SailPoint IdentityNow (via Codeless Connector Framework)
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
| Attribute | Value |
|---|---|
| Connector ID | SailPointIdentityNowConnector |
| Publisher | Microsoft |
| Used in Solutions | SailPointIdentityNow |
| Collection Method | CCF |
| Connector Definition Files | SailPointIdentityNow_ConnectorDefinition.json |
| DCR Definition Files | SailPointIdentityNow_DCR.json |
| CCF Configuration | SailPointIdentityNow_PollerConfig.json |
| CCF Capabilities | OAuth2, POST |
The SailPoint IdentityNow data connector provides the capability to ingest [SailPoint IdentityNow] search events into Microsoft Sentinel through the REST API. The connector provides customers the ability to extract audit information from their IdentityNow tenant. It supports connecting multiple SailPoint IdentityNow tenants simultaneously - each identified by its unique Tenant ID and domain - making it easy to monitor multiple environments (production, demo, partner) from a single Microsoft Sentinel workspace. Refer to SailPoint Developer Documentation for API authentication details.
Tables Ingested
This connector ingests data into the following tables:
| Table | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|
SailPointIDN_EventsV2_CL |
? | ✓ | ? |
💡 Tip: Tables with Ingestion API support allow data ingestion via the Azure Monitor Data Collector API, which also enables custom transformations during ingestion.
Permissions
Resource Provider Permissions:
- Workspace (Workspace): Read and Write permissions are required.
Custom Permissions:
- SailPoint IdentityNow OAuth2 Client Credentials: An OAuth2 Client ID and Client Secret with the
sp:search:readscope are required. Create an API client in your SailPoint admin console under Admin > Global > Security Settings > API Management. See the documentation for step-by-step instructions.
Setup Instructions
⚠️ Note: These instructions were automatically generated from the connector's user interface definition file using AI and may not be fully accurate. Please verify all configuration steps in the Microsoft Sentinel portal.
1. Prerequisites
1. Find your Tenant ID and Domain
Your Tenant ID is the subdomain of your SailPoint URL.
| Environment | Your URL | Tenant ID | Domain |
|---|---|---|---|
| Production | https://acme.identitynow.com |
acme |
identitynow.com |
| Demo/Partner | https://ta-partner19947.identitynow-demo.com |
ta-partner19947 |
identitynow-demo.com |
The connector will call: https://{Tenant ID}.api.{Domain}/v2025/search/events
2. Create an API Client
- In the SailPoint admin console, go to Admin > Global > Security Settings > API Management.
- Click + New to create a new API client.
- Enable Client Credentials grant type.
- Copy the generated Client ID and Client Secret - the secret is only shown once.
3. Assign the required scope
Ensure the API client has the sp:search:read scope to query the Search API.
2. SailPoint IdentityNow Connections
Add and manage connections to your SailPoint IdentityNow tenants. You can connect multiple tenants simultaneously. Connector Management Interface
This section is an interactive interface in the Microsoft Sentinel portal that allows you to manage your data collectors.
📊 View Existing Collectors: A management table displays all currently configured data collectors with the following information:
- Tenant ID
- Domain
- Data Type
➕ Add New Collector: Click the "Add new collector" button to configure a new data collector (see configuration form below).
🔧 Manage Collectors: Use the actions menu to delete or modify existing collectors.
💡 Portal-Only Feature: This configuration interface is only available when viewing the connector in the Microsoft Sentinel portal. You cannot configure data collectors through this static documentation.
Add SailPoint IdentityNow Connection
Connect a SailPoint IdentityNow tenant to Microsoft Sentinel
When you click the "Add Connection" button in the portal, a configuration form will open. You'll need to provide:
- Tenant ID (required): e.g. acme or ta-partner19947
- IdentityNow Domain (required): e.g. identitynow.com or identitynow-demo.com
- Client ID (required): Enter your OAuth2 Client ID
- Client Secret (required): Enter your OAuth2 Client Secret
💡 Portal-Only Feature: This configuration form is only available in the Microsoft Sentinel portal.
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊