Connectors · Lesson

Active Directory

Quick answer

The Active Directory connector lets IdentityIQ read AD users and groups (aggregation) and create, modify, enable, disable and delete accounts (provisioning). Because AD is a Windows service, IdentityIQ reaches it through IQService, a small agent installed near the domain.

Key takeaways

Reads AD users and groups; provisions account changes
Requires IQService, the Windows agent
Correlates AD accounts to cubes on a stable attribute
memberOf drives group (entitlement) membership
Most first failures are IQService or service-account issues

Active Directory is almost always the first and most important target in a SailPoint deployment, because so much other access depends on AD accounts and group membership. Governing AD cleanly, correct correlation and automated account and group lifecycle, is foundational to the whole programme.

Connector type and how it connects

The Active Directory integration is a directory connector. It connects to AD over LDAP/LDAPS (and uses the appropriate APIs for password and group operations) with a service account. As with every connector, the flow is the same: authenticate to Active Directory, read accounts and entitlements during aggregation, and write changes during provisioning.

Onboarding the source

1. Configure the connection and credentials for Active Directory.
2. Map the account schema, mapping AD account attributes (such as sAMAccountName, userPrincipalName) and memberOf group memberships to SailPoint accounts and entitlements.
3. Set the correlation logic so Active Directory accounts attach to the right identities (typically on a stable key such as employee ID or email).
4. Run account aggregation and confirm accounts and entitlements load.
5. Verify correlation, watching for uncorrelated/orphan accounts.

Provisioning capabilities

SailPoint can create, modify, enable and disable AD accounts and add or remove group memberships, driven by birthright roles, requests and lifecycle events. Immediate disable on leaver is a critical control.

Entitlements and what to govern

AD group memberships are the entitlements to govern; model important groups as roles or Managed Attributes with owners and descriptions so certifications are meaningful.

Troubleshooting

When Active Directory aggregation or provisioning fails, work through the usual causes in order:

Verify the service account bind and LDAPS trust.
Confirm the service account has rights to manage the OUs, accounts and groups in scope.
Check network/port access (389/636) to domain controllers.
Validate the search base, correlation key and group membership mapping.

Common pitfalls

Credential expiry (tokens/secrets/certs) silently breaking the connector.
Insufficient rights on the Active Directory service account for the operations you need.
Schema or correlation misconfiguration leaving accounts uncorrelated.

Want to learn this properly?

Our live, instructor-led SailPoint Training covers this hands-on, with real projects and a certification path.

See the course Ask a question

Check your understanding

IdentityIQ reaches Active Directory through?
- A. memberOf. memberOf carries group membership, aggregated as entitlements.
- B. IQService. IQService is the Windows agent used for AD reads and writes.
- C. IQService status. IQService being down or blocked is the top cause of AD issues.
Show answer
B. IQService. IQService is the Windows agent used for AD reads and writes.
IQService. IQService is the Windows agent used for AD reads and writes.
AD group membership is carried by the attribute?
- A. IQService. IQService is the Windows agent used for AD reads and writes.
- B. IQService status. IQService being down or blocked is the top cause of AD issues.
- C. memberOf. memberOf carries group membership, aggregated as entitlements.
Show answer
C. memberOf. memberOf carries group membership, aggregated as entitlements.
memberOf. memberOf carries group membership, aggregated as entitlements.
The first thing to check on an AD failure is?
- A. IQService status. IQService being down or blocked is the top cause of AD issues.
- B. memberOf. memberOf carries group membership, aggregated as entitlements.
- C. IQService. IQService is the Windows agent used for AD reads and writes.
Show answer
A. IQService status. IQService being down or blocked is the top cause of AD issues.
IQService status. IQService being down or blocked is the top cause of AD issues.

Frequently asked questions

What does the term Active Directory connector refer to in SailPoint?

What else is worth knowing about Active Directory connector?

The Active Directory integration is a directory connector. It connects to AD over LDAP/LDAPS (and uses the appropriate APIs for password and group operations) with a service account.

What is the practical takeaway on Active Directory connector?

As with every connector, the flow is the same: authenticate to Active Directory, read accounts and entitlements during aggregation, and write changes during provisioning.

What tends to go wrong with Active Directory connector?

Credential expiry (tokens/secrets/certs) silently breaking the connector. Insufficient rights on the Active Directory service account for the operations you need. Schema or correlation misconfiguration leaving accounts uncorrelated.