What Oleria discovers
Once connected, Oleria continuously discovers and maps the following from your SailPoint tenant:- Identities - the canonical, cross-source-correlated principal for every person SailPoint governs.
- Accounts - each per-source account (Active Directory, Workday, a custom connector, and so on) that rolls up into an Identity.
- Sources - every connected downstream system, represented as a governed resource.
- Roles, Access Profiles, and Entitlements - all three of SailPoint’s assignable-access objects, including how Access Profiles and Entitlements nest inside Roles.
- Governance Groups - SailPoint’s group construct, along with group membership.
- Activity - audit events from SailPoint, mapped to Oleria’s activity model.
SailPoint has no separate “group” concept tied to a specific source (for example, an Active Directory group is modeled as an Entitlement). Oleria’s Governance Group discovery covers SailPoint’s own cross-source Governance Groups, not source-native groups - those are represented as Entitlements instead. See Known limitations.
Prerequisites
- A SailPoint ISC credential using OAuth2 Client Credentials - either of the following works:
- A Personal Access Token (PAT), which any user can self-service under Preferences -> Personal Access Tokens (recommended - see the note below).
- An OAuth API Client, which an org admin creates under Admin -> Global -> API Management.
- Your SailPoint tenant subdomain - the part of your SailPoint URL before
.api.identitynow.com(for example,acme). If you’re on a demo or trial tenant (*.identitynow-demo.com), paste the full hostname instead of the bare subdomain - see the Tenant field below.
Use a Personal Access Token for connections that will run any governance action (role assignment, entitlement grant, or access profile assignment). SailPoint scopes access requests by the Access Request Segments defined in the credential’s user context, which a PAT carries and a standalone OAuth API Client may not.
Create a credential in SailPoint
1
Choose a credential type
Decide whether to use a Personal Access Token or an OAuth API Client. Both authenticate identically - the choice only affects whose permissions the resulting token carries.
2
Generate the credential
For a Personal Access Token, go to Preferences -> Personal Access Tokens and create a new token. For an OAuth API Client, go to Admin -> Global -> API Management and create a new API client with the scopes your governance use case requires.
3
Copy the Client ID and Client Secret
Save the credential, then copy the Client ID and Client Secret.
Connect SailPoint to Oleria
1
Open the integration
Log in to your Oleria workspace, navigate to Integrations, and select SailPoint.
2
Complete the connection form
Fill in the connection form with the credential you generated:
3
Authenticate
Select Authenticate to validate and save the integration. Oleria checks the credentials against SailPoint before saving.
4
Verify the connection
Verify the SailPoint integration status from the connected integrations page. After the first sync completes, you can review the discovered identities, accounts, roles, access profiles, entitlements, and governance groups in your Oleria workspace.
Governance actions
With a suitably scoped credential, Oleria can take the following actions directly against SailPoint:- Enable or disable a user’s account.
- Assign or remove a Role.
- Assign or revoke an Access Profile.
- Grant or revoke an Entitlement.
- Add or remove a user from a Governance Group.
Role, Access Profile, and Entitlement changes are submitted as SailPoint access requests, which may route through an approval workflow configured in your tenant rather than applying immediately.
Known limitations
- SailPoint’s tenant-admin capability model is not modeled. Who holds SailPoint’s own administrative roles (Org Admin, Help Desk, and so on) is not discovered - SailPoint has no confirmed API for enumerating this separately from Governance Group membership, which Oleria does model.
- Source-native groups appear as Entitlements, not as groups. SailPoint represents a downstream system’s native group (for example, an Active Directory group) as an Entitlement rather than as a distinct group type, so Oleria mirrors that and surfaces it as access rather than group membership.
- Nested Governance Groups are not distinguished. SailPoint does not expose a parent/child field for Governance Groups, so group nesting - if present in your tenant - is not currently reflected.
- Activity actor and target resolution is best-effort. SailPoint’s audit events identify the actor and target by name only, with no stable identifier. Oleria resolves names to known identities using a cache built during sync, upgraded with additional detail where SailPoint’s API provides it, but resolution is not guaranteed to be exact for every event.
- Joiner (account creation) is not supported. Oleria can disable, enable, and change access for existing SailPoint-governed accounts, but does not create new accounts.
- Certification and access-review actions are not supported. Oleria does not currently trigger or respond to SailPoint certification campaigns.
- Very large result sets are paginated up to a fixed limit. Sync relies on offset-based pagination sufficient for typical tenant sizes; extremely high-volume tenants should confirm complete sync coverage with Oleria support.
- Changes in SailPoint may take up to several minutes to appear in Oleria. Oleria applies a short delay before pulling new activity to ensure SailPoint’s own records have settled.