SailPoint integration overview

Overview

SailPoint Identity Security Cloud is an identity governance platform. It holds the workforce record for each worker, the accounts that worker owns on connected systems, and the lifecycle state that drives what their access should be. A worker’s record carries their identity attributes, such as name, email, employee number, department, and job title, along with rich governance signals like whether they are active, disabled, locked, or terminated.

Persona’s SailPoint integration connects these records to your Persona workflows as an API credential. With it, you can look up a worker from an employee number or email, read the accounts correlated to them, and turn an account off or back on when a verification outcome says to. This keeps identity data fresh during onboarding, account recovery, and offboarding without leaving the Persona experience.

Organizations can:

• Match verified identity data against workforce records held in SailPoint
• Pull employee and account attributes into Persona workflows to enrich verification
• Automate account actions such as disabling an account during offboarding or re-enabling it after recovery

Integration Options

Persona offers one way to integrate with SailPoint: the Marketplace API integration, which connects to your tenant using OAuth 2.0 client credentials. The integration works against your tenant’s base URL, such as https://acme.api.identitynow.com, where acme is the tenant name shown in the SailPoint admin console. There is no built-in OIDC or SSO flow for SailPoint in Persona today.

Setting up the SailPoint integration

To use the SailPoint integration, you need admin access to your SailPoint Identity Security Cloud account and a set of OAuth 2.0 client credentials, which you can create in the SailPoint admin console. Then configure the credential in Persona:

1. In the Persona Dashboard, navigate to Integrations > Marketplace and select SailPoint.
2. Click Add Credential at the top of the page.
3. Enter a nickname for your credential in the modal and click Continue.
4. Provide your SailPoint tenant name, along with the Client ID and Client Secret for your OAuth 2.0 client.
5. Save the credential to enable the integration.

Persona calls https://{tenant}.api.identitynow.com/oauth/token to get an access token, then uses that token to call the SailPoint API on your tenant.

Using the SailPoint integration in a workflow

1. Create a new workflow, or open an existing workflow you’d like to update.
2. Add a new Action Step > Integrations.
3. Select the SailPoint integration, and choose the desired endpoint (see operations below).
4. Configure the input fields to pass the correct information.
5. Save and publish the workflow.

Operations

Search records

Search SailPoint’s indexed records and return the matches. This is the way to find a worker when you only hold a value from their record, such as an employee number or an email address. Use employeeNumber:10673 to match the worker holding that employee number, email:"worker@example.com" to match by email address, or attributes.cloudLifecycleState:active to match every active worker. A queryResultFilter keeps only the properties you care about, for example attributes.cloudLifecycleState.

List identities

List the workers in the tenant, with the shared details every SailPoint user is allowed to see. Use a filter such as email eq "worker@example.com" to resolve a worker from an email address or sign-in name when you do not need their full governance record. Sorts by name, and supports a page size of 1 through 250.

List accounts

List the accounts SailPoint manages on connected systems. Filter by worker to see everything one person can sign in with, or by source to review a single system. Use identityId eq "2c9180835d2e5168015d32f890ca1581" to see the accounts for one worker, or sourceId eq "ff8081815d1c4e7f015d1c4ec7ff0002" and disabled eq true to review the accounts that are turned off on one source. Choose SLIM for core details only, or FULL for every property SailPoint holds.

Retrieve account

Return a single account SailPoint manages on a connected system, including whether it is currently turned off or locked. Find the account ID first with List accounts or Search records.

Disable account

Turn an account off on its connected system, so the worker can no longer sign in with it. SailPoint carries the change out in the background and returns a task ID (HTTP 202), which can be followed up in the SailPoint admin console. An optional externalVerificationId records the identifier of the outside verification that authorized the change, so the decision can be traced back later.

Enable account

Turn an account back on its connected system, so the worker can sign in with it again. Like disable, this starts a background change and returns a task ID (HTTP 202), with an optional externalVerificationId for tracing.

Plans Explained

SailPoint Integration by plan

Learn more about pricing and plans.