Migrating Virtual Appliance-Based Sources
Some sources connected to virtual appliance (VA) clusters can be migrated to SaaS connections while preserving users, entitlements, and source configurations like access profiles, roles, password settings, and correlation configurations.
To migrate a source from a VA-based source to a SaaS source, you will provide configuration details on a draft version of the source before publishing the source. Migrations are permanent and cannot be reverted.
You must have the Admin or Source Admin user level to migrate sources.
Supported Sources
You can migrate the following sources from VA-based sources to SaaS sources:
Supported Sources
Migrating Sources
- Go to Admin > Connections > Sources.
- Select or edit the VA-based source you want to migrate.
-
Select Migrate to SaaS.
-
Select Continue.
A draft version of the source is created. The live source will continue to work throughout the migration process. Settings from the VA-based source are retained, including the account schema, but you must reenter authentication information.
Caution
Do not edit the live source during migration. Changes made to the live source will be overwritten when you publish the draft source.
-
Select Connection Settings.
- Reenter encrypted configuration details like the Client Secret, Password, Refresh Token, or Certificates to migrate from the VA cluster to the SaaS connection.
- Select Review and Test.
- Select Test Connection.
-
(Optional) Select Account Schema to review and modify the account schema in the draft source before applying the migration. Refer to Schema Handling During Migration for more information. You can generate previews of accounts based on this schema configuration.
Important
When adding or modifying attributes, ensure the attribute types are compatible with the SaaS connector's supported types. Refer to the SailPoint Connector documentation for details on each connector's supported options.
Note
You cannot delete attributes that are used in:
- Provisioning policies
- Correlation configurations
- Identity profiles
-
(Optional) Select Accounts. If you successfully tested your connection in Review and Test, you can select Preview to display a subset of accounts from the application that will be mapped to identities in Identity Security Cloud. This can help ensure you are accurately connecting identity data from the application with identities in Identity Security Cloud.
Note
If accounts were not aggregated on this source previously, you might see an empty accounts list. You can still preview accounts. Previews do not affect the live source.
-
(Optional) Select Entitlements. If you successfully tested your connection in Review and Test and your source type supports entitlement management, you can select Preview to view a preview of entitlements using the current configuration settings.
Note
If entitlements were not aggregated on this source previously, you might see an empty list of entitlements. You can still preview entitlements. Previews do not affect the live source.
-
Carefully review your changes.
Warning
Migrations cannot be reverted.
-
When you've finished reviewing your changes and successfully tested your connection, select Apply Migration.
When you apply your changes, the source is migrated from a VA-based source to a SaaS source and the draft source will be deleted.
Important
The cluster time zone determines the GMT offset when scheduling account aggregations and entitlement aggregations for the connected source.
If the time zone of your VA cluster is different from the SaaS connection, aggregation and certification due dates will be affected. Carefully review configurations in the live source that might be affected by time zone changes.
Schema Handling During Migration
During migration, the account schema from the VA-based source is automatically merged with the SaaS connector's default schema. This ensures that the migrated source contains the appropriate attributes for the SaaS connector while preserving customizations from the VA-based source.
The schema merge follows these rules:
- Common attributes - Attributes that exist in both the VA and SaaS schemas that contain the same name and type are preserved.
- Different attribute types - If an attribute exists in both schemas with the same name but different types, the SaaS schema type is used.
- Custom VA attributes - Custom attributes that exist in the VA schema but not in the SaaS schema are preserved in the draft source.
- SaaS-only attributes - Attributes that exist in the SaaS schema but not in the VA schema are added to the draft source.
- Top-level attributes - Schema top-level attributes like Account ID and Account Name from the VA-based source take precedence.
Viewing Source Migration Status
You can view the status of draft sources in process or that have failed test connections. The date the draft source was created and the migration began is indicated in the Created column.
- Go to Admin > Connections > Sources.
-
Select Source Migration Status.
-
To view or edit the draft source, select Actions
> Preview on the draft source. - To delete the draft source, select Actions > Delete on the draft source.
Documentation Feedback
Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.