-hosted APIs. In this case, add the following line to the `proxy.yaml` file: `no_proxy: |` Where `` can either be a domain or an IP address. This can contain any number of hosts separated by pipe (|) symbols. 1. Save the `proxy.yaml` file and exit the editor. 1. Sign in to the VA with User Name: sailpoint, Password: S@ilp0int, and then change the password immediately. 1. Enter the command to set up your passphrase: `va-bootstrap set-passphrase --http-proxy --https-proxy ` The value of keyPassphrase must be identical for every virtual appliance in the cluster. The keyPassphrase cannot start with a special character, and cannot include !, /, , or spaces. The VA automatically encrypts the keyPassphrase. Encrypted keyPassphrases are denoted by a leading set of colons (::::). 1. Enter the command to get a pairing code: `va-bootstrap pair --http-proxy --https-proxy ` 1. Enter the pairing code within 4 hours and select **Pair**. 1. Wait about 30 minutes for configuration to finish. When VA configuration is complete, the VA Status will change to Connected. ## Network Tunnel VA Configuration If you are required to add outbound traffic to the allow list, and your firewall does not support domain entries, consider using a network tunnel configuration. This option requires additional setup for the VA to connect to SailPoint and other endpoints through network tunnel servers. For considerations and configuration information, refer to [Virtual Appliance Network Tunnel Configuration](https://community.sailpoint.com/t5/IdentityNow-Connectors/Virtual-Appliance-Network-Tunnel-Configuration/ta-p/274648) using your SailPoint Compass login. ## Transport Layer Security Transport Layer Security (TLS) is recommended for encrypted communication between VAs and sources that support it. To enable TLS for a supported source: 1. In your tenant, go to **Admin > Connections > Sources**, and select your supported source. 1. In the **Source Setup** section, select **Use Transport Layer Security (TLS)** on the relevant config pages. 1. Select **Save**. The TLS certificate should be automatically copied to the VA cluster associated with the source. For example, Active Directory sources include checkboxes to enable TLS support in the following source configuration settings: - Forest - Domain - IQ Service - Exchange For information about IQService TLS configuration and manually adding certificates to VAs, refer to [TLS Configuration on Virtual Appliances](https://documentation.sailpoint.com/connectors/iqservice/help/common/va_topics_and_snippets/tls_config_on_va.html). ## FIPS VA Configuration FedRAMP users may need to configure their VAs to be compliant with Federal Information Processing Standards (FIPS). FIPS configuration is performed on each individual VA at the Linux kernel level. Important FIPS configuration on a VA cannot be reversed or disabled. If you decide later not to use FIPS mode, you must create new VAs from a fresh VA image. For instructions and more information, refer to [Configuring Virtual Appliances for FIPS Compliance](https://community.sailpoint.com/t5/IdentityNow-Connectors/Configuring-Virtual-Appliances-for-FIPS-Compliance/ta-p/236557) using your Compass login. ## Configuring a Hosts.yaml File Source connectors may need a host entry in the `hosts.yaml` file to complete an [Identity Security Cloud Connector](https://documentation.sailpoint.com/connectors/isc/landingpages/help/landingpages/isc_landing.html) implementation. To add a source host entry in the `hosts.yaml` file: 1. Go to `/home/sailpoint/`. 1. Create the file or edit an existing `hosts.yaml` file using the command `vim hosts.yaml`. 1. Add an entry for the source host. Important Example hosts.yaml ```yaml hosts: 10.20.30.40: - host1.domain.example - host1 10.20.30.41: - host2.domain.example - host2 ``` Spacing and indentation in the hosts.yaml file must be precise: - The second line must start with 2 spaces followed by a valid IP address matching the IP address configured for the host. - The third line must start with 4 spaces followed by a dash and one additional space. It must contain a fully qualified hostname matching the fully qualified hostname configured for the source. - The fourth line must start with 4 spaces followed by a dash and one additional space. It must contain a hostname matching the hostname configured for the source. - Repeat second to fourth lines for multiple entries. - For Data Access Security, hosts.yaml lookups on Alpine are case-sensitive, so hostnames in the hosts.yaml file will need to match case used by the Data Access Security application (or Kerberos). 1. Save the `hosts.yaml` file. 1. Restart the `charon` service using the command `sudo systemctl restart charon`. # Customer-Provided Operating System for Virtual Appliances Limited Availability Functionality available to select customers upon request. Visit [SailPoint Product News](https://developer.sailpoint.com/discuss/t/new-capability-limited-availability-of-va-customer-provided-operating-systems-cpos/111346) for more information. Important Installing your own operating system on the Virtual Appliance (VA) requires that your organization sign additional legal documents, including an addendum acknowledging assumption of increased liability and responsibility. Contact your Customer Success Manager for information. Additionally, this updated Documentation supersedes and governs any previously incorporated Documentation agreed to by you or your organization with respect to updating the VA, your operating system, and associated support, maintenance, and other responsibilities. Your organization has the option to create VAs on the Linux distribution of your choice where you can use your preferred vulnerability management, monitoring, and log management tools. This option is currently offered for the following OS versions: - RedHat Enterprise Linux / CentOS / Rocky Linux: 8.x and 9.x and 10.x - Ubuntu: 22.04 LTS, 24.04 LTS, and 26.04 LTS - Amazon Linux: AL2 and AL2023 (2023 is the successor to 2) - Suse Linux: SUSE Linux Enterprise Server - 15 and 16 - Oracle Linux: CIS Level 1 - Oracle Linux 9 To implement this option, a script is copied to the host during the [VA installation process](#installing-the-va-on-your-operating-system). ## Customer Responsibilities By opting to provide your own OS, you are agreeing to expand your organization’s responsibilities regarding the OS and VA setup, maintenance, and upkeep. You and your organization are responsible for the following: - Ensure the virtual appliance hardware meets or exceeds the minimum published specifications. For customers that require specific /home, /var, or /opt partitioning, meet the following minimum requirements: - /var/lib/docker - 40 GB - /opt/sailpoint - 20 GB - /home/sailpoint - 60 GB - Monitor and implement all OS-level updates and patching and otherwise provide all relevant support and maintenance for the OS. - Validate with SailPoint before making OS major version upgrades. You will be responsible for all OS reboots. - Harden the OS using the [CIS benchmarks](https://www.cisecurity.org/cis-benchmarks). - Provision the VMs from an allowed OS (see above), as supported by your organization, which include: - Consult SailPoint Support for initial VA cluster setup. - Configure your organization settings such that these VMs serve as dedicated VAs for SailPoint software or services. - For clarity, the supported OS server should be dedicated to running the VAs for SailPoint software or services and ancillary tools or software used to support the primary function of the VAs or security for the VAs. - Manage installations, troubleshoot, and maintain all required, non-SailPoint tools on the box. - Allow, and configure all applicable organization settings to accept automatic updates by SailPoint to any SailPoint-provided software running on the VA (subject to your election of the separately-provided change control option by SailPoint). By electing this option, you acknowledge and agree that except for the SailPoint software and services installed therein, your organization will be solely responsible for issues related to the setup, maintenance, update, and upkeep of the OS and VA. In most instances, a VA rebuild will be the default solution when troubleshooting issues related to the VA functions. ## Installing the VA on Your Operating System The Customer-Provided Operating System (CPOS) VA installer is a bash script (`sp-va-install`) appended with the docker images required to bootstrap the VA. By default, the installer includes the latest released versions of `charon`, `va_agent`, `canal`, and `toolbox`. Once online and bootstrapped, the VA will pull the remaining images along with any updates from Elastic Container Registry (ECR) just as it does on Flatcar OS. OS type detection is done in the script, so the install package works for all supported OS types. Note A new VA can be saved to the cluster without pairing, but is not operational until you enter the time-sensitive pairing code and wait for configuration to finish. **To install the VA on your supported OS:** 1. [Create a VA cluster](https://documentation.sailpoint.com/saas/help/va/deploy_va.html#creating-a-va-cluster). 1. Select **Edit** on the VA cluster you want to work with. 1. Select **Virtual Appliances**. 1. Select **Add New > VA with custom OS**. 1. Select **Download the installer**. 1. Copy the `sp-va-install` script to the host. 1. Make the script executable with the following command: `$ chmod +x sp-va-install` 1. Run the script with any of the following options: - Check requirements and exit: `$ sudo ./sp-va-install` - Install rpm/deb dependencies and exit: `$ sudo ./sp-va-install -d` - Perform the full installation: `$ sudo ./sp-va-install -i` - Specify the uid and gid if your preference differs from the default. (The default is the next available numeric IDs for the SailPoint user and group):\ `$ sudo ./sp-va-install -i --uid 1011 --gid 1011` 1. Sign in with User Name: sailpoint, Password: S@ilp0int, and then change the password immediately. 1. Enter the command to setup your passphrase:\ `va-bootstrap set-passphrase` Note Your passphrase must be identical for every VA in the cluster. The passphrase cannot start with a special character, and cannot include !, /, , or spaces. 1. Enter the command to get a pairing code: `va-bootstrap pair` 1. Enter the pairing code within 4 hours and select **Pair**. 1. Wait about 30 minutes for configuration to finish. When VA configuration is complete, the VA Status will change to Connected. If the VA connection is successful, you can now [connect the VA cluster to a source](https://documentation.sailpoint.com/saas/help/va/manage_va.html#connecting-a-va-cluster-to-a-source) and enable [Transport Layer Security](https://documentation.sailpoint.com/saas/help/va/config_va.html#transport-layer-security) if the source supports it. ## Security Requirements Customers opting to provide their own operating system (OS) have additional responsibilities for maintaining the security of the OS they chose to use. These include: - OS hardening to your company standards. - We recommend using the [CIS benchmarks](https://www.cisecurity.org/cis-benchmarks) for hardening the OS. - FedRAMP customers should use STIG. - All OS-level updates and patching. - We recommend patches be applied at least weekly or anytime a critical patch is released by the OS vendor. - Vulnerability scanning and remediation. - We recommend running a vulnerability scanning tool continuously or at least daily to identify any new vulnerabilities. - Vulnerabilities should be remediated as soon as possible by either applying an available patch or removing the vulnerable OS package if it is not needed. - Log collection and monitoring. - Customers can either use their SEIM tool or Fluent, which is installed as part of the VA installation. # Deploying Virtual Appliances To deploy a virtual appliance (VA), complete the steps specific to your virtualization platform. Then, proceed to [starting a new virtual machine](#starting-a-new-virtual-machine) and subsequent steps. **Start with the section for your deployment type.** ## Local VA Deployment with vSphere To deploy a VA locally with vSphere: 1. [Download the virtual appliance package](https://sppcbu-va-images.s3.amazonaws.com/va-latest.zip). 1. Unzip the package. 1. Copy it to your virtualization platform following the standard process for your platform. 1. Proceed to [Starting a New Virtual Machine](#starting-a-new-virtual-machine). ## Local VA Deployment with Hyper-V To deploy a VA locally with Hyper-V: 1. [Download the virtual appliance package](https://sppcbu-va-images.s3.amazonaws.com/va-azure-latest.zip). 1. Unzip the package. 1. Copy the `sailpoint-va.vhd` file to your virtualization platform. 1. In Hyper-V, select **New > Virtual Machine**. The New Virtual Machine Wizard launches. 1. On the Before You Begin screen, select **Next >** to create a virtual machine with custom configuration. 1. On the Specify Name and Location screen: a. Enter a name for your new virtual machine. b. Select the checkbox for **Store the virtual machine in a different location**. c. Enter the desired location for your new virtual machine. d. Select **Next >**. 1. On the Specify Generation screen, select **Generation 1**, and then **Next >**. 1. On the Assign Memory screen, enter the [amount of startup memory for the VA](https://documentation.sailpoint.com/saas/help/va/requirements_va.html#system-requirements), and select **Next >**. 1. On the Configure Networking screen, select **External** for the V-Switch connection, and then **Next >**. 1. On the Connect Virtual Hard Disk screen, select **Use an existing virtual hard disk**, enter the path to the extracted file in the **Location** field, and select **Finish**. 1. Verify the Summary. 1. Proceed to [Starting a New Virtual Machine](#starting-a-new-virtual-machine). ## Cloud VA Deployment with AWS To support connections to other cloud-based applications, you may want to deploy SailPoint VAs on your AWS infrastructure. VA deployment with AWS must be completed by an experienced admin of your company’s AWS tenant with knowledge of the following: - The VPC, networking, and security group requirements for your AWS tenant. - The AWS regions where the VA will reside. To deploy a VA in the cloud with AWS: 1. Ensure that your environment meets the following prerequisites: - Meets the [AWS EC2 instance size requirements](https://documentation.sailpoint.com/saas/help/va/requirements_va.html#system-requirements). - In the security group, Port 22 is open from your IP range. 1. [Open a support ticket](https://community.sailpoint.com/t5/Working-With-Support/ct-p/WorkWithSupport) requesting an Amazon Machine Image (AMI) ID to install a VA in AWS. You will need to provide your AWS account number and region, such as us-east-1. SailPoint Support will then share the AMI with your account and provide you with an AMI ID. Tip To locate the shared AMI image, select **EC2 > Images > AMIs** and filter your search by Private Images. 1. In AWS, select the AMI, and select **Launch**. 1. In the Instance Type page, select the appropriate AWS EC2 instance size based on the [system requirements](https://documentation.sailpoint.com/saas/help/va/requirements_va.html#system-requirements). 1. Select **Configure Instance Details**. 1. Select the appropriate VPC and Subnet for your environment. 1. Select **Add Storage**, and leave the defaults on this page. 1. Select **Instance Metadata Service**. 1. Enable **Metadata accessible**, and set **Metadata response hop limit** to 2. 1. Select **Add Tags**, and complete this page as appropriate for your organization. 1. Select **Configure Security Group**, and select the appropriate security group. 1. Select **Review and Launch > Launch**. 1. In the **Select an existing key pair or create a new key pair** dialog box, select the option appropriate to your company policy. 1. Proceed to [Starting a New Virtual Machine](#starting-a-new-virtual-machine). ## Cloud VA Deployment with Azure To support connections to other cloud-based applications, you may want to deploy SailPoint VAs on your Azure infrastructure. VA deployment with Azure must be completed by an experienced admin of your company’s Azure tenant with knowledge of the following: - The Azure CLI - The networking and security group requirements for your Azure tenant - The regions where the VA will reside To deploy a VA in the cloud with Azure: 1. Ensure that your environment: - Meets the [Azure VM instance size requirements](https://documentation.sailpoint.com/saas/help/va/requirements_va.html#system-requirements) for storage account, blob container, and resource group to hold the VA resources. - Has sufficient bandwidth to upload a 132 GB image to Azure 1. [Download the virtual appliance package](https://sppcbu-va-images.s3.amazonaws.com/va-azure-latest.zip). 1. Unzip the package. Important The extracted VHD file will be around 132 GB. Check your disk space before extracting. 1. Log in to your Azure command line tool. Refer to the [Azure CLI Command Reference](https://learn.microsoft.com/en-us/cli/azure/reference-index?view=azure-cli-latest) as necessary. 1. Upload `sailpoint-va.vhd` to an Azure storage container with the following [az storage blob upload command](https://learn.microsoft.com/en-us/cli/azure/storage/blob?view=azure-cli-latest#az-storage-blob-upload): `az storage blob upload --container-name "$container_name" --file "sailpoint-va.vhd" --name "sailpoint-va.vhd" --connection-string "$connection_string"` Note Given the large size of the image, this step might take hours. 1. Create a managed disk from the blob with the following [az disk create command](https://docs.microsoft.com/en-us/cli/azure/disk?view=azure-cli-latest#az-disk-create): `az disk create --resource-group "$resource_group" --name "sailpoint-va" --source "$vhd_blob_url"` Where: `$vhd_blob_url` is the URL of the `sailpoint-va.vhd` blob. For example: `https://${storage_account}.blob.core.windows.net/$container_name/sailpoint-va.vhd` 1. Create the VM from the managed disk with the following [az vm create command](https://docs.microsoft.com/en-us/cli/azure/vm?view=azure-cli-latest#az-vm-create): `az vm create --resource-group "$resource_group" --location "$region" --name "$name" --os-type linux --attach-os-disk "sailpoint-va" --nsg "$network_security_group" --size "Standard_B4ms"` Note The network security group you associate with the VM must allow traffic over port 22 in order for you to SSH into the VA. 1. To test the VM, SSH in using the default login: Username: `sailpoint` Password: `S@ilp0int` 1. Proceed to [Starting a New Virtual Machine](#starting-a-new-virtual-machine) to change your password. ## Cloud VA Deployment with GCP VA deployment with Google Cloud Platform (GCP) must completed by an experienced admin of your company’s GCP environment with the following: - Google SDK - Admin permissions for GCP account - A bucket to hold the VA image with admin permissions - Knowledge of the networking and security requirements for your GCP environment - A project on GCP To deploy a VA in the cloud with GCP: 1. [Download the virtual appliance package](https://sppcbu-va-images.s3.amazonaws.com/va-latest.zip). 1. Extract the `.ova` file using 7-Zip or similar software. 1. Launch a Google Cloud SDK Shell. 1. Authenticate to GCP. 1. Upload the unzipped VA-latest folder to the bucket you will use for the VA. 1. In Google Cloud Shell SDK, execute a command to import the VA disk as a *non-bootable virtual disk* into GCP. For example: `gcloud compute migration image-imports create sailpoint-va-disk --source-file gs://(cloud storage bucket)/sailpoint-va.vmdk --location (location) --skip-os-adaptation` 1. After the import completes, log in to Google Admin Console and go to **Computer Engine > VM Instances > Create an Instance**. a. On Boot disk section go to **Change > Custom Images**. b. Select the Project you created and where the VA Disk was updated. c. Choose the image you imported. d. Size the disk to 128G. 1. Create the instance. After the instance is created it will appear on the instances tab and you will be able to log in via SSH using the default username and password for the VA. 1. Log in as the SailPoint user through SSH and register the VA to your tenant. 1. Proceed to [Starting a New Virtual Machine](#starting-a-new-virtual-machine). ## Starting a New Virtual Machine 1. Start the virtual machine (VM) you previously downloaded and copied to your local virtualization platform or launch your VM instance. 1. Sign in to the VM: Username: `sailpoint` Password: `S@ilp0int` 1. Change your password immediately: a. At the command prompt, type `passwd`. b. Enter the current password `S@ilp0int`. c. Provide a new password. d. Repeat the new password. Important - It is very important to save your `sailpoint` user password. If the password is lost, a new VA must be created. - If you are performing a cloud VA deployment and receive a failed unit message for the `esx_dhcp_bump.service` after login, run the following command to disable the service: `sudo systemctl disable esx_dhcp_bump.service` 1. For local VA deployments, [set a static IP address for your virtual appliance](#setting-a-static-ip-address-for-local-va-deployments). 1. For cloud VA deployments, proceed to [Creating Virtual Appliances](#creating-virtual-appliances). ## Setting a Static IP Address for Local VA Deployments 1. Find the name of your virtual NIC card for your VA: a. In the command line, type `ip addr` b. From the list of virtual NICs displayed, find the second one. Note Virtual NIC names are dynamically assigned upon initial VA creation, so you will need to perform this step for each VA to enter the correct name into your static.network file in the steps that follow. 1. Create the `static.network` file: a. From the /home/sailpoint/ directory, enter: `sudoedit /etc/systemd/network/static.network` b. Enter the following: `[Match]` `Name=` `[Network]` `DNS=` `Address=` `Gateway=` Where: - `` is the name of your VA's virtual NIC card and the values under Network are specific to your VA's IP address. - `CIDR` in the Address field is required if you want to set a subnet mask Note To set a custom DNS Search Domain, add `Domains=` to the bottom of the `[Network]` section. 1. Reboot the VA: `sudo reboot` 1. Proceed to [Creating Virtual Appliances](#creating-virtual-appliances). #### If using Hyper-V: Hyper-V images ship with the `waagent` Azure service enabled by default. This can cause DNS issues and irregular network routing on virtual appliances running on Hyper-V. To prevent these issues, disable the `waagent` service: `systemctl status waagent` `sudo systemctl mask waagent` `sudo reboot` ## Creating Virtual Appliances After you get your URL from SailPoint, you can securely connect the virtual machine to your tenant by creating VAs. This section describes how to create VAs with the standard configuration. Note If you are using non-standard VA configurations, be sure to complete the additional configuration steps for [HTTP proxy VAs](https://documentation.sailpoint.com/saas/help/va/config_va.html#configuring-http-proxy-vas) or [Network Tunnel VAs](https://documentation.sailpoint.com/saas/help/va/config_va.html#network-tunnel-va-configuration) before creating VAs. ### Creating a VA Cluster 1. Go to **Admin > Connections > Virtual Appliances**. 1. On the Virtual Appliance Clusters page, select **Create New**. 1. Enter a unique **Cluster Name** and **Cluster Description** for the virtual appliance cluster. You cannot have two clusters with the same name in your organization. 1. Select a **Time Zone**. The cluster time zone determines the GMT offset when scheduling [account aggregations](https://documentation.sailpoint.com/saas/help/accounts/loading_data.html#scheduling-aggregations-for-direct-connect-sources) and [entitlement aggregations](https://documentation.sailpoint.com/saas/help/loading_entitlements/aggregating_entitlements.html#scheduling-recurring-aggregations) for the connected source. 1. Select the **Standard** cluster type unless your organization uses IdentityIQ. If your organization has [AI-Driven Identity Security for IdentityIQ](https://documentation.sailpoint.com/saas/help/ai/iiq/index.html), select the **IAI Harvester** cluster type. Important You cannot change the cluster type for an existing cluster. If the wrong cluster type is selected for a cluster, you must delete the cluster and start over. 1. (Optional) Select **Enable Debugging** to start 24 hours of debug-level (verbose) logging for all VAs in this cluster. It is not required to enable debugging, but it can be helpful in case you need to troubleshoot anything. When debugging is enabled, all log information is saved to log files for 24 hours regardless of file size. When debugging is not enabled, log files are replaced once they reach 512 MB. 1. Select **Save**. 1. If your organization has licensed [Data Access Security](https://documentation.sailpoint.com/das/help/index.html) or [SailPoint Privilege](https://documentation.sailpoint.com/saas/help/privilege/index.html), select **Cluster Components** to [enable cluster components](#enabling-cluster-components) for these products. If your organization does not have these products, you can now add VAs to the cluster. #### Enabling Cluster Components Enabling cluster components allows you to create VAs that support the other SailPoint products or features used in your organization. The Cloud Connector Gateway component is enabled by default for all Identity Security Cloud VA clusters. Deselect this component only if you want to create a standalone VA for a single SailPoint product component. **To enable cluster components:** 1. After saving a Standard cluster, select **Cluster Components**. 1. Select component checkboxes for only your licensed SailPoint products and features. The total minimum system requirements per VA are updated as new components are selected for enablement. You are responsible for allocating enough resources for the total minimum requirements per VA. The following cluster components are available: #### VA Cluster Components **Privileged Access Gateway** - Select this component to run privileged workflow actions against target systems and applications. The Privileged Access Gateway VA cluster component supports [standard](https://documentation.sailpoint.com/saas/help/va/config_va.html#standard-va-configuration) and [HTTP proxy](https://documentation.sailpoint.com/saas/help/va/config_va.html#http-proxy-va-configuration) VA configurations, but not the [network tunnel](https://documentation.sailpoint.com/saas/help/va/config_va.html#network-tunnel-va-configuration) configuration. For more information, refer to [SailPoint Privilege Overview](https://documentation.sailpoint.com/saas/help/privilege/index.html). **Data Access Security** - Data Access Security VA cluster components support only [standard](https://documentation.sailpoint.com/saas/help/va/config_va.html#standard-va-configuration) VA configurations and not [HTTP proxy](https://documentation.sailpoint.com/saas/help/va/config_va.html#http-proxy-va-configuration) or [network tunnel](https://documentation.sailpoint.com/saas/help/va/config_va.html#network-tunnel-va-configuration) configurations. For more information, refer to [SailPoint Data Access Security](https://documentation.sailpoint.com/das/help/index.html). - **Data Access Security - Resource Collector** - Select this component to enable resource discovery for on-premises applications governed by Data Access Security. - **Data Access Security - Permission Collector** - Select this component to enable permission collections and access rights analysis tasks for on-premises applications governed by Data Access Security. - **Data Access Security - Data Classification Collector** - Select this component to enable data collection, classification and cataloging tasks for applications governed by Data Access Security. - **Data Access Security - Activity Monitor** - Select this component to enable event collection for on-premises applications governed by Data Access Security. 1. Select **Save**. VA cluster components can be added to existing Standard type clusters. For more information, refer to [Editing a VA Cluster](https://documentation.sailpoint.com/saas/help/va/manage_va.html#editing-a-va-cluster). ### Adding VAs to a Cluster 1. Select **Edit** on the VA cluster you want to work with. 1. Select **Virtual Appliances**. 1. Select **Add New > VA**. The Configure Virtual Appliance page displays. Note A new VA can be saved to the cluster without pairing, but is not operational. 1. Download the VA image and copy it to your virtualization platform. If you are adding HTTP Proxy VAs, stop here and complete the rest of the process using the steps in [Configuring HTTP Proxy VAs](https://documentation.sailpoint.com/saas/help/va/config_va.html#configuring-http-proxy-vas). 1. Start the VA image. 1. Sign in with User Name: sailpoint, Password: S@ilp0int, and then change the password immediately. 1. Enter the command to set up your passphrase: `va-bootstrap set-passphrase` FedRAMP customers enter this command instead: `va-bootstrap -t govcloud set-passphrase` The value of keyPassphrase must be identical for every virtual appliance in the cluster. The keyPassphrase cannot start with a special character, and cannot include !, /, , or spaces. The VA automatically encrypts the keyPassphrase. Encrypted keyPassphrases are denoted by a leading set of colons (::::). 1. Enter the command to get a pairing code: `va-bootstrap pair` 1. Enter the pairing code within 4 hours and select **Pair**. 1. Wait about 30 minutes for configuration to finish. When VA configuration is complete, the VA Status will change to Connected. If the VA connection is successful, you can now [connect the VA cluster to a source](https://documentation.sailpoint.com/saas/help/va/manage_va.html#connecting-a-va-cluster-to-a-source) and enable [Transport Layer Security](https://documentation.sailpoint.com/saas/help/va/config_va.html#transport-layer-security) if the source supports it. ## Deploying VAs for High Availability and Disaster Recovery The need to factor High Availability (HA) and Disaster Recovery (DR) into your deployment decisions may be obvious, but it might help to also understand the following: - Each source is associated with a specific VA cluster. - Any actions performed on that source, such as aggregation, test connection, authentication, or provisioning are sent as requests to the VA cluster and form a queue. - Each VA that's running continually polls the queue of requests sent to its associated VA cluster. This section outlines different strategies for handling high availability and disaster recovery scenarios in virtual appliance deployments. *High Availability* means ensuring that there are enough VAs running to meet the processing needs of the business, as well as sufficient redundancy to be able to compensate for a single VA becoming temporarily unavailable due to an upgrade process, loss of connectivity, or other activity that could otherwise result in downtime. *Disaster Recovery* means making sure that your organization has VAs deployed in more than one location, as part of a failover strategy that ensures business continuity in the face of a disaster (natural or otherwise). ### All VAs Running In this strategy, all VAs are deployed in a single VA cluster, with all VAs running concurrently. Some VAs are in the primary datacenter, and others (called DR VAs) are deployed in a DR datacenter. As work is assigned to the VA cluster, either primary VAs or DR VAs can pick up and perform requests. A problem could arise if there are latency issues between the source that the VA is communicating with and the VA's deployment location. This is especially true for DR VAs, which may be farther from the sources they are communicating with. During a failover event, no action is needed. If the primary VAs go down, the DR VAs continue to respond to requests. | | | | ------------------------------------------------------------------------------------------------------------- | -------------------------- | | **Advantages** | **Disadvantages** | | - On DR event, no action needed - Full utilization of all VAs - VAs stay up-to-date - Minimal risk of outages | - Potential latency issues | ### Switch Clusters In this strategy, two VA clusters are deployed. One VA cluster is the 'primary VA cluster', with all member VAs in the primary datacenter. The other VA cluster is the 'DR VA cluster', with all member VAs in the backup DR datacenter. All VAs in all clusters are powered-on and receiving updates. As work is assigned to the primary VA cluster, the primary VAs can pick up and fulfill requests. This mitigates any sort of latency issues between the source that the VA is communicating with and the VA deployment location. Even though the DR VAs are powered on, they are not receiving requests, because they are not associated with the primary VA cluster that the sources are using. During a disaster event where the primary VAs go down, there would be an outage until the sources are reconfigured to use the DR VA cluster. Note On failover, switching clusters requires reentering the source credentials. This can complicate the failover process if these credentials are not readily available to the administrator, or if there are many sources to manage. | | | | --------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Advantages** | **Disadvantages** | | - DR VAs stay up-to-date - DR VAs don’t add latency, as they aren’t processing anything until a DR event occurs | - No utilization of DR VA cluster - Reconfiguration needed upon DR event, involving reentering of source credentials - Difficult if large number of sources to manage | ### Standby Reactive Deployment In this strategy, primary VAs are deployed in a single VA cluster. Only the VAs in the primary datacenter are running concurrently. There are existing standby VAs set up and tested in a DR zone, but not yet deployed to a VA cluster. These VAs can be left powered up or down. As work is assigned to the primary VA cluster, the primary VAs can pick up and fulfill requests. This mitigates any sort of latency issues between the sources that the VA is communicating with and the VA deployment location. During a disaster event where the primary VAs go down, there would be an outage until the standby DR VAs are deployed to the primary VA cluster. As the new standby DR VAs come online, they start to fulfill requests. | | | | ----------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------ | | **Advantages** | **Disadvantages** | | - VAs do not add latency, as they are not processing anything until a DR situation occurs | - Turnaround time can be greater depending on deployment of VA DR - Relies on VA readiness | ## Deployment in the DMZ is Not Recommended While there are no technical reason prohibiting it, **we strongly recommend that you not deploy virtual appliances in the DMZ**, or perimeter network. For the most secure and highest performing communication with target sources, we recommend that you deploy VAs near their sources on internal networks as shown in the following diagram. #### Why Not Deploy in the DMZ? We recommend against deploying the VA in the DMZ for the following reasons: - **Security** - The most important consideration against DMZ deployment is security. A DMZ is a less-secure perimeter network by design. SailPoint VAs are hardened against attack, but they are a communication backbone with sources, and could be an attack vector. Each VA also contains the 2048-bit RSA asymmetric private key (generated from the chosen key passphrase), which is used to decrypt credentials when talking to various sources. Placing a VA in a less-secure zone could put your information at risk. - **Proximity** - Virtual appliances connect to various sources, and both read (aggregation) and write (provisioning) activities can occur via API on these connections. Some connector APIs can be latency-sensitive. Deploying the VAs closer to the sources they are communicating with yields better performance. - **Connectivity** - VAs are designed to communicate with internal sources, not perimeter sources. The purpose of a DMZ perimeter network is for externally-facing components to communicate with each other, not with components on the internal network. If a VA is deployed in the DMZ and needs to communicate with internal sources, you might have to open more ports on your internal firewall to facilitate that communication. # Getting Started with Virtual Appliances Because the VA is critical to your SailPoint infrastructure, you'll need to understand your options, make crucial deployment and configuration decisions, and carefully complete deployment and configuration. Important This process must be completed by someone with a clear understanding of the organization’s virtualization platform and network security requirements. These instructions assume expertise in the general tasks of deploying virtual machines on the organization's local network or cloud infrastructure. Notes - VAs run with UTC as their time zone. The VA time zone cannot be changed. - Adding users, VA trust/key store access, and root access is not supported. - The VA uses Flatcar as its operating system. Prior to VA release, [Flatcar releases and security updates](https://www.flatcar.org/releases) are monitored in a sandbox environment for one week. - Organizations with IdentityIQ require additional configuration to deploy the VA. IdentityIQ users should refer to [Deploying the Virtual Appliance with IdentityIQ](https://documentation.sailpoint.com/saas/help/ai/iiq/iiq_ai_get_started.html#deploying-the-virtual-appliance-with-identityiq). ## VA Process Overview The high-level steps to get a VA up-and-running are: 1. Review and understand [VA system and network requirements](https://documentation.sailpoint.com/saas/help/va/requirements_va.html). 1. Review and understand VA [best practices](#best-practices). 1. Review and select VA deployment options. Even though the VA itself runs Linux, the hypervisor can be any operating system that is compatible with your hardware. VA deployment options include: - [**Local with vSphere**](https://documentation.sailpoint.com/saas/help/va/deploy_va.html#local-va-deployment-with-vsphere) - ​​Deploy the downloaded image on a virtual machine behind your firewall. Local deployments require a static network. - [**Local with Hyper-V**](https://documentation.sailpoint.com/saas/help/va/deploy_va.html#local-va-deployment-with-hyper-v) - ​​​​Deploy the downloaded image on a virtual machine behind your firewall. Local deployments require a static network. - [**AWS Cloud**](https://documentation.sailpoint.com/saas/help/va/deploy_va.html#cloud-va-deployment-with-aws) - ​Deploy our AMI on your AWS infrastructure. - [**Azure Cloud**](https://documentation.sailpoint.com/saas/help/va/deploy_va.html#cloud-va-deployment-with-azure) - ​​Deploy the downloaded image on a virtual machine running in your Azure environment. - [**Google Cloud Platform (GCP)**](https://documentation.sailpoint.com/saas/help/va/deploy_va.html#cloud-va-deployment-with-gcp) - Deploy the downloaded image on a virtual machine running in your GCP environment. In addition to your selection of a deployment type, you should also consider options for [high availability and disaster recovery](https://documentation.sailpoint.com/saas/help/va/deploy_va.html#deploying-vas-for-high-availability-and-disaster-recovery). 1. Review and select VA network configuration options. This selection determines how the VA will communicate with external systems. All communications, regardless of the deployment configuration selected, will be initiated as outbound only. No incoming communications from outside your network will be requested or required. Choose the network configuration option that is most appropriate for your network layout and policy. - [**Standard**](https://documentation.sailpoint.com/saas/help/va/config_va.html#standard-va-configuration) - Uses the standard traffic generated by the VA. - [**HTTP Proxy**](https://documentation.sailpoint.com/saas/help/va/config_va.html#http-proxy-va-configuration) - Routes all HTTP/HTTPS traffic through a proxy. - [**Network Tunnel**](https://documentation.sailpoint.com/saas/help/va/config_va.html#network-tunnel-va-configuration) ​- Limits the outbound connections generated by the VA. Choose this option only if your firewall cannot support host names. In addition, you can also implement: - [**Transport Layer Security (TLS)**](https://documentation.sailpoint.com/saas/help/va/config_va.html#transport-layer-security) - Encrypts the connection between the VA and sources that support TLS. TLS encryption is recommended when connecting VAs to sources that support it. - [**Password Interceptor**](https://community.sailpoint.com/t5/IdentityNow-Connectors/Configuring-Sources-and-Virtual-Appliances-to-Support-the/ta-p/76693) - If you enable password interception, password changes on supported sources (Active Directory) are intercepted and propagated to the related source in Identity Security Cloud. - [**Local NTP Server**](https://documentation.sailpoint.com/saas/help/va/requirements_va.html#connecting-the-va-to-a-local-ntp-server) - If you do not want to allow outbound access for port 123, you can configure your VAs to communicate with NTP servers behind your firewall. 1. Complete [deployment steps](https://documentation.sailpoint.com/saas/help/va/deploy_va.html) for the VA deployment options you selected in Step 3. 1. Complete [configuration steps](https://documentation.sailpoint.com/saas/help/va/config_va.html) for the VA configuration options you selected in Step 4. 1. [Monitor and maintain](https://documentation.sailpoint.com/saas/help/va/manage_va.html) your VA infrastructure. #### Troubleshooting Restarting the VA cluster is almost always the best first action to resolve problems with a VA. If you cannot resolve a problem with a VA, consider standing up a new replacement VA or refer to the [Virtual Appliance Troubleshooting Guide](https://community.sailpoint.com/t5/IdentityNow-Connectors/Virtual-Appliance-Troubleshooting-Guide/ta-p/78735) using your SailPoint Compass login. ## Best Practices In addition to meeting all [System and Network Requirements](https://documentation.sailpoint.com/saas/help/va/requirements_va.html), SailPoint recommends the following best practices when deploying virtual appliances: - **Locate VAs Close to Sources** - To ensure a reliable connection between a VA and the source system, locate them as follows: - **Local** - Install clusters near the connected source system. - **AWS/Azure/GCP** - Place clusters in the Availability Zone as close as possible to the target sources. If your organization has a VPN connection to its AWS or Azure Virtual Private Cloud (VPC), the VAs should be hosted in the same region that's hosting the network gateways for your organization. - **Maintain a 1:1 VA to Virtual Machine Ratio** - To avoid a single point of failure in your environment, have a a ***1:1 ratio of VA to VM***. - To build in fault tolerance, configure local VAs in the same cluster to run on different servers whenever possible. - Spread VAs in the same cluster running in AWS/Azure across different Availability Zones. - **Create New VAs to Switch Deployment Locations and Platforms** - Migrating existing VAs to a different deployment method is not supported. New VAs must be created to switch from one deployment method to another, such as from standard deployment to network tunnel deployment. # Managing Virtual Appliances Virtual appliances connect your SailPoint tenant and enterprise systems, supporting secure communication between them. It's therefore important to regularly monitor and maintain each SailPoint VA, and be familiar with the connected sources. ## VA Updates SailPoint manages VA updates. Whenever we make improvements to the VA image, we deploy them to the clusters, which then perform rolling updates and reboots on the related VAs one at a time. As stated in the [System and Network Requirements](https://documentation.sailpoint.com/saas/help/va/requirements_va.html), you must have at least 2 VAs per cluster to ensure connectivity with your sources during these updates. By applying updates and rebooting one at a time, the VA cluster maintains full availability during the update process. Note While cluster availability is maintained during updates, in-progress processes, such as long-running aggregations that have not completed in time for the upgrade to complete, may be interrupted. If a VA does not automatically reboot after an update, please manually [restart the VA cluster](#restarting-a-va-cluster). Caution If any VA in a cluster is not connected, no software or maintenance updates are made to any of the VAs in that cluster. VA updates cannot be skipped or delayed. SailPoint does not notify before VA updates. VA updates are usually released to sandbox environments a week before they are released to production environments. Your organization must have similar VA setups in sandbox and production and be [configured to send notifications](https://documentation.sailpoint.com/saas/help/common/getting_notified_org_health.html) if a VA fails. ### Updates to VA Components and Processes Updates to a VA component or process are performed in coordination with the status of other processes. Processes running on the VA signal their availability status for updates to avoid disrupting running processes. This [VA Component Process Status](#va-component-process-status) is displayed in the UI and designates whether the process is busy or available for updates. VAs with idle processes will be prioritized for updates and restarts and processes that are busy will continue uninterrupted for a period of time. While most updates occur without disruption, sometimes it is necessary to override busy processes. If a process on the VA is continually busy for an excessive amount of time, then updates may be applied to maintain supportability, patch vulnerabilities, or apply critical fixes. Depending on the extent of updates, sometimes you must restart the process, or reboot the VA to complete the updates. ### VA Update Errors Require Action While SailPoint automatically applies updates to your VA, there may be situations where a VA is unable to be updated, misses updates, or otherwise does not deploy an update correctly, including if your VA does not meet the requirements specified in this document. In these cases, intervention may be required to return the VA to its required state and/or maintain full functionality. You agree to cooperate with SailPoint upon request to enable SailPoint to take any actions necessary to bring your VA up to date, which may include performing these steps: - Rebooting your cluster, upon notification, to complete interrupted updates - Investigating and resolving environmental issues that may be preventing updates Prompt intervention in the event of a VA update error is important to avoid the following possible issues: - Loss of support (SailPoint supports only N-2 major releases) - Missing functionality and degradation of service - Persisting vulnerabilities - Compromised cluster high availability ## Monitoring VA Health You have the following options to check on the health of your VAs: - **Notifications** - You can [receive emails](https://documentation.sailpoint.com/saas/help/common/getting_notified_org_health.html) when a VA goes down or a VA cluster has a health warning or error. - **Admin Dashboard** - Select the Clusters tile of the [system components status](https://documentation.sailpoint.com/saas/help/common/audit-reports.html#admin-dashboard) panel. - **Virtual Appliance Clusters Page** - Select **Admin > Connections > Virtual Appliances** to view cards for each VA cluster in your organization. Each VA cluster card displays status and alert messages informing about the health of the cluster. When you have a warning or error, select the health badge for a link to the VA list that shows which VA is experiencing the error. From there, you can select the VA to see more details, including timestamp, category, severity, error message, and additional information. - **Virtual Appliance Cluster Details Page** - To monitor the health of the individual VAs in the cluster, select **Details** on the cluster card, and then select the **Virtual Appliances** tab. When you have a warning or error, select the health badge for a link to the VA list that shows which VA is experiencing the error. From there, you can select the VA to see more details, including timestamp, category, severity, error message, and additional information. - **Edit Virtual Appliance Cluster Page** - Select **Edit** on the cluster card, then select **Virtual Appliances** from the left navigation. When you have a warning or error, select the health badge for details, including timestamp, category, severity, error message, and additional information. - **View Virtual Appliance Page** - To view the status of a VA's processes, go to the VA cluster card and select **Details > Virtual Appliances > linked VA ID > VA Components**. You can also access these tabs from a VA cluster card by selecting **Edit > Virtual Appliances > Actions > View > VA Components**. - **Third-Party Monitoring Tools** - SailPoint supports the export of VA metrics and logging information to third-party monitoring tools. Refer to [Virtual Appliance Observability](https://documentation.sailpoint.com/saas/help/va/observe_va.html) for more information. ### Cluster Status and Alert Messages | Badge Text | Information | | --------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- | | VA Update in Progress | At least 1 VA in the cluster is in the configuring state. If the cluster contains at least 2 VAs, normal cluster operation is maintained during updates. | | Empty Cluster | The cluster does not have any VAs. SailPoint recommends having at least 2 VAs in a cluster. The cluster is not usable until VAs are added. | | Only 1 VA in Cluster | There is only 1 VA in the cluster. SailPoint recommends having at least 2 VAs in a cluster. | | Inactive VA | One or more of the VAs in the cluster are inactive. | | VA Did Not Update | One or more VAs in the cluster did not update. Restart the cluster. | | All VAs Inactive | All the VAs in the cluster are inactive. | ### VA Status and Alert Messages | Badge Text | Information | | ------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Connected | The VA is operating as expected. | | Update in Progress | The VA in the cluster is in the configuring state. Normal operation will resume after update is complete. | | Configuration Incomplete | The VA failed to connect during configuration. Delete this VA and try again. (This status is unlikely to be encountered, because VAs that fail to successfully connect during configuration are auto-deleted.) | | VA Did Not Update | Restart the cluster. If the problem persists, contact SailPoint Support. | | Inactive State | The VA is in an inactive state and cannot connect. Contact your network administrator. | ### VA Cluster Warnings and Errors | Type | Summary | Details | Recommendations | | ------------------------------ | ---------------------------------------------- | ---------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Certificate Expiration Warning | Certificate expired or expiring within 30 days | Certificate has expired or the certificate will expire within 30 days. | Renew expiring certificate stored in the location /home/sailpoint/ca-certificates/. Delete the expired certificate from this location or move it to /tmp if possible. | | Disk Warning | Low storage space | File system storage usage is over 80%. | Check the log levels and turn off debug logs if they are not needed. Go to **Admin > Connections > Virtual Appliances**. Locate the VA and select **Edit**. Unselect the checkbox for Enable Debugging. Select **Save**. Alternatively, you can clear logs or split them up. Refer to [Working with Debug Logging](https://community.sailpoint.com/t5/IdentityNow-Connectors/Virtual-Appliance-Troubleshooting-Guide/ta-p/78735#toc-hId--791106575). | | Disk Error | Storage full | File system storage usage is over 90%. | Check the log levels and turn off debug logs if they are not needed. Go to **Admin > Connections > Virtual Appliances**. Locate the VA and select **Edit**. Unselect the checkbox for Enable Debugging. Select **Save**. Alternatively, you can clear logs or split them up. Refer to [Working with Debug Logging](https://community.sailpoint.com/t5/IdentityNow-Connectors/Virtual-Appliance-Troubleshooting-Guide/ta-p/78735#toc-hId--791106575). | | Network Error | Network connectivity error | VA cluster is unable to reach the required endpoints. | Check the network configuration as described in the [VA Network Troubleshooting guide](https://community.sailpoint.com/t5/IdentityNow-Connectors/Virtual-Appliance-Troubleshooting-Guide/ta-p/78735#toc-hId--1449899724). Be sure that you are allowing VA traffic to required URLs. | | Memory Warning | High memory usage warning | Average memory usage for the last 12 hours is over 80%. | Make sure you have sufficient memory for the VAs in your cluster. Refer to [VA Image Sizes](https://documentation.sailpoint.com/saas/help/va/requirements_va.html#system-requirements) to review SailPoint's requirements and recommendations. | | Memory Error | Memory error | Average memory usage for the last 12 hours is over 90%. | Make sure you have sufficient memory for the VAs in your cluster. Refer to [VA Image Sizes](https://documentation.sailpoint.com/saas/help/va/requirements_va.html#system-requirements) to review SailPoint's requirements and recommendations. | | OS Update Error | OS failed to update | Flatcar OS update failed. | Follow the process for [VA Flatcar OS Update Problems](https://support.sailpoint.com/csm/en/virtual-appliance-os-has-not-updated-to-a-recent-flatcar-version?id=kb_article_view&sysparm_article=KB0011734). | | OS Update Warning | OS has been updated and requires reboot | Flatcar OS update requires reboot. | Get status by running 'sudo update_engine_client -status' Look for a value of CURRENT_OP: UPDATE_STATUS_UPDATED_NEED_REBOOT An update is pending and the system needs to reboot. | | Service Stability Warning | Service instability | Container has restarted more than 10 times in 30 minutes. | Make sure your containers are up to date. Refer to [Are VA Services Up to Date?](https://community.sailpoint.com/t5/IdentityNow-Connectors/Virtual-Appliance-Troubleshooting-Guide/ta-p/78735#toc-hId--933657684). Manually [restart the VA cluster](#restarting-a-va-cluster). | ### VA Component Process Status Processes operate as part of VA cluster components. The badge text indicates the status for processing or updates. | Badge Text | Information | | ---------- | ------------------------------------------------------------------ | | OK | The process is available for processing or updates. | | Busy | The process is busy and unavailable for new processing or updates. | | Error | The process reported an error or was unable to report its status. | ## Reviewing Sources Connected to VAs To review the sources connected to a specific VA: 1. Go to **Admin > Connections > Virtual Appliances**. 1. Select **Details** on the cluster card you want to review. 1. Select the **Connections** tab. All sources connected to the VA cluster are listed along with source status messages and other information. Refer to [Managing Sources](https://documentation.sailpoint.com/saas/help/sources/index.html) for information about working with sources. ## Connecting a VA Cluster to a Source A VA cluster can be connected to a source when the source is being created or after the source has already been created. To connect a VA cluster to an existing source: 1. Go to **Admin > Connections > Sources**. 1. Select or edit the source you want to connect. 1. In the **Base Configuration**, select a VA cluster in the **Virtual Appliance Cluster** dropdown list. 1. Select **Save**. Refer to [Managing Sources](https://documentation.sailpoint.com/saas/help/sources/index.html) for information about working with sources. ## Disconnecting a VA Cluster from a Source To disconnect a VA cluster from a source: 1. Go to **Admin > Connections > Sources**. 1. Select or edit the source you want to disconnect. 1. In the **Base Configuration**, select a different VA cluster in the **Virtual Appliance Cluster** dropdown list. 1. Select **Save**. Refer to [Managing Sources](https://documentation.sailpoint.com/saas/help/sources/index.html) for information about working with sources. ## Setting the VA Cluster Time Zone The cluster time zone determines the GMT offset when scheduling [account aggregations](https://documentation.sailpoint.com/saas/help/accounts/loading_data.html#scheduling-aggregations-for-direct-connect-sources) and [entitlement aggregations](https://documentation.sailpoint.com/saas/help/loading_entitlements/aggregating_entitlements.html#scheduling-recurring-aggregations) for the connected source. To set the VA cluster time zone: 1. Go to **Admin > Connections > Virtual Appliances**. 1. Select **Edit** on the VA cluster you want to change. 1. Select a **Time Zone**. 1. Select **Save**. Refer to [Loading Identity and Access Data](https://documentation.sailpoint.com/saas/help/setup/index.html) for more information about working with aggregations. ## Maintaining Your VA Infrastructure Maintaining your VA infrastructure ensures continuous connectivity with your sources. If there is an issue with a VA, it is important to respond quickly so the VAs are available for updates and able to maintain connectivity. Caution SailPoint strongly advises against moving or migrating existing virtual appliances. You must create new VAs, ensure connection, and then delete the old, existing VAs. ### Changing Your VA Password You can change the password on a VA at any time: 1. Sign in as `sailpoint` user to the virtual machine on which the VA is running. 1. At the command prompt, type `passwd`. 1. Enter the current password. 1. Enter the new password. 1. Repeat the new password. 1. Reboot the VA: `sudo reboot` Important It's very important to save your `sailpoint` user password. If the password is lost, a new VA must be created. ### Restarting a VA Cluster If a VA cluster or VA is not operating as expected, a status or alert message may prompt you to restart the VA cluster. To restart a VA cluster: 1. Go to **Admin > Connections > Virtual Appliances**. 1. On the card for the cluster you want to restart, select **Menu > Restart**. 1. In the confirmation window, select **Restart Cluster**. A confirmation banner confirms that the VA cluster restart process has been initiated. ### Editing a VA Cluster You can update names and descriptions, change time zones, and add or remove cluster components for existing Standard VA cluster types. You cannot enable or disable cluster components for older, Default VA cluster types. To edit VA clusters: 1. On the Virtual Appliance Clusters page, select Edit for the cluster you would like to change. 1. In the left pane select the page related to the changes you would like to make: 1. **Cluster Configuration** – Enable debugging, or change the cluster name, cluster description, or timezone. 1. **Virtual Appliances** – Add or remove virtual appliances. 1. **Cluster Components** – Enable or disable cluster components. 1. **Review Details** – Restart the cluster. 1. Select **Save** if required on the page. ### Deleting a VA Cluster To delete a VA cluster: 1. Go to **Admin > Connections > Virtual Appliances**. 1. [Disconnect the VA cluster from the source](#disconnecting-a-va-cluster-from-a-source). 1. [Delete each VA in the cluster you want to delete](#deleting-a-va). 1. On the card for the cluster to be deleted, select **Menu > Delete**. 1. In the confirmation window, select **Delete Cluster**. A banner confirms that the VA cluster has been deleted, and the deleted cluster is removed from the cluster list. ### Deleting a VA You can delete a single VA without deleting the entire cluster. To delete a specific VA: 1. Go to **Admin > Connections > Virtual Appliances**. 1. Select **Edit** on the cluster that includes the VA you want to delete. 1. Select **Virtual Appliances** to display the list of VAs in the cluster. 1. Select **Delete** for the VA you want to delete. Caution After deleting the VA, you also need to shut down the related VA instances on your virtualization platform. Failure to do so can result in degraded performance or potential downtime. Info A VA cannot be deleted if it is the only VA within a cluster and is still attached to a source. To delete the VA, reassign the source to a different VA in another cluster. ### Recovering from a VA Failure When a VA cluster fails, you need to replace it quickly with a new VA cluster and reconnect all of the sources. Caution SailPoint strongly advises against moving or migrating existing virtual appliances. You must create new VAs, ensure connection, and then delete the old, existing VAs. To replace a failed VA: 1. Create a new VA cluster and at least 2 VAs on that cluster. You will be connecting your sources to this new VA cluster. 1. On the failed VA cluster, select **Details > Connections** and make note of the sources that are connected to the failed VA cluster. 1. Go to **Admin > Connections > Sources**, and connect each source to the new VA cluster you just created as follows: 1. Select or edit the affected source. 1. In the **Base Configuration**, select the new VA cluster in the **Virtual Appliance Cluster** dropdown list. 1. Select **Save**. 1. Repeat these steps for each source connected to the failing cluster. 1. Once all sources are connected to the new VA cluster, go to **Admin > Connections > Virtual Appliances**. 1. Select **Details** on the new VA cluster. 1. Select the **Connections** tab and verify that the new VA cluster is connected to the same sources that the failed VA was. 1. [Delete](#deleting-a-va-cluster) the failed VA cluster.​ For troubleshooting tools and resources, refer to the [Virtual Appliance Troubleshooting Guide](https://community.sailpoint.com/t5/IdentityNow-Connectors/Virtual-Appliance-Troubleshooting-Guide/ta-p/78735) using your SailPoint Compass login. # Manual VA Updates Limited Availability Functionality available to select customers upon customer inquiry. Visit [SailPoint Product News](https://developer.sailpoint.com/discuss/c/announcements/product-news/65) for more information. Important Opting out of automatic Virtual Appliance (VA) updates from SailPoint requires that your organization sign additional legal documents, including an addendum, acknowledging assumption of increased liability and responsibility. Contact your Customer Success Manager for information. Additionally, this updated Documentation supersedes and governs any previously incorporated Documentation agreed to by you or your organization with respect to updating the VA and associated support, maintenance, and other responsibilities. Updates to the VA generally include any security fixes, bug fixes, patches, releases,enhancements, configurations, and new features for the following: - Flatcar Linux VA operating system as configured by SailPoint - SailPoint-developed software applications that run on the VA As a general best practice, SailPoint recommends implementing automatic VA updates. Upon your organization's election, SailPoint provides the option to forego automatic VA updates and instead apply updates manually, as described further below. This option may be suitable for organizations that are required to comply with security practices that include anticipating, vetting, and mitigating risks of changes made to their network infrastructure that is outside their control. Caution By choosing to disable automatic VA updates, and enable manual updates only, organizations acknowledge and agree to assume significant risks and responsibilities to the same, and agree that falling behind certain updates may limit access to SailPoint support for the VA, as further described below. ## Manual VA Update Risks and Responsibilities Organizations choosing to manually update their VAs will have the ability to control whether and when updates provided by SailPoint get deployed to the VA. You can choose to delay or decline updates, but your organization will be subject to limits or exclusions on SailPoint’s obligations if you are no longer on a supported version. For organizations electing manual update, the following applies with respect to support for the VA (including both the Flatcar Linux operating system as configured by SailPoint and SailPoint software applications running on the VA): - SailPoint provides standard support for N-2 major releases of the Flatcar Linux operating system configured by SailPoint and any SailPoint software applications running on the VA (including all minor releases falling under a supported major release). The version numbering scheme is {Major}.{Minor}. For example, 1.5 indicates version 1 as the major release, and version 5 as the minor release. If the current release were version 4.5, SailPoint would support versions 4.0-4.5, 3.0-3.n, and 2.0-2.n. Anything from version 1 (including 1.0, 1.1, 1.2, etc.) would be deemed out of support. - By choosing manual updates you acknowledge that VA updates will NOT be managed or automatically applied by SailPoint to the VA, the Flatcar Linux operating system, or SailPoint software applications on the VA and will be solely your responsibility. - Any update designated as a “security fix” in release notes or the UI must be applied immediately. If your organization does not apply security fixes, you will not be eligible for support, warranty, indemnity, or other liability coverage in the event of a security incident or breach that could have been prevented or mitigated by automatic updates of such security fixes. ## Configuring Manual VA Update Settings Important Opting out of automatic Virtual Appliance (VA) updates from SailPoint requires that your organization sign additional legal documents, including an addendum, acknowledging assumption of increased liability and responsibility. Contact your Customer Success Manager for information. Additionally, this updated Documentation supersedes and governs any previously incorporated Documentation agreed to by you or your organization with respect to updating the VA and associated support, maintenance, and other responsibilities. To configure manual VA updates: 1. Go to **Admin > Connections > Virtual Appliances**. 1. On the card for the cluster you want to manually update, select **Menu > Update Settings**. 1. On the cluster's Update Settings page, select **Manual** for Virtual Appliance Updates. 1. Enter an email address to receive update notifications. 1. Select **Save**. It can take several hours for the new update settings to synchronize and save successfully. ## Monitoring VA Cluster Update Status The cluster cards on the Virtual Appliance Clusters page display version information, update methods, and the following informational badges relating to update status: | Badge Text | Information | | ----------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | | Updates Available | A VA update is available to apply. | | Critical Update | You are required to immediately apply critical updates to your virtual appliances. | | Out of Support | Your virtual appliances have fallen behind more than 2 update versions and are no longer supported by SailPoint. Please apply updates as soon as possible. | ## Manually Applying VA Updates To manually apply a VA update: 1. Go to **Admin > Connections > Virtual Appliances**. 1. On the card for the cluster you want to manually update, select **Apply Updates**. 1. On the Apply Updates page review the displayed version and component information. 1. Select **Confirm** when you are ready to apply the update. A message displays confirming that the virtual appliance updates are being applied. This may take several hours. ## VA Update Notifications ### Virtual Appliance Updates Available Email Template The Virtual Appliance Updates Available email is sent when a new virtual appliance (VA) update bundle is available. **Name:** Virtual Appliance Updates Available **Subject:** $PRODUCT_NAME Notification: Virtual appliance updates are available for the $clusterName cluster. **Body:** ```html

Dear recipient,

The following updates are available for your virtual appliance cluster:


Cluster Name: $clusterName

Update Type: $releaseType

Update Version: $releaseVersion


$releaseData

Please sign in to ${PRODUCT_NAME} for more information.

Thank you,
The $PRODUCT_NAME Team

``` #### Attributes This email template uses [version 1](https://documentation.sailpoint.com/saas/help/common/emails/available_templates.html#version-1-templates) global variables and the following template-specific attributes: | Name | Type | Description | | -------------- | ------ | ---------------------------------------------------------------- | | clusterName | String | The name of the cluster for which release bundles are available. | | releaseType | String | Type of new release. Example: SOFTWARE/OS | | releaseVersion | String | The version of new available release. | | releaseData | Map | Information about available updates. | ### Virtual Appliance Updates Failed Email Template The Virtual Appliance Update Failed email is sent when virtual appliance updates failed to be applied to a cluster. **Name:** Virtual Appliance Updates Failed **Subject:** $PRODUCT_NAME Notification: Virtual appliance updates failed to be applied to the $clusterName cluster **Body:** ```html

Dear recipient,

Some virtual appliance updates failed to be applied to the $clusterName cluster.

Try restarting the cluster in $PRODUCT_NAME. If the problem persists, please contact Support

Thank you,
The $PRODUCT_NAME Team

``` #### Attributes This email template uses [version 1](https://documentation.sailpoint.com/saas/help/common/emails/available_templates.html#version-1-templates) global variables and the following template-specific attributes: | Name | Type | Description | | ----------- | ------ | ------------------------------------------------- | | clusterName | String | The name of the cluster for which updates failed. | # Virtual Appliance Observability SailPoint supports the export of virtual appliance (VA) metrics and logging information to third-party monitoring tools. ## Exporting VA Metrics You can configure an Identity Security Cloud Virtual Appliance (VA) to export metrics to an observability tool of your choice. These include priority metrics, such as CPU usage, disk space, memory usage, and network traffic, and secondary metrics from SailPoint applications, such as aggregation times, CCG health status, and VA cluster uptime. SailPoint uses an OpenTelemetry agent (otel_agent) to send metrics from the VA to your preferred observability tool. The list of tools that support OpenTelemetry Protocol (OTLP) is extensive, and each requires a separate OTLP configuration from the OTEL agent to send metrics. To address this, SailPoint has selected the following widely-used tools that share a common set of OTLP agent configurations and support standard observability backends and pipelines: - Datadog - Dynatrace - Grafana Labs - Honeycomb - New Relic - SignalFX ### Configuring VA Metrics Export To enable metrics to move from the VA, you need to provide the endpoint URL and API keys to authenticate the otel_agent to the observability tool. Then, run the otel_agent within the VA to load its configuration from `/etc/otel-agent-config.yaml` and transmit metrics to your OTLP-supported backend. 1. Enable the otel_agent. - On the VA, locate the `/home/sailpoint/config.yaml` file. - Add the line `enableOTELAgent: true`. 1. Start the otel_agent service by executing the command `sudo systemctl start otel_agent`. 1. When the agent successfully starts, it creates an `otel.env` file in the `/home/sailpoint` directory. This is where you configure the OTLP endpoint and API key for the otel_agent. - Set values for: - `OTLP_ENDPOINT=""` to define the endpoint URL. - `OTLP_API_KEY=""` to define the API key. Note The VA encrypts the value inside the `otel.env` file for the OTLP_ENDPOINT and OTLP_API_KEY. If you do not define these values in the `otel.env` file, the otel_agent can still run, but it will send metrics to your SailPoint tenant rather than sending them to your observability tool. 1. After defining these values, restart the otel_agent service using the command `sudo systemctl restart otel_agent`. 1. The otel-agent automatically detects the OTLP backend and loads the appropriate configuration. 1. Check the agent’s log files at `/home/sailpoint/log/otel_agent.log`. If there are no errors and the otel_agent has detected the backend, then the configuration is successful. 1. Go to your observability tool and search for the [available VA metrics](#available-va-metrics). You can create a dashboard to monitor them more easily. Tip You can switch between observability tools by changing the endpoint and API key in the `otel.env` file and restarting the otel_agent. ### Available VA Metrics Once configured, the following system metrics will be available to your OTLP-supported observability tool: ```text system.cpu.load.average.15m system.cpu.load.average.1m system.cpu.load.average.5m system.filesystem.usage{state="free", type="ext4"} system.filesystem.usage{state="reserved", type="ext4"} system.filesystem.usage{state="used", type="ext4"} system.memory.utilization{state="buffered"} system.memory.utilization{state="cached"} system.memory.utilization{state="free"} system.memory.utilization{state="slab.reclaimable"} system.memory.utilization{state="slab.unreclaimable"} system.memory.utilization{state="used"} system.network.io ``` Available CCG metrics are: ```text ccg_healthy ccg_queue_healthy ccg_sufficient_uptime{"type":"gauge","count":1,"sum":1.0,"min":1.0,"max":1.0,"latest":1.0} ``` ### Troubleshooting VA Metrics Export Configuration The following list describes some common issues with exporting VA metrics to your observability tool and their solutions. - If otel_agent failed to start, check to be sure you've added `enableOTELAgent: true` at the bottom of the `/home/sailpoint/config.yaml` file. - Error logs in `/home/sailpoint/log/otel_agent.log` may indicate that the API key or endpoint URL is wrong or that it may have extraneous details. For example, OTLP_API_KEY should only mention the API key. Grafana Labs may provide additional information with the API key, such as: ```text OTEL_EXPORTER_OTLP_HEADERS="Authorization=Basic nlJam9pY0hKdlpDMWhjQzF643434sbjE5". ``` In this case, `OTLP_HEADERS="Authorization=Basic` is already managed in the `otel-agent-config.yaml`, so there is no need for that information here. Remove the excess information in the `otel.env` file so that it only includes `OTLP_API_KEY="nlJam9pY0hKdlpDMWhjQzF643434sbjE"`, then restart the otel_agent service using the command `sudo systemctl restart otel_agent`. - If `sudo docker logs otel_agent` has an unknown OTLP backend and no information for the Detected backend, then the otel_agent is not able to detect the observability tool because the endpoint URL is wrong. Check and correct the endpoint URL, then restart otel_agent. - The otel_agent specifically looks for the keywords `OTLP_ENDPOINT` and `OTLP_API_KEY` in the `otel.env` file. If these variables are missing or if you erase all contents from the `otel.env` file and restart the otel_agent, it will load an empty configuration, as shown below. ```text ############################## # OTLP Configuration ############################## # Set these variables to export metrics to an OTLP-compatible backend. OTLP_ENDPOINT="" OTLP_API_KEY="" # Example: OTLP_ENDPOINT="https://otlp.nr-data.net:4318" # Example: OTLP_API_KEY="ABCD1234567890" ``` Running the agent without these values will send metrics to your SailPoint tenant rather than to your observability tool. ## Exporting VA Logs You can configure a virtual appliance to send systemd logs to the following tools: - Splunk HTTP event collector (HEC) - CloudWatch Logs - Datadog ### Configuring VA Log Exports To configure VA log exports: 1. Ensure network connectivity between the VA and the monitoring tool. 1. Create or gather the tokens, URLs, or keys required to configure your specific monitoring tool. 1. Create a [`host-logging.yaml`](#example-host-loggingyaml) file in the VA's `/home/sailpoint` directory. 1. Enter the key information for your tool as shown in the following example. 1. Wait for the VA to detect the configured `host-logging.yaml`. 1. Confirm in the monitoring tool that the logs are appearing. ### Example host-logging.yaml ```text --- config: enableSailPointLogging: true loggers: - name: splunk_hec type: splunk_hec hec_host: 172.31.31.31 hec_port: 8383 hec_token: quzkajkfkdjafk insecure_ssl: true - name: cwl type: cwlogs log_group_name: sailpoint log_stream_name: sailpoint region: us-east-1 - name: thedog type: datadog api_key: 1234-1234-1234 tags: customer: foobar ``` where: - `name` is a valid YAML string. - `type` is one of the following: - `splunk_hec` - `cwlogs` - `datadog` ### Global Config Keys | Key | Required | Description | | ------------------------ | -------- | ------------------------------------------------------------------------------------------- | | `enableSailPointLogging` | No | Enables export of the SailPoint container logs in addition to the Flatcar OS system journal | ### Monitoring Tool Keys #### Splunk HEC Type: `splunk_hec` | Key | Required | Description | | -------------- | -------- | ------------------------------------------------------------------- | | `hec_host` | Yes | Hostname of HEC host | | `hec_port` | Yes | TCP port HEC is listening on | | `hec_token` | Yes | HEC token (from Splunk) | | `index` | No | Index targeted | | `insecure_ssl` | No | Bypasses certificate validity check (for development/test purposes) | #### CloudWatch Logs Type: `cwlogs` | Key | Required | Description | | ----------------- | -------- | ------------------------------------------- | | `log_group_name` | Yes | CloudWatch Logs Group Name | | `log_stream_name` | Yes | CloudWatch Logs Stream Name | | `region` | Yes | AWS region CloudWatch Logs Group resides in | #### Datadog Type: `datadog` | Key | Required | Description | | ------------------- | -------- | --------------------------------------------------------- | | `api_key` | Yes | Datadog API key | | `host` | No | Datadog API host target (defaults to US/Datadog Standard) | | `dd_source` | No | Sets the `dd_source` field | | `dd_sourcecategory` | No | Sets the `dd_sourcecategory` field | | `tags` | No | Sets additional tags (should be in key: value form) | # System and Network Requirements For successful VA deployment and configuration, your organization's environment must meet [system](#system-requirements), [network](#network-requirements), and [geography](#restricted-geographies) requirements and [allow VA traffic](#allowing-va-traffic-to-required-urls) to required URLs. ## System Requirements | | | | | | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------ | --- | | **Virtualization Environments** | | | | | Local | vSphere 8.0+ Microsoft Hyper-V Server 2016 or later Windows Server 2016 or later Minimum CPU Instruction Level: Intel Nehalem or AMD Opteron Generation 4 The hypervisor must expose these instructions to the VA. | | | | Cloud | AWS Azure GCP | | | | **Minimum VA Image Sizes** | | | | | Local | **Minimum** Processors:  4 Memory:  16 GB Storage:  128 GB | **IdentityIQ Users With AI Services** Processors:  4 Memory:  16 GB Storage:  128 GB | | | AWS EC2 Instance Size | M5.xlarge or equivalent size x86 Processors:  4 Memory:  16-32 GB Storage:  128 GB Refer to [Amazon EC2 Instance Types](https://aws.amazon.com/ec2/instance-types/) ​for details. | | | | Azure VM Instance Size | Standard_D8s_v5 or equivalent size x86 Processors:  4 Memory:  16-32 GB Storage:  128 GB Refer to [Azure Virtual Machine Sizes](https://learn.microsoft.com/en-us/azure/virtual-machines/sizes) ​for details. | | | | GCP VM Instance Size | n2-standard-4 or equivalent size x86 Processors:  4 Memory:  16-32 GB Storage:  128 GB Refer to [Machine Families Resource and Comparison Guide](https://cloud.google.com/compute/docs/machine-resource) for details. | | | | **VA Cluster Components - Required Additions to Minimum VA Image Sizes** | | | | | Enabling additional [VA Cluster Components](https://documentation.sailpoint.com/saas/help/va/deploy_va.html#enabling-cluster-components) requires increasing the Minimum VA Image Sizes by the following additional amounts. | | | | | Privileged Access Gateway | Processors:  2Memory:  4 GB | | | | Data Access Security - Resource Collector | Processors:  2Memory:  8 GB | | | | Data Access Security - Permission Collector | Processors:  2Memory:  8 GB | | | | Data Access Security - Data Classification Collector | Processors:  2Memory:  8 GB | | | | Data Access Security - Activity Monitor | Processors:  2Memory:  8 GB | | | | **VA Locations and Minimum Distributions** | | | | | Virtual Machines | 1 VA per virtual machine host. | | | | Clusters | Required. Deploy at least 2 VAs per cluster and deploy at least 1 production cluster and 1 sandbox cluster to ensure connectivity during updates and minimize the risk of downtime or data loss. | | | | VAs and Sources | - Local - Each cluster should be installed in close proximity to the connected source system. - AWS/Azure - Each cluster should be placed in the Availability Zone as close as possible to the target sources. If your organization has a VPN connection to its AWS or Azure VPC, the VAs should be hosted in the same regions hosting the network gateways for your organization. | | | | Sandbox | Required. Deploy at least 2 VAs per sandbox cluster to ensure connectivity during updates and minimize the risk of downtime or data loss. Closely monitor sandbox VA clusters and test connectivity changes before they go to production. | | | | [High Availability and Disaster Recovery](https://documentation.sailpoint.com/saas/help/va/deploy_va.html#deploying-vas-for-high-availability-and-disaster-recovery) | Required. Deploy at least 2 VAs per cluster to ensure connectivity during updates. A load balancer is not required. | | | | DMZ | [DMZ deployment is not recommended](https://documentation.sailpoint.com/saas/help/va/deploy_va.html#deployment-in-the-dmz-is-not-recommended). | | | Note For organizations implementing AI-Driven Identity Security with IdentityIQ, only 1 VA is required for connectivity. ## Network Requirements | | | | ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | DNS Servers | Required. VAs must connect to your internal DNS servers. You can connect VAs to a local DNS server behind your firewall. | | NTP Servers | Required. VAs must connect to a network time protocol (NTP) server. You can ["connect VAs to a local NTP server](#connecting-the-va-to-a-local-ntp-server) behind your firewall. | | HTTP Proxy Servers | Optional. VA traffic must be [allowed to access required URLs](#allowing-va-traffic-to-required-urls) for external sources and tools. | | Network Tunnel | Optional. VA traffic must be allowed access to the [network tunnel IP addresses](#network-tunnel-https-port-requirements) for your region. | | Third-party Monitoring | Not supported | | SailPoint-reserved IP Ranges | - 10.255.255.241/28 - If any sources reside in this range, traffic will not route properly for any VA configuration type. - 172.16.0.0/22 - If any sources reside in this range, traffic will not route properly for network tunnel VA configurations. | ### Port Requirements VA communication should be allowed through these ports in the specified directions. | | | | | | | -------- | ---------- | ------------- | --------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Port** | **Reason** | **Direction** | **IP Addresses** | **Description** | | 22 | SSH | Inbound | Internal Only (Recommended) | Used to access VA when inside your network | | 53 | DNS | Outbound | All | Used to access internal name servers and name resolution | | 123 | NTP | Outbound | All | Used for time synchronization. If you connect all of your VAs to a [local NTP server](#connecting-the-va-to-a-local-ntp-server), you can close port 123. | | 443 | HTTPS | Outbound | All | Used for HTTPS communication. The network tunnel configuration has specific requirements for this port. | Important Target systems might have their own port requirements. VAs must be allowed to communicate over the ports required by target systems. ### Network Tunnel HTTPS Port Requirements | | | | | | | -------- | ---------- | ------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------- | | **Port** | **Reason** | **Direction** | **IP Addresses** | **Description** | | 443 | HTTPS | Outbound | US East (N. Virginia): 52.206.133.183 52.206.132.240 52.206.130.59 Europe (Frankfurt): 35.157.132.22 35.157.185.79 35.157.251.228 Europe (London): 18.130.210.174 18.130.148.201 35.178.220.78 Asia Pacific (Singapore): 52.77.39.81 13.250.189.48 54.251.149.153 Asia Pacific (Sydney): 52.65.42.92 13.55.78.212 3.24.127.50 | Used for network tunnel initialization and HTTPS communication. | ### Connecting the VA to a Local NTP Server By default, VAs are configured to communicate with external network time protocol (NTP) servers using port 123. If you do not want to allow outbound access for port 123, you can configure your VAs to communicate with NTP servers behind your firewall. Each VA must be configured individually. While you do not have to configure every VA to use your NTP server, you cannot close port 123 until all of your VAs have been configured to use internal NTP servers. Complete the following steps to connect a VA to a local NTP server: 1. Edit the `timesyncd.conf` file using the full path: `sudoedit /etc/systemd/timesyncd.conf` 1. Add entries to the NTP line for local servers using the server host names or IP addresses. More than one server can be added, separated by a space. Examples: `NTP=chronos.acme.com` `NTP=chronos1.acme.com chronos2.acme.com` Caution Be sure to remove the # sign on the NTP line before adding server names. 1. Save the changes to the `timesyncd.conf` file. 1. Restart the `systemd-timesyncd` daemon: `sudo systemctl restart systemd-timesyncd` 1. To verify the UTC time status on the VA run: `timedatectl status` ### Deep Packet Inspection Support SailPoint VAs can be configured to trust a private root certification authority (CA) and any certificates that have that CA in their trust chain, such as those from deep packet inspection (DPI) transport layer security (TLS) inspection solutions. SailPoint VAs reject untrusted certificates. SailPoint is unable to provide guidance on specific DPI implementation issues beyond setting up root CA certificate trust. Contact your Customer Success Manager for information regarding DPI. ## Restricted Geographies Contracts for SailPoint products restrict customers from installing a VA in any country that has data residency or data transmission restrictions, including, but not limited to, Russia and China. The customer must install the VA in a SailPoint-approved country and is responsible for any legal compliance for the transfer of data from countries like China and Russia to that VA for use in our products, including data residency restrictions. ## Allowing VA Traffic to Required URLs Depending on your firewall configuration, you may need to add URLs to the allow list. If you are required to add outbound traffic to the allow list, and your firewall does not support domain entries, consider using a [network tunnel VA configuration](https://documentation.sailpoint.com/saas/help/va/config_va.html#network-tunnel-va-configuration). Notes - These lists are subject to change without notice. - Allowing IP addresses of connected service endpoints is not supported. ### Primary URLs The following table lists URLs that must be accessible to the VA, regardless of the VA region. | | | | | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------ | --------------------------------------------------------------------------------------------------------------- | | **URL** | **Source** | **Purpose** | | \*.flatcar-linux.net \*.flatcar-linux.org | Flatcar | Used for security patches and software updates | | \*.identitynow.com \*.api.identitynow.com \*.sailpoint.com \*.secure-api.infra.identitynow.com va-access.infra.identitynow.com FedRAMP users only: \*.sailpointfedramp.com \*.secure-api.saas.sailpointfedramp.com va-docker.secure-api.saas.sailpointfedramp.com | SailPoint | Allows the VA to: - Communicate with SailPoint - Retrieve service updates - Make REST requests to SailPoint | | \*.launchdarkly.com | LaunchDarkly | Sailpoint uses this service to manage feature releases. | | NTP | N/A | Allows the clock to sync to standard. **NOTE**: This is only applicable if you're using an external NTP server. | ### Region-Specific AWS URLs The services in this section must be accessible, but the URLs you must add to the allow list depend on the region configured for your VA. For example, SailPoint places messages into SQS in your region. The VA checks the queue for messages about work it needs to complete. | | | | ------------------------- | -------------- | | **Supported AWS Regions** | **Code** | | US East (N. Virginia) | us-east-1 | | US West (Oregon) | us-west-2 | | US-West (GovCloud) | us-gov-west-1 | | Asia Pacific (Mumbai) | ap-south-1 | | Asia Pacific (Singapore) | ap-southeast-1 | | Asia Pacific (Sydney) | ap-southeast-2 | | Asia Pacific (Tokyo) | ap-northeast-1 | | Canada (Central) | ca-central-1 | | Europe (Frankfurt) | eu-central-1 | | Europe (London) | eu-west-2 | | Middle East (UAE) | me-central-1 | | South America (São Paulo) | sa-east-1 | Contact your SailPoint deployment team to determine the region you need to use. You must always allow: - The us-east-1 URL for each of these services, even if your region is located elsewhere. - The region-specific URL for each of these services if your tenant is in a region other than us-east-1. The following table lists region-specific URLs that must be accessible to the VA. Replace `` with the AWS region where your tenant resides. | | | | -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Service** | **Region-specific URLs to Allow** | | S3 | \*.s3.us-east-1.amazonaws.com and  \*.s3.\.amazonaws.com FedRAMP users only: \*.s3-fips.us-gov-west-1.amazonaws.com Refer to [AWS Regional endpoints](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). | | SQS | sqs.us-east-1.amazonaws.com and  sqs.\.amazonaws.com Refer to [Amazon Simple Queue Service endpoints](https://docs.aws.amazon.com/general/latest/gr/sqs-service.html). | | DynamoDB | dynamodb.us-east-1.amazonaws.com and dynamodb.\.amazonaws.com Refer to [Amazon DynamoDB endpoints](https://docs.aws.amazon.com/general/latest/gr/ddb.html). | | Elastic Container Registry | 874540850173.dkr.ecr.\.amazonaws.com Refer to [Amazon ECR endpoints](https://docs.aws.amazon.com/general/latest/gr/ecr.html). | | Firehose1 | firehose.us-east-1.amazonaws.com and  firehose.\.amazonaws.com FedRAMP users only: firehose-fips.us-gov-west-1.amazonaws.com Refer to [Amazon Kinesis Data Firehose endpoints](https://docs.aws.amazon.com/general/latest/gr/fh.html). | 1 Required only for AI-Driven Identity Security with IdentityIQ ### IdentityIQ Customers Using IAI Harvester Only For IdentityIQ customers using the IAI Harvester, the following URL must be accessible to the VA: \*.launchdarkly.com If you are unable to use this URL, you may instead allow these specific URLs: - app.launchdarkly.com - events.launchdarkly.com - stream.launchdarkly.com - sdk.launchdarkly.com - clientstream.launchdarkly.com - clientsdk.launchdarkly.com ### Deprecated Allow List URLs If your organization has previously added these now-deprecated URLs to your firewall allow list, you do not need to remove them. However, SailPoint recommends updating your firewall allow list to those listed in [Primary URLs](#primary-urls). | | | | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------- | | **Deprecated URL** | **Source** | | s3.amazonaws.com \*.s3.amazonaws.com | AWS | | api.ecr.us-east-1.amazonaws.com ecr.us-east-1.amazonaws.com 874540850173.dkr.ecr.us-east-1.amazonaws.com FedRAMP users only: api.ecr.us-gov-west-1.amazonaws.com ecr.us-gov-west-1.amazonaws.com ecr-fips.us-gov-west-1.amazonaws.com 240112628119.dkr.ecr-fips.us-gov-west-1.amazonaws.com 240112628119.dkr.ecr.us-gov-west-1.amazonaws.com 229634586956.dkr.ecr-fips.us-gov-west-1.amazonaws.com 229634586956.dkr.ecr.us-gov-west-1.amazonaws.com | Elastic Container Registry | # Loading Identity and Access Data Note Identity Security Cloud is SailPoint’s next-generation identity security solution. It encompasses and builds on features and functions from IdentityNow. The product documentation covers both Identity Security Cloud and IdentityNow features. Identity Security Cloud collects identity and access information about the people in your organization from your enterprise systems. It attaches accounts and access data to identities to give you an overall view of each person's access rights. To facilitate this, you need to: - [Manage emergency access admins](https://documentation.sailpoint.com/saas/help/setup/ea_admin.html) to ensure administrative Identity Security Cloud access regardless of enterprise network availability. - [Load account data](https://documentation.sailpoint.com/saas/help/accounts/loading_data.html) by defining sources and aggregating their accounts and access. - [Create identity profiles](https://documentation.sailpoint.com/saas/help/setup/identity_profiles.html) to define authoritative sources of identities. - [Configure Multifactor Authentication](https://documentation.sailpoint.com/saas/help/common/strong_auth.html) to define the required authentication methods for your users. - [Assign source accounts to identities](https://documentation.sailpoint.com/saas/help/accounts/correlation.html) based on account correlation attributes. - [Use identity processing](https://documentation.sailpoint.com/saas/help/setup/identity_processing.html) to keep your configurations and your identity data in sync. - [Load entitlements](https://documentation.sailpoint.com/saas/help/access/entitlements.html) to reflect all available access, including descriptions and display names. # Updating Emergency Access Administrators When an identity profile uses a flat file source as its account source, the admins listed in that flat file have special emergency, or break glass, access so they can sign in when your site is having connectivity issues to troubleshoot and repair problems. When you first gain access to your orgs, you're granted one emergency access administrator. You can add or remove emergency access admins by editing the file containing the emergency access administrator identity information. Note Emergency access administrators are frequently referred to as *break glass administrators*. **Prerequisites:** - SailPoint has created your org and given you access to an initial administrator account. - At least one identity profile exists with a flat file account source. ## Updating Emergency Access Administrators List Download the emergency access administrator file to add, remove, or update information in the file. **To download the list of emergency access administrators:** 1. Go to **Admin > Connections > Sources**. 1. Select or edit the **IDN Administrator** source. 1. In the **Account Management** section, select **Accounts**. 1. Select **Export** to download the current list of emergency access administrators. 1. Open the .csv file and review the list of accounts. Each administrator has one row under each column header. Column headers represent account attributes. 1. Update, add, or remove rows for each administrator as needed. **Do not add or remove any column headers.** Save the .csv file. Important - When this file is uploaded, the identities provided are used as the complete set of emergency access admins for the site. Removing an account from this file and uploading the file removes that identity from Identity Security Cloud. - Do not include the SailPoint Support identities *slpt.support* or *slpt.services* in this file. These identities are used to allow the SailPoint support team to troubleshoot your site. To grant or disable access to these identities, visit [Granting Support Access to Your Site](https://documentation.sailpoint.com/saas/help/common/grant-tenant-access.html). - Do not delete the *slpt.support* or *slpt.services* identities from your site. If these accounts are deleted, SailPoint Support might be unable to sign in to your site to help with implementation or troubleshooting. 1. In the **Account Management** section, select **Account Aggregation**. 1. Under **Import Accounts**, select the **Upload** icon and choose the .csv file of accounts. While an aggregation is running, the Start Aggregation button will be disabled. You can view the progress of this aggregation in the Latest Account Aggregation section on this page. You can cancel the aggregation by selecting **Cancel** at the top of the aggregation card. You can also view aggregation activity on the [**Aggregation History**](https://documentation.sailpoint.com/saas/help/accounts/loading_data.html#viewing-account-aggregation-history) page. You can also [cancel](https://documentation.sailpoint.com/saas/help/accounts/loading_data.html#canceling-an-aggregation) the aggregation from this page. ## Setting Up Emergency Access Administrators After adding users to the emergency access admins flat file, grant them admin access. 1. Go to **Admin > Identity Management > Identities** and find the identities you have designated as emergency access administrators. 1. Select **Actions** **> Set User Levels**. 1. Enable the toggle for the **Admin** user level and select **Save**. ## Inviting New Emergency Access Administrators Invite new emergency access admins who are also new users to Identity Security Cloud. Refer to [Inviting Users to Register](https://documentation.sailpoint.com/saas/help/common/users/inviting_users.html) for instructions. # Getting Started in Identity Security Cloud Welcome to SailPoint! To get the most out of SailPoint's SaaS offerings, review the following information about setting up your site for the first time. Note Identity Security Cloud is SailPoint’s next-generation identity security solution. It encompasses and builds on features and functions from IdentityNow. The product documentation covers both Identity Security Cloud and IdentityNow features. ## Register a Device If you are signing into Identity Security Cloud using an identity provider (IdP) for the first time, you will be asked to configure an external authenticator immediately after signing in. This is a one-time requirement that will ensure you can access SailPoint if you need to bypass SSO, like with [emergency admin accounts](https://documentation.sailpoint.com/saas/help/setup/ea_admin.html). Refer to [Registering a Time-Based One-Time (TOTP) Device](https://documentation.sailpoint.com/saas/help/common/strong_auth.html#registering-a-time-based-one-time-password-totp-device) for more information. ## Add Initial Administrators Before you can begin setting up your site, you'll need one or more emergency access administrators. - [**Updating Emergency Access Administrators**](https://documentation.sailpoint.com/saas/help/setup/ea_admin.html) Emergency access administrators can sign in to your site even if your connectivity is interrupted, which allows them to make changes and troubleshoot your site to get it working again. When you're first given access to your new tenant, SailPoint has already created one of these administrators for you, which you'll use to sign in and add more admins. ## Load Data Identity Security Cloud manages your identity and access data, but that data comes from sources. You can connect those sources to Identity Security Cloud and link together accounts that belong to the same person in the form of an identity. - [**Identity Security Cloud SaaS Connectors**](https://documentation.sailpoint.com/connectors/isc/landingpages/help/landingpages/isc_landing.html) If you want to upload data to Identity Security Cloud from a source without a virtual appliance cluster, use a SaaS connector. - [**Create Virtual Appliances**](https://documentation.sailpoint.com/saas/help/va/get_started_va.html) If you want to directly connect to any of your sources to load account data, you'll need a virtual appliance (VA). Virtual appliances allow you to connect your tenant to your sources without compromising your firewall. ### Create Identities An identity serves as a way to store all of a user's account and access data in a single place. - [**Create Initial Sources**](https://documentation.sailpoint.com/saas/help/sources/config_sources.html) Many organizations have a few sources that, together, have records for every user in the organization. These might be HR or directory sources, and they should be created first so that their data is considered the highest priority. You can create other sources later. Review our [supported sources](https://documentation.sailpoint.com/connectors/isc/landingpages/help/landingpages/isc_landing.html) so you can choose the best sources for your environment. - [**Create Identity Profiles**](https://documentation.sailpoint.com/saas/help/setup/identity_profiles.html) Creating an identity profile turns a source into an authoritative source. It also means that any accounts aggregated from this source become identities, and any other accounts aggregated for those users can be associated with their identities. - [**Load Initial Accounts**](https://documentation.sailpoint.com/saas/help/accounts/loading_data.html) Load accounts from those sources. This is also known as an aggregation. ### Load Other Account and Access Data Once you've created the identities for your organization, you can add information about their other accounts and access. - [**Create Additional Sources**](https://documentation.sailpoint.com/saas/help/sources/config_sources.html) Configure connections to the rest of the sources in your environment and [load accounts](https://documentation.sailpoint.com/saas/help/accounts/loading_data.html) from those sources. - [**Correlate Accounts to Identities**](https://documentation.sailpoint.com/saas/help/accounts/correlation.html) Each account you aggregate can be associated with one of the identities you created earlier, so all of their accounts and access can be viewed in one place. - [**Load Entitlement Data**](https://documentation.sailpoint.com/saas/help/access/entitlements.html) Aggregate the access data from each of your sources so that those entitlements can be managed. ## Configure Security Settings You'll want to make sure that every time an identity in your site signs in, they're the right person and they're allowed to do so. You can configure any or all of the following measures to help keep your site safer: - [**Set Up Strong Authentication**](https://documentation.sailpoint.com/saas/help/common/strong_auth.html) Strong authentication, sometimes called multifactor authentication, requires users to prove their identity before they can change their password. - [**Configure Network and Location Settings**](https://documentation.sailpoint.com/saas/help/access/restrict_access.html) You can block or allow users who are signing in from specific locations or from outside of your network. - [**Configure Lockout Settings**](https://documentation.sailpoint.com/saas/help/setup/lockout.html) Decide how many times a user can enter an incorrect password before they're locked out of the system. - [**Configure Session Lengths**](https://documentation.sailpoint.com/saas/help/setup/lockout.html) Decide how long a user can stay signed in to your tenant without reauthenticating, and how long they can be idle before they're signed out. ## Configure SailPoint’s Cloud Services Now that the framework of your site has been set up, review the documentation about each cloud service you've subscribed to for more information about configuring each feature. - [**Access Request**](https://documentation.sailpoint.com/saas/help/requests/index.html) - [**Certifications**](https://documentation.sailpoint.com/saas/help/certs/index.html) - [**Password Management**](https://documentation.sailpoint.com/saas/help/pwd/index.html) - [**Separation of Duties**](https://documentation.sailpoint.com/saas/help/sod/index.html) You can track the status of Identity Security Cloud and its services at [status.sailpoint.com](https://status.sailpoint.com/). You can also review the documentation for some of SailPoint's other products that can be integrated with Identity Security Cloud. - [**Access Risk Management**](https://documentation.sailpoint.com/access-risk-mgmt/help/) - [**AI-Driven Identity Security**](https://documentation.sailpoint.com/saas/help/ai/index.html) ## Invite Users Finally, if you've decided that your users should have access to your site to review certifications, manage their passwords, or complete other tasks, you can [invite them](https://documentation.sailpoint.com/saas/help/common/users/inviting_users.html) to Identity Security Cloud. After you've completed your initial setup, you're ready to dive into the more detailed aspects of [managing identities](https://documentation.sailpoint.com/saas/help/identities/index.html) and [governing their access](https://documentation.sailpoint.com/saas/help/access/index.html). ## Using the Resource Center The Resource Center provides a collection of resources to help administrators learn about, set up, and use the features and capabilities of Identity Security Cloud. The Resource Center icon is displayed at the bottom right of the screen. Select the icon to open the Resource Center to: - Access product documentation. - View product tours with in-app guides for common features. - Access the customer support portal to view knowledge articles and report issues with your service. - Find announcements about new product updates. A badge is displayed when new announcements are available. - View other helpful resources including service health status and training. Tip To dismiss the announcements badge, open the Resource Center and view the product updates. # Processing Identity Data When changes occur to identity data or access model configurations (identity profiles, roles, access profiles, or applications), corresponding access for your identities may also need to change. These changes happen through identity processing, which can be initiated in response to events, scheduled, or executed manually. - [Event-based processing](#event-based-processing) immediately processes identity data for identities changed during an aggregation and for identities modified in provisioning actions. - [Scheduled processing](#scheduled-processing) occurs every morning and evening for identities that meet the requirements. - [Time-based processing](#time-based-processing) uses an identity attribute to schedule the exact date and time an identity will be processed. - [Manual processing](#manual-processing) can be initiated following changes to configurations like role definitions or identity attribute mappings. These actions were previously performed by the process known as an identity refresh. ## Event-Based Processing When an aggregation or provisioning process modifies an identity, that event initiates identity processing to automatically analyze the identity to make sure the rest of their data is accurate. If the identity's data is out of sync with the configurations, it performs these changes: 1. Updates identity attribute according to the [identity profile](https://documentation.sailpoint.com/saas/help/setup/identity_profiles.html) mappings. 1. Determines the identity’s correct manager through [manager correlation](https://documentation.sailpoint.com/saas/help/sources/manager_correlation.html). 1. Updates the identity’s access according to their assigned [lifecycle state](https://documentation.sailpoint.com/saas/help/provisioning/lifecycle.html). 1. Updates the roles assigned to the identity based on the criteria they meet, and updates their access based on which roles were added to or removed from them. However, identity processing does not validate that access was successfully provisioned to the identity after starting the provisioning process. ## Scheduled Processing In some identity profiles, lifecycle states and other identity attributes are calculated through rules or transforms that determine values based on time, rather than on aggregated data. Example The lifecycle state attribute is commonly calculated with a [transform](https://developer.sailpoint.com/docs/extensibility/transforms/operations/date-math/#transform-structure) that compares the current date to a hire date or termination date attribute. Scheduled identity processing runs twice daily, at 8:00 AM and 8:00 PM in the tenant's configured time zone (default CST/CDT). - At 8:00 AM: - Active and Inactive (short-term) identities with an account on a source configured with [attribute synchronization](https://documentation.sailpoint.com/saas/help/provisioning/attr_sync.html) are processed. - This operation performs all necessary actions for [event-based processing](#event-based-processing) for the specified identities. To optimize system performance, Identity Security Cloud updates identity attribute data and reevaluates user access data (roles and lifecycle-driven access) for only those identities with changes. - At 8:00 PM: - If your site has any roles implemented, Active and Inactive (short-term) identities are automatically processed. - If you have no roles defined, identities are processed based on their identity profile. If any of its identity attributes are marked as requiring a periodic refresh, Active and Inactive (short-term) identities are processed. - This operation performs all necessary actions for [event-based processing](#event-based-processing) for the specified identities. To optimize system performance, Identity Security Cloud updates identity attribute data and reevaluates user access data (roles and lifecycle-driven access) for only those identities with changes. Notes - The scheduled processing jobs are queued for execution at the specified times. Other queued or in-progress operations may delay the job start. - Times are based on your site's [configured time zone](https://developer.sailpoint.com/docs/api/beta/org-config) (default CST/CDT). ## Time-Based Processing Time-based processing uses the `nextProcessing` identity attribute to determine the next date and time an identity should be processed. This identity attribute must be configured per identity profile. Identities will be refreshed at the date and time set in this attribute, as well as during [scheduled processing](#scheduled-processing). **To configure time-based processing:** 1. Go to **Admin > Identity Management > Identity Profiles** and select the identity profile you want to edit. 1. Select **Mappings**. 1. Map the **Next Processing Date** (`nextProcessing`) attribute to an account attribute containing the date the identity should be processed next. Important - Ensure the date occurs in the future and uses [ISO 8601](https://www.iso.org/iso-8601-date-and-time-format.html) format. You can use a [transform](https://developer.sailpoint.com/docs/extensibility/transforms/) to convert the date to ISO 8601 format. - The value for the `nextProcessing` attribute must be set for at least an hour after the `nextProcessing` identity attribute was updated in Identity Security Cloud. The `nextProcessing` attribute is often mapped to a start date or an end date. This attribute can be assigned a [transform](https://developer.sailpoint.com/docs/extensibility/transforms/operations/static/) so that the next processing date is calculated based on your business needs. For example, you can build a transform that represents the following logic, which will evaluate the `startDate` and `endDate` attributes and select the earliest future date: ```text if (startDate > now) return startDate + "T06:00:00" else if (endDate > now) return endDate + "T15:00:00" else return null ``` For additional information on using transforms to set the next processing date, refer to the [Developer Community](https://developer.sailpoint.com/discuss/t/time-based-identity-refresh/135906). 1. Select **Save** to complete the mapping. Best Practice If you've used transforms in your mappings, SailPoint recommends [previewing and verifying your identity profile changes](https://documentation.sailpoint.com/saas/help/setup/identity_profiles.html#verifying-mappings-with-preview) before selecting **Apply Changes**. The next time this source is aggregated, this value will be populated for identities and they will be processed as applicable at the assigned date and time. The identity will undergo processing at that date and time, in addition to during scheduled processing. ## Manual Processing When you create or edit identity profiles, roles, or access profiles, you must manually initiate identity processing to update your identities. This is required to apply your access model updates to your identities and recalculate access requirements, even when the identities have not changed. You can also initiate identity processing for selected identities. ### Manual Processing for All Identities To manually start identity processing, select **Apply Changes** on an identity profile or on the role, access profile, or application list pages. This performs the actions described in [event-based processing](#event-based-processing) for the affected identities: - From the role, access profile, and application pages, this runs for Active and Inactive (short-term) identities. - From the identity profile, this runs for identities associated with that profile. Best Practice These processes are time- and resource-intensive. For best results: - Complete all desired role, access profile, and application changes before selecting **Apply Changes** to recalculate membership and access for all of those at once. - Save and preview your identity profile changes to verify the expected results before selecting **Apply Changes**. When you select **Apply Changes** for roles, access profiles, or applications, you can select **Review recent configuration changes** before you initiate the job. This will open a pre-defined search showing changes made since manual identity processing was last initiated for all identities through the role, access profile, and application pages. This can help you anticipate the impact of the identity processing job you are initiating. ### Manually Processing for Select Identities You can also initiate identity processing for a set of identities. 1. Go to **Admin > Identity Management > Identities** and find the identity you want to process. 1. Select **Actions** **> Process Identity**. This performs the actions described in [event-based processing](#event-based-processing) for the affected identity. To process multiple identities, select the checkboxes next to the identities you want to process, select the **Actions** menu, and choose **Process Identities**. ## Monitoring Identity Processing When identity processing is executing, you can go to **Admin > Dashboard > Monitor** to monitor the running process in the Active Jobs list. You can also use Search to review audit records of identity processing jobs initiated with Apply Changes. Use this query to see the start and end records for each execution: `name:"Manual Identity Processing Started" OR name:"Manual Identity Processing Passed"`. ## Synchronizing Identity Data After Processing When an identity changes after processing, its data is synchronized across connected services like [Search](https://documentation.sailpoint.com/saas/help/search/index.html) and other systems. Identities are typically synchronized at the same time they are updated. However, in some cases, identities are not processed yet have data changes that affect associated identity data. To capture these cases, the SYNCHRONIZE_IDENTITIES job runs daily at 1:00 AM CST/CDT (6:00 AM UTC) in every tenant. This reconciliation job scans eligible identities in the tenant, determines which changes are necessary, and synchronizes them as needed. Note Identities in the Inactive (long-term) [identity state](https://documentation.sailpoint.com/saas/help/provisioning/lifecycle.html#identity-state) are excluded from the SYNCHRONIZE_IDENTITIES job to reduce the system resource consumption and ensure other nightly scheduled jobs are completed. The job’s speed depends on system load and other identity-related operations. For example, provisioning processes and aggregations may lock identities to maintain their state. For these cases, synchronization will occur after these locks are released. Note Submit a [Support](https://community.sailpoint.com/t5/Working-With-Support/ct-p/WorkWithSupport) ticket to adjust the time that the SYNCHRONIZE_IDENTITIES job is scheduled to run. ## Confirming Identity Update Status Identity data shows when each user was last updated in Identity Security Cloud. 1. Go to **Admin > Identity Management > Identities**. 1. Find and select an identity. 1. In the **Details** tab, view the **Modified** date to determine when the identity was updated. # Creating Identity Profiles Most organizations have one or two *authoritative sources*: sources that provide a complete list of their users, such as an HR source or Active Directory. When you define a source as authoritative in Identity Security Cloud, an identity is created for each of its accounts. You make a [source](https://documentation.sailpoint.com/saas/help/accounts/loading_data.html) authoritative by configuring an identity profile for it. The identity profile determines: - Security settings for the identities associated to the identity profile, such as authentication settings. - Mappings for populating identity attributes for those identities. - The access granted to or removed from those identities when Provisioning is enabled and their [lifecycle states](https://documentation.sailpoint.com/saas/help/provisioning/lifecycle.html) change. ## Prioritizing Authoritative Sources Each identity can be associated to only one identity profile. If a user can exist in multiple authoritative sources for your organization, it is important to set the priority order of those sources' identity profiles correctly. Identities will be associated with the highest priority identity profile where they have an account on its authoritative source. By default, identity profiles are prioritized based on the order they were created. The earlier an identity profile is created, the higher priority it is assigned. If you need to change this order, you can use the [Update Identity Profile API](https://developer.sailpoint.com/docs/api/beta/update-identity-profile) to change the identity profiles' `priority` attribute values. ## Setting Up Identity Profiles 1. Go to **Admin > Identity Management > Identity Profiles**. 1. Select **Create New**. 1. Enter a name for your identity profile. As a best practice, describe the source for this identity profile. 1. Choose a source from the dropdown list. This source will become an authoritative source, and the source's users will become identities in Identity Security Cloud. 1. Enter a description for this identity profile. 1. Configure the identity profile's sign-in and security settings: **Invitation Options** - Unless you configure external authentication options (such as pass-through authentication or single sign-on), only invited users can sign in to your tenant. You can choose to invite users manually or automatically. If you have the provisioning service enabled for your org, you can configure the identity profile to automatically invite users to join Identity Security Cloud when they enter a specific lifecycle state. - Refer to [Inviting Users to Register with Identity Security Cloud](https://documentation.sailpoint.com/saas/help/common/users/inviting_users.html#inviting-users-manually) for details. **Sign-in Method** - **`< Site >` User Name & Password** - Users in this identity profile sign in to Identity Security Cloud with the username and password created during their registration process. - **Directory Connection** - Users loaded from the identity profile sign in using the password associated with the source selected from the Authentication Source dropdown list. This type of authentication is also referred to as [*pass-through authentication*](https://documentation.sailpoint.com/saas/help/common/pta.html). - **Multifactor Authentication** - Users in this identity profile sign in using a mobile authenticator application such as Google Authenticator or Duo Mobile. *Admins will still be required to use [MFA](https://documentation.sailpoint.com/saas/help/common/strong_auth.html) even if this checkbox is disabled on the identity profile.* **Password Reset and User Unlock Settings** - **Enable Two-Factor Authentication** - Select this option to require users to complete two (rather than the standard one) of the enabled Password Reset and User Unlock Methods before resetting their passwords or unlocking their Identity Security Cloud accounts. Refer to [Enabling Two-Factor Authorization](https://documentation.sailpoint.com/saas/help/pwd/pwd_reset.html#enabling-two-factor-authentication) for more information. - **Mask Phone Numbers** - Select this option to enable phone number masking when users are resetting their passwords. **Block Access From** - **Off Network** - If you select this option, users with IP addresses outside of your specified network block won't be able to sign in to Identity Security Cloud. Configure a network block in [Restricting Identity Security Cloud Access](https://documentation.sailpoint.com/saas/help/access/restrict_access.html#specifying-network-ip-restrictions). Caution If you select **Off Network** without specifying a network definition, all users associated with the identity profile will be blocked from accessing Identity Security Cloud. - **Untrusted Geography** - You might have configured a list of [untrusted countries](https://documentation.sailpoint.com/saas/help/access/restrict_access.html#specifying-a-block-list-or-allow-list). If you select this option, users in those countries won't be able to access Identity Security Cloud. Alternatively, you might have created a list of [trusted countries](https://documentation.sailpoint.com/saas/help/access/restrict_access.html#specifying-a-block-list-or-allow-list). If this is the case, and you select this option, users outside of those trusted countries won't be able to access Identity Security Cloud. **Password Reset and User Unlock Methods** - Select the checkbox beside the options you want users to have for resetting their Identity Security Cloud passwords or unlocking their accounts. You can learn about the available methods in [Configuring User Authentication for Password Resets](https://documentation.sailpoint.com/saas/help/pwd/pwd_reset.html#setting-password-reset-and-user-unlock-methods). 1. Select **Save**. Note An identity profile cannot be created while an account aggregation is running. Now that you've set up an identity profile, you are ready to map the identity profile attributes to the appropriate source attributes. ## Defining Identity Profile Attributes Mappings define how each identity profile's attributes, also known as *identity attributes*, should be populated for its identities. Identity attributes can be mapped from account attributes on any source and can differ for each identity profile. For example, your Employees identity profile could map most attributes from your HR system while the email attribute is sourced from Active Directory. At the same time, contractors' information might come exclusively from Active Directory. You can also configure and apply a [transform](#transform) or [rule](#rules) if you need to make changes to a source value in setting your identity attributes. Important The special characters `* ( ) & ! .` cannot be used in the source attribute mapped to a username or alternative sign-in attribute. If the username or other sign-in attribute includes any of these special characters, the user associated with the identity may not be able to sign in to or otherwise access your tenant. ### Mapping Identity Attribute Values The Mappings page contains the list of identity attributes. This includes both the default attributes included with Identity Security Cloud and identity attributes you have added for your site. Default attributes should not be deleted. Contact SailPoint Support for assistance. Default Attributes The following attributes are available by default in newly-created tenants: - city - costCenter - country - department - displayName - email - endDate - firstname - identificationNumber - inactive - initials - lastname - licenseStatus - location - locationCode - middleName - nextProcessing - organization - personalEmail - phone - postalCode - preferredName - startDate - state - streetAddress - timezone - title - uid - workPhone **To map identity attributes for identities in an identity profile:** 1. Open the identity profile you want to edit and select **Mappings**. In some cases, Identity Security Cloud sets a default mapping from attributes on the account source. Required Attributes - The identity attributes **User Name** (uid), **Work Email** (email), and **Last Name** (lastname) are required. They must be set with a mapping for each identity profile and cannot be null for any identity. - User Name must be unique across all identities from any identity profile. - Work Email cannot be null but is not validated as an email address. 1. To change or set the source attribute mapping for an identity attribute: - Select the desired source from the **Source** dropdown list. - Select a source attribute from the **Attribute** dropdown list. 1. If an identity attribute cannot be set directly from a source attribute, you can use a [transform](https://developer.sailpoint.com/docs/extensibility/transforms/) or [rule](https://developer.sailpoint.com/docs/extensibility/rules/) to calculate the attribute value. - To apply a transform, choose a source and an attribute, then choose a transform from the **Transform** dropdown list. Transforms Identity Security Cloud provides the following **simple** transforms: - E.164 Phone Format - Converts a phone number into the [E.164 standard](http://en.wikipedia.org/wiki/E.164) for phone numbers. - ISO3166 Country Format - Converts the name of a country into the two-character [ISO 3166](https://en.wikipedia.org/wiki/ISO_3166) format for countries. - Remove Diacritical Marks - Converts [diacritical marks](https://en.wikipedia.org/wiki/Diacritic) to their base characters. - ToLower - Converts the value in the selected attribute to lowercase letters. - ToUpper - Converts the value in the selected attribute to uppercase letters. Additional transforms available for tenants onboarded after February 7, 2024. - RFC5646 - Converts an incoming string into an RFC 5646 language tag value. - User Preferred Name - Converts an identity’s Display Name value using the Preferred Name value when it exists over the Given Name value. The Family Name value is then appended to form the complete Display Name. You can combine simple transforms to create **complex** transforms that perform multiple operations on a single attribute, like automatically calculating an identity's lifecycle state based on the start date attribute. You can also [create and upload transforms](https://developer.sailpoint.com/docs/api/v3/transforms). Note that if you contact SailPoint Services to help with this effort, it will be considered a billable service. Important - To allow identities with this profile to use [international phone numbers](https://documentation.sailpoint.com/saas/user-help/getting_started/country_codes.html), you must apply the E.164 Phone Format transform to the Work Phone attribute. - Adding a multi-value attribute to a mapping transform will take the first value only and transform it to a single value attribute. - To use a rule, choose **Complex Data Source** from the **Source** dropdown list and select a rule from the **Transform** dropdown list. Note Rules can provide more flexibility to perform complex calculations of identity attributes, modify provisioning instructions, interact with a connector, and more. Unlike transforms, rules must be reviewed by SailPoint Services before they can be implemented for your org. Refer to the [Developer Community Rules documentation](https://developer.sailpoint.com/docs/extensibility/rules/) for guidelines and review information. 1. To unmap an attribute, select **None** from the **Source** dropdown list. Special Attributes - If you want to use [lifecycle states](https://documentation.sailpoint.com/saas/help/provisioning/lifecycle.html) to perform provisioning tasks, the **Lifecycle State** attribute must be mapped. - If you plan to use functionality that requires users to have a manager, ensure the **Manager Name** attribute is mapped, and then define [manager correlation logic](https://documentation.sailpoint.com/saas/help/sources/manager_correlation.html) for the source. Download an [audit report](https://documentation.sailpoint.com/saas/help/common/audit-reports.html#reporting-overview) for a list of identities without managers. - If identity attributes are enabled, the identity's Details page displays the `personalEmail` and `phone` attributes set by the user on their Preferences page. These attributes’ values are unaffected by aggregation changes and will only update if the user updates the attributes in their preferences. ### Adding Identity Attributes You can define custom identity attributes for your site. Any attribute you add under any identity profile will appear in all of your identity profiles, but you do not have to map and use all attributes in all identity profiles. **To add a new attribute for your site:** 1. Select **Add New Attribute** at the top of the **Mappings** page. 1. In the **Add New Attribute** overlay, enter the name for the new attribute. The Name field only accepts letters, numbers, and spaces. The Technical Name field populates automatically with a camel case version of the name you typed in the Name field. 1. Select **Add** to save and add the new attribute. 1. Map the attribute to a source and source attribute as described in the [mapping instructions](#mapping-identity-attribute-values) above. 1. Repeat these steps for any additional attributes, and then select **Save**. 1. Use the **Preview** feature to [verify your mappings](#verifying-mappings-with-preview). Make any needed adjustments and save your changes. 1. Select **Apply Changes** at the top of the page to apply your changes to the identity profile's identities. ### Verifying Mappings with Preview Use preview to verify your mappings using your data. 1. Select **Preview** at the upper-right corner of the Mappings page of an identity profile. 1. Select an **Identity to Preview** and verify that your mappings populate their identity attributes as expected. 1. To return to the **Mappings** page to edit or apply your changes, select **< Mappings** at the top of the page. ### Deleting Identity Attributes You can delete custom attributes you no longer need. This deletes them from all identity profiles. Be mindful of where the attribute may be in use in your implementation and the [implications of deleting them](#impact-of-deleting-a-custom-identity-attribute). To delete a custom attribute: 1. Select **Remove** on the attribute you want to delete. This immediately removes the attribute from the mappings list, though it is not yet deleted. 1. Select **Save**. 1. Review the warning message about deleting custom attributes. Select **OK** to proceed with the deletion, or select **Cancel** to abort the deletion and restore the attribute to the mappings list. Note If you select **Cancel**, all other unsaved changes will also be reverted. #### Impact of Deleting a Custom Identity Attribute Deleting a custom identity attribute may have unintended consequences. - Deleting a custom attribute from an identity profile deletes the attribute from all identity profiles, not just the identity profile you are editing. You must individually run identity processing on each identity profile in the Identity Profiles list. This is required even if the attribute is not mapped in the identity profile. - Deleting the attribute could cause data integrity issues if it's used in other areas of your tenant, such as: - Roles whose [membership criteria](https://documentation.sailpoint.com/saas/help/provisioning/role_assignment.html#standard-criteria) are based on the value of this attribute. - The Identity Security Cloud User Name field if it has been configured to use this attribute. - A custom app's User Name field if it has been configured to use this attribute. - SAML attributes including the attribute maps. Refer to [SAML Configuration Guide](https://documentation.sailpoint.com/saas/help/common/config_isc_service_provider.html)​ for details. - [Rules](https://developer.sailpoint.com/docs/extensibility/rules/) or [transforms](https://developer.sailpoint.com/docs/extensibility/transforms/) that call this attribute in the related code. This can include calculations to determine: - [Lifecycle states](https://documentation.sailpoint.com/saas/help/provisioning/lifecycle.html) which could impact provisioning. - [Exclusion rules](https://documentation.sailpoint.com/saas/help/certs/campaign_filters.html) which could impact certifications. ## Viewing Identity Profiles You can view your identity profiles, as well as their identity exceptions, priority, and statuses, by going to **Admin > Identity Management > Identity Profiles**. **Identity Exceptions** An identity exception occurs when an account on an authoritative source is missing values for one or more of the [required attributes](#required-attrs). If an identity profile contains identity exceptions, you can select the **Identity Exceptions** icon to download a .csv or .pdf file to [resolve the identity exceptions](#resolving-identity-exceptions). **Priority** Identity profiles are prioritized based on the order they were created. The earlier an identity profile is created, the higher priority it is assigned. By default, the first identity profile created will be assigned 10 as a priority and will have the highest priority. The next identity profile created will be assigned 20 and will have a lower priority. This pattern continues for each identity profile you create. You can change the priority order of identity profiles through the [Update the Identity Profile API](https://developer.sailpoint.com/docs/api/beta/update-identity-profile). For more information about an identity profile’s priority, refer to [Prioritizing Authoritative Sources](#prioritizing-authoritative-sources). **Scheduled Processing** An identity profile will be marked as having scheduled processing if it has an identity attribute mapped to a rule or transform that is tagged with `@requiresPeriodicRefresh`. For more information, refer to [Scheduled Processing](https://documentation.sailpoint.com/saas/help/setup/identity_processing.html#scheduled-processing). **Status** An identity profile can have an Active or Needs Processing status. For identity profiles that need processing, you can select **Actions** **> Apply Changes** to apply changes made to that identity profile. For example, if you make changes to your mappings, the identity profile needs processing to apply those changes. ### Resolving Identity Exceptions When you aggregate data from an authoritative source, if an account on that source is missing values for one or more of the [required attributes](#required-attrs), Identity Security Cloud generates an *identity exception*. A duplicate User Name (uid) also generates an exception. You can resolve identity exceptions by updating the missing attributes in the source. Note Identities missing required attributes also appear as Incomplete Identities on the Identities page. 1. Go to **Admin > Identity Management > Identity Profiles**. 1. Find an identity profile with the **Identity Exceptions** icon . Select either **Download CSV** or **Download PDF** to download the report. The CSV option downloads the report as a zip file. If these buttons are disabled, there are currently no identity exceptions for the identity profile. 1. Review the report and determine which attributes are missing for the associated accounts. 1. Edit the account in the source to resolve the data problem. 1. Manually aggregate the source again or wait for a regularly scheduled aggregation to confirm that the exceptions were resolved. Identity Security Cloud automatically [processes identity data](https://documentation.sailpoint.com/saas/help/setup/identity_processing.html) changed in aggregation, so you can be sure you're working with the latest identity data. ## Deleting Identity Profiles When you attempt to delete an identity profile, you'll receive a warning message that describes the implications of deleting the identity profile. Deleting an identity profile: - Does not delete its account source, but it does make the source non-authoritative. - Does not delete the source's accounts in Identity Security Cloud or deprovision them from the source system. - Deletes its identities unless they can be [reassigned to other identity profiles](https://documentation.sailpoint.com/saas/help/accounts/loading_data.html#deleting-authoritative-accounts-and-identities) in your system. When identities get deleted, all of their source accounts become [uncorrelated](https://documentation.sailpoint.com/saas/help/accounts/correlation.html#resolving-uncorrelated-accounts). Before deleting an identity profile, verify that any associated identities are not source or app owners. If they are, you won't be able to delete the identity profile until those connections are removed. **To delete an identity profile:** 1. Go to **Admin > Identity Management > Identity Profiles**. 1. Select the **Actions** icon next to the identity profile you want to delete. 1. Select **Delete Identity Profile**. 1. Select **Delete**. Note An identity profile cannot be deleted while an account aggregation is running. # Managing Lockout Settings Identity Security Cloud locks a user account if they fail to enter the correct password or complete multifactor authentication (MFA) verification after a certain number of tries to sign in or reset a password. By default, if a user or an unauthorized person provides the wrong password five times in a row in a five-minute period, they are locked out of their account for 15 minutes. You can change the default settings to meet the requirements of your organization by following the process described below. Note The sign in page does not warn the user that this is happening to prevent malicious activities such as brute force attacks. However, the user does receive an [email notification](https://documentation.sailpoint.com/saas/help/common/emails/et_user_lockedout.html) that indicates when and where the attempts occurred and when the account will be unlocked. After 15 minutes, the user can try again or choose to [reset their password](https://documentation.sailpoint.com/saas/user-help/accounts/resolving_issues.html#resetting-your-password). Important If your tenant is configured to restrict users from unlocking their account or resetting their password based on their [country or network](https://documentation.sailpoint.com/saas/help/access/restrict_access.html), these options might not be available to all users. Be aware of how these lockout settings might interact with pass-through authentication sources. If Identity Security Cloud is configured to use [pass-through authentication](https://documentation.sailpoint.com/saas/help/common/pta.html), locking the Identity Security Cloud account also locks their Active Directory or other primary account. If users are locked out because of failed sign ins, they can choose to [unlock their account](https://documentation.sailpoint.com/saas/user-help/accounts/resolving_issues.html#unlocking-your-account) or [reset their password](https://documentation.sailpoint.com/saas/user-help/accounts/resolving_issues.html#resetting-your-password)​ to access the system immediately. If a user needs help resetting their password or you believe their account is compromised, you can [reset their password](https://documentation.sailpoint.com/saas/help/common/users/reset_pwd_auth.html#initiating-a-password-reset) for them. **To manage lockout settings:** 1. Select **Global > Security Settings > Lockout Management**. 1. Under **Sign In Lockout Settings**, use the dropdown menus to set the: - **Maximum Attempts** - The number of times someone can enter the wrong password before the account is locked. - **Minutes Until Attempt Count Resets** - The period during which the number of failures is counted. For example, by default, if someone enters the wrong password five times within a five-minute period, they are locked out. However, if they enter four wrong passwords and then take a break for five minutes, they can try again without being locked out because the failure count resets. - **Minutes User is Locked Out** - How long the account is locked before the user can try again. Note These settings apply to both password authentication attempts and MFA verification attempts during sign-in. If a user fails to provide the correct password or MFA verification code the specified number of times within the configured window, their account will be locked. 1. Under **Password Reset Lockout Settings**, use the dropdown menus to set the maximum attempts and minutes the user is locked out of the account. These settings apply to password reset attempts, including both password entry and MFA verification attempts during the password reset process. If a user successfully enters their password but fails the security questions, they are not locked out of their accounts. Note Maximum attempt limits do not apply to [security questions](https://documentation.sailpoint.com/saas/help/accounts/kba.html). However, if a user is *resetting* their password and fails the questions, they will be temporarily blocked from resetting their password. The attempt limit and duration of being blocked are configured in **Global > Lockout Management > Password Reset Lockout Settings**. # Managing Sources Overview A *source* is the Identity Security Cloud representation of a third-party application, database, or directory management system that maintains its own set of user accounts or personnel records. Identity Security Cloud uses [*connectors*](https://documentation.sailpoint.com/connectors/isc/landingpages/help/landingpages/isc_landing.html) to collect user accounts and access rights from those systems and associate them to the source definition. [Multi-Host groups](https://documentation.sailpoint.com/saas/help/multihost/index.html) can be used for bulk source creation of infrastructure components and server configuration. ## Source and Connector Definitions There are multiple methods to load identity data into Identity Security Cloud. The following definitions outline the differences between sources, connectors, connection types, and applications. ### Source Definitions | Term | Definition | | --------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Source | The Identity Security Cloud representation of a third-party [enterprise application](#enterprise-app), database, or directory management system that maintains its own set of user accounts or personnel records. It contains the identities you want to govern in Identity Security Cloud. For a list of available source types, refer to the [SailPoint Connectors documentation](https://documentation.sailpoint.com/connectors/isc/landingpages/help/landingpages/isc_landing.html). | | [SAML Just-in-Time (JIT) Provisioning Source](https://documentation.sailpoint.com/saas/help/common/jit-accounts.html) | The SAML Just-in-Time (JIT) provisioning source connects with your identity provider to create an account on an app for a user when they attempt to authenticate for the first time. | ### Connection Type Definitions | Term | Definition | | -------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Direct Connection | A connection type where you enter configuration details to allow Identity Security Cloud to connect directly to the source system. Identity Security Cloud uses direct connections to track and aggregate identity data changes from the source system. Direct connections can use [VA-based connectors](#va-based) or [SaaS connectors](#saas-connector). | | Flat File Connection | A connection type where you provide a flat file, like a .csv, containing identity and account data. | ### Connector Definitions | Term | Definition | | ----------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Connector | An interface provided by SailPoint to enable you to provide configuration details or a flat file to collect user accounts and access rights from your source systems. Refer to the [SailPoint Connector Documentation](https://documentation.sailpoint.com/connectors/isc/landingpages/help/landingpages/isc_landing.html) for a list of available connectors. | | VA-Based Connector | Virtual appliance (VA)-based connectors provide an interface to read user account data and provision changes from Identity Security Cloud to target systems and applications. VA-based connectors are on-premise deployments which require you to configure a virtual appliance cluster to manage the connector. Previously referred to as "direct sources." | | SaaS Connector | SaaS connectors provide an interface to read user account data and provision changes from Identity Security Cloud to target systems and applications without needing an on-premise virtual appliance cluster. | | [Deep Governance Connector](https://documentation.sailpoint.com/connectors/isc/landingpages/help/landingpages/deep_governance.html) | Deep governance connectors read user account data and provision changes directly from Identity Security Cloud to managed systems and applications. This includes governance actions on the source like configuring account schemas and provisioning, aggregating and managing entitlements, and configuring password settings. They can be SaaS or VA-based. | | [Quick Compliance Connector](https://documentation.sailpoint.com/connectors/isc/landingpages/help/landingpages/quick_compliance.html) | Quick Compliance connectors support account and entitlement aggregation only. These read-only configurations require minimal information to quickly begin gathering user data from the source system. They can be SaaS-based only. | | File-Based Connector | File-based connectors are disconnected, read-only sources that require a file to upload data to Identity Security Cloud. These are either Delimited File or Generic Flat File connectors. | | [Single Source Connectors](https://documentation.sailpoint.com/connectors/isc/landingpages/help/landingpages/single_source.html) | SaaS connectors that enable you to configure both your identity governance sources and Cloud Infrastructure Entitlement Management (CIEM) or Activity Insights within Identity Security Cloud. | | [Enterprise Application](https://documentation.sailpoint.com/saas/help/ai/app_onboarding/index.html#application-definitions) | Enterprise applications are on-premise or SaaS platforms that require identity security functions to manage access to accounts on them. Enterprise applications are often the source systems you're connecting to. If your organization has licensed SailPoint application onboarding, you can use [Discovery Connectors](https://documentation.sailpoint.com/saas/help/ai/app_onboarding/app_discovery.html#available-discovery-connectors) to quickly discover these enterprise applications. | | [Access Application](https://documentation.sailpoint.com/saas/help/access/app-config.html#configuring-access-applications) | Access applications are logical groupings of access within Identity Security Cloud that provide context for access rights, access requests, and password policies. These are groups you create within Identity Security Cloud, as opposed to enterprise applications, which are external systems you connect using connectors or SailPoint application onboarding. | | [SAML Just-in-Time (JIT) Provisioning Source](https://documentation.sailpoint.com/saas/help/common/jit-accounts.html) | The SAML Just-in-Time (JIT) provisioning source connects with your identity provider to create an account on an app for a user when they attempt to authenticate for the first time. | | [Discovery Connectors](https://documentation.sailpoint.com/saas/help/ai/app_onboarding/app_discovery.html#available-discovery-connectors) | Discovery connectors are connectors used in SailPoint application onboarding that are capable of discovering enterprise applications in your organization. Discovery connectors have categories like CMDB and SSO. | | [Connector Category](https://documentation.sailpoint.com/saas/help/ai/app_onboarding/app_discovery.html) | The source category is used to determine where the discovery connector should look to find your enterprise applications. For example, SSO discovery connectors like Okta identify applications connected through SSO connections that you can add to Identity Security Cloud. | ## Viewing Source Details After you have [configured a source](https://documentation.sailpoint.com/saas/help/sources/config_sources.html) and [loaded account data](https://documentation.sailpoint.com/saas/help/accounts/loading_data.html), you can view or edit a source's details. To view a list of sources configured by your organization, go to **Admin > Connections > Sources**. You can search the list by name or description, or filter the list by connection type, source owner, warnings, and more. If there are warnings or statuses, you may be able to select them for more information. The default view of the sources list is the table view. Select **Cards** to display source details in a card view. From the sources list, you can view: - **Source type** - The type of data provided by the source. For a list of source types, refer to the [SailPoint Connector documentation](https://documentation.sailpoint.com/connectors/isc/landingpages/help/landingpages/isc_landing.html). - **Connection type** - The method used to connect the source to Identity Security Cloud. Sources can be connected through a direct connection with an external system or through a flat file that a user imports. For more information on these connections, refer to [Loading Account Data](https://documentation.sailpoint.com/saas/help/accounts/loading_data.html). - **Source Owner** - The owner of the source. After you've configured a source, you must [assign a source owner](#assigning-a-source-owner). - **Recommendations** - If your organization uses [Recommendations](https://documentation.sailpoint.com/saas/help/ai/app_onboarding/source_recommendations.html), you can view the status of source configuration recommendations. If you visit the source page with recommendations, the Ready state will be cleared until recommendations are refreshed. To view governance group and connectivity information for a source, select **Edit** from the **Actions** menu or on a card: - [**Governance Group for Source Management**](https://documentation.sailpoint.com/saas/help/common/users/governance_groups.html) - The group used for granting users source role sub-admin level oversight of the source and its access. - **Additional connectivity details** - Connectivity information such as URL, host, port, username, password, and more. This information varies by connector. ## Viewing Accounts on a Source To view which identities have accounts on a source, go **Admin > Connections > Sources** and select or edit a source. In the **Account Management** section, select **Accounts** to view a list of the accounts on the source. Select an account to view additional details. The identity assigned to each correlated account is listed by default within the table. Select the **Correlated** filter at the top of the page to show only correlated accounts. If an identity is listed multiple times, this indicates that the identity has multiple accounts on this source. As a result, the identity may be able to access the application using any of these accounts, possibly with different types of access through each account. Uncorrelated accounts have `(Uncorrelated)` beside their identity name, indicating that while a shadow identity has been created for them, the account hasn't been correlated to an authoritative identity. Select the **Uncorrelated** filter to show only [uncorrelated accounts](https://documentation.sailpoint.com/saas/help/accounts/correlation.html#resolving-uncorrelated-accounts), which are accounts that have not been matched to an identity in your system. You can also take several actions on the accounts in this list by selection the **Actions** icon beside the account. - Select **Disable Account** to disable the user's account on the source. - Select **Aggregate Account** to aggregate only this account data from this source. - Select **Remove Account** to remove this account from Identity Security Cloud. It will be re-aggregated during the next complete source aggregation unless it is removed from the source as well. Select **Export** to export details for all accounts on a source, including their entitlements. Sources with more than 100,000 accounts can't be exported. ## Assigning a Source Owner Sources must have a designated *source owner* who can complete provisioning and certifications tasks: - **Provisioning** - For sources added using a flat file feed, source owners will receive notifications in their [Task Manager](https://documentation.sailpoint.com/saas/user-help/task_manager.html) when an account needs to be added, modified, or removed. - **Certifications** - A source owner may be asked to review the access of people who have entitlements on a source. They may also receive tasks to remove entitlements that were revoked during certification campaigns. Note The source owner of the IdentityNow source can only be assigned using the [Update Source (Partial)](https://developer.sailpoint.com/docs/api/v3/update-source/) API. **To assign a source owner:** 1. Go to **Admin > Connections > Sources**. 1. Select or edit the source you want to assign an owner to. 1. In the **Source Setup** section, select **Base Configuration**. 1. In the **Source Owner** dropdown field, enter the name of the user you want to assign as the source owner. 1. Select **Save** to add this user as the source owner. The source owner will receive notifications of tasks they need to complete in their [Task Manager](https://documentation.sailpoint.com/saas/user-help/task_manager.html). Notes If a source owner is not assigned: - Access Request approvals are escalated to an Admin if there is a source owner in the approval schema. - Source Owner Certification Campaigns show an error. ## Verifying Connectivity You can check the following to ensure that your sources are working after an update: **Identity System Checks** - Check the [Virtual Appliance Health](https://documentation.sailpoint.com/saas/help/va/manage_va.html#monitoring-va-health). - Validate that VA clusters have a status of **Normal**. - Check the health of your sources: - Check the System Status dashboard for source errors. - Look for [status banners](#source-status-messages) on the source pages. - Edit a source and choose **Test Connection** in the **Review and Test** section. - Validate that user/group [aggregations](https://documentation.sailpoint.com/saas/help/accounts/loading_data.html#viewing-account-aggregation-history) are functioning appropriately. **Verifying Provisioning** - Validate the [role](https://documentation.sailpoint.com/saas/help/access/roles.html) is providing the expected entitlements. - Validate [attribute synchronization](https://documentation.sailpoint.com/saas/help/provisioning/attr_sync.html) operates as expected. - Validate [lifecycle state changes](https://documentation.sailpoint.com/saas/help/provisioning/lifecycle.html) operate as expected. ## Resetting Sources You can remove data associated with a source from your system, including accounts, entitlements, and access profiles, without losing the source's configuration. For example, you may want to reload the data for a source after you've changed its schema. Rather than delete the source and start over, you can reset the source so it maintains its configuration, and then run a [full aggregation](https://documentation.sailpoint.com/saas/help/accounts/loading_data.html#aggregating-account-information-on-a-direct-connect-source-using-apis) to reload its data. Note You can reset one source at a time. Before you reset a source, review the following table to understand how resetting a source can affect your data and what actions you may need to take after the reset. | Source Data Affected | System or User Behavior | Post-Aggregation | | --------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- | | Connected Identity Profile | The identity profile is not deleted, but all identities are deleted from it. If the identity also exists on another authoritative source, it will temporarily become an identity on that source. | Identities are recreated. If an identity was temporarily moved to a different identity profile, it will be reconnected to the original source. | | Identity Profiles with Required Attributes Mapped to the Source | If mappings are on required attributes, those accounts become uncorrelated. | Accounts become correlated. | | Identity Profiles with Attributes Mapped to the Source | Associated attributes are temporarily removed from the related identities. **Note:** Attributes that are mapped to transforms that reference this source are also temporarily removed. | The attributes and their values appear correctly. | | Source Owners from the Source | If any of the identities on the source you are resetting are [source owners](#assigning-a-source-owner) of any source, you will not be able to reset the source. Choose a new source owner for that source and try again. | Reassign the previous source owner as needed. | | App Owners from the Source | The app owner field on the app is cleared. | You must reassign the app owner. | | Entitlements | Entitlements are cleared. | Entitlements are reloaded. | | Access Profiles | Access profiles are deleted. | You must recreate any access profiles needed for provisioning. | | Accounts Correlated to Identities | Source accounts that were correlated to your identities are removed. | The new correlation configuration is applied to your current identities. Account sources might be reassigned based on these changes. | ### Aggregations and Source Resets - A source reset will fail if an aggregation is in progress. - [Aggregation schedules](https://documentation.sailpoint.com/saas/help/accounts/loading_data.html#scheduling-aggregations-for-direct-connect-sources) are retained after a reset. - You must disable [delta aggregations](https://documentation.sailpoint.com/saas/help/accounts/loading_data.html#configuring-delta-aggregations-for-supported-sources) for JDBC, Lotus Domino, and SAP HR before resetting these sources. After executing a full aggregation, you can reinstate the delta aggregation configurations. - For Active Directory and SharePoint, [delta aggregations](https://documentation.sailpoint.com/saas/help/accounts/loading_data.html#configuring-delta-aggregations-for-supported-sources) can remain in place, and schedules associated with aggregation still apply. Identity Security Cloud will run one full aggregation before resuming delta aggregation for these sources. ### Resetting a Source To reset a source, you will remove [accounts](#remove-accounts-from-a-source) and [entitlements](#remove-entitlements-from-a-source) from a source using the REST API. API calls require the appropriate authentication. To reset your source, you will need the cloud source ID displayed at the end of the URL in your browser address. Alternatively, you can [delete a source](#deleting-sources) if you no longer need to maintain it. **To remove accounts from a source using the REST API:** 1. Go to **Admin > Connections > Sources**. 1. Select or edit the source you want to remove accounts from. 1. Make note of the cloud source ID, which is displayed at the end of the URL in your browser address. 1. Use your preferred tool to call the following API: `POST https://.api.identitynow.com/beta/sources/<:id>/remove-accounts` where `` is the URL for your Identity Security Cloud tenant. `<:id>` is the ID of the source your accounts will be removed on. The call removes all accounts from the source. To reload accounts onto this source, run a full, un-optimized [aggregation](https://documentation.sailpoint.com/saas/help/accounts/loading_data.html#aggregating-account-information-on-a-direct-connect-source-using-apis). If you need to remove entitlements, refer to [removing entitlements from a source](#remove-entitlements-from-a-source). **To remove entitlements from a source using the REST API:** 1. Go to **Admin > Connections > Sources**. 1. Select or edit the source you want to remove entitlements from. 1. Make note of the cloud source ID, which is displayed at the end of the URL in your browser address. 1. Use your preferred tool to call the following API: `POST https://.api.identitynow.com/beta/entitlements/reset/sources/<:id>` where `` is the URL for your Identity Security Cloud tenant. `<:id>` is the ID of the source your entitlements will be removed on. The call removes all entitlements and access profiles from the source. Run an account aggregation and entitlement aggregation to add accounts and entitlements to the source. ## Deleting Sources Before you can delete a source, you'll need to remove all connections to that source. This includes: - [Resetting the source](#resetting-a-source) to remove its accounts and entitlements. - [Removing identity profiles](#removing-identity-profiles-from-a-source) associated with the source. - [Removing access applications](#removing-access-app-connections-from-a-source) connected to the source. - Removing references to the source in [transforms](https://developer.sailpoint.com/docs/extensibility/transforms/). Note If the source is used to authenticate logins to Identity Security Cloud through [pass-through authentication](https://documentation.sailpoint.com/saas/help/common/pta.html), you must configure an alternative authentication process (source) prior to deleting the source. Tip To see a comprehensive list of connections to a source, including the virtual appliance, identity profiles, and access apps, select **Connections** under **Aggregation History and Connections** in the source configuration. ### Removing Identity Profiles from a Source Before you delete an [identity profile](https://documentation.sailpoint.com/saas/help/setup/identity_profiles.html), it's important to understand the implications of doing so. For example, in addition to deleting identities, the accounts on the related source become [uncorrelated](https://documentation.sailpoint.com/saas/help/accounts/correlation.html#resolving-uncorrelated-accounts) unless another identity profile in your system also owns those accounts. **Prerequisite:** Before deleting an identity profile, verify that associated identities are not source or access app owners. If they are, you won't be able to delete the identity profile until those connections are removed. **To view the identity profiles on a source:** 1. Go to **Admin > Connections > Sources**. 1. Select or edit the source you want to remove identity profiles from. 1. In the **Aggregation History and Connections** section, select **Connections**. If the source is connected to an identity profile, the name of the profile is displayed under **Identity Profile** along with the number of identities that came from the source using that identity profile. 1. Select **Details** on the identity profile to view additional details and to verify that deleting it will not pose any problems. **To delete a source's associated identity profile:** 1. Go to **Admin > Identity Management > Identity Profiles**. 1. Select **Actions > Delete Identity Profile** for the identity profile you want to delete. 1. In the confirmation window, select **Delete**. ### Removing Access App Connections from a Source Before you remove an access app from a source, it's important to understand the implications of doing so. Removing an access app from a source affects users' ability to use those access applications. You must select a replacement source for the access application before you remove the current source. 1. Go to **Admin > Connections > Sources**. 1. Select or edit the source you want to remove access applications from. 1. In the **Aggregation History and Connections** section, select **Connections**. 1. Choose the access app from the **Applications** section to view additional details about it before removing it from the source. 1. When you understand the impact of removing the access app from the source, go to **Admin > Access Model > Applications** and select the access app you want to edit. 1. In the **Account Source** section of the **Configuration** tab, use the **Select Source** dropdown list to select the new source for the access app to use in place of the one you are preparing to delete. Note The **Account Source** section only displays when **Admin (IT)** is selected for **App Accounts Created By**. 1. Complete your configuration and select **Save** to update Identity Security Cloud with your changes. After you've removed all connections to the source, run an aggregation for the source. When the aggregation process completes, you can [delete the source](#deleting-a-source). Note You cannot delete a source while identity data is being processed, even if the data isn't connected to the source you want to delete. ### Deleting a Source Before you delete a source, you must you must remove its accounts and entitlements and remove all references to that source from identity profiles and applications. You can delete a source on the Sources list page or from the Source Configuration page, or by using the Identity Security Cloud REST API. Refer to the [Delete Source API](https://developer.sailpoint.com/docs/api/v3/delete-source) documentation for more information on the API call. **To delete from the sources list page**: 1. Go to **Admin > Connections > Sources**. 1. Select **Actions > Delete** for the source you want to delete. 1. Select **Continue** on the confirmation message to delete the source. If the source is still in use, an error will display. Tip You will see more details about where the source is in use if you delete it from the source details page. **To delete from the source details page**: 1. Go to **Admin > Connections > Sources**. 1. Select or edit the source you want to delete. 1. Select **Actions > Delete**. If the source is still in use, a list of items connected to the source displays. You must remove these connections before you can successfully delete the source. 1. If the source is not in use, select **Continue** on the confirmation message to delete the source and its related data. ## Source Status Messages You can view source status information in: - The [alert](https://documentation.sailpoint.com/saas/help/common/audit-reports.html#admin-dashboard) icon in both the **Sources** panel of the System Status and the list of sources. - The [email](https://documentation.sailpoint.com/saas/help/common/emails/et_source_health.html) notification from Identity Security Cloud, if you have enabled email [notifications](https://documentation.sailpoint.com/saas/help/common/getting_notified_org_health.html#configuring-system-notifications) for your sources. - A banner on the source's page. You can select the source to see the banner at the top of the source's configuration. This banner contains more information about the problem your source is experiencing. Use the following table to troubleshoot source errors: | Banner Text | Source Type | Suggested Solutions | | ------------------------------------------------ | ---------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | VA cluster failing for `