AD integration
Quick answer
This project connects Active Directory to SailPoint to govern accounts and group memberships as the core directory.
Key takeaways
- Aggregate AD accounts and groups
- Correlate to identities
- Govern group membership via roles
- Automate AD provisioning
Active Directory is almost always the first and most important target in a SailPoint deployment, because so much other access depends on AD accounts and group membership. This project brings AD accounts and groups under clean correlation and automated lifecycle.
The goal
Aggregate AD accounts and groups, correlate them reliably to identities, govern group membership through roles, and automate account creation, disable and group changes across the lifecycle.
How to build it
- Configure the AD connector and aggregate accounts and groups.
- Establish reliable correlation on a stable key so no accounts are orphaned.
- Model important AD groups as entitlements/roles with owners and descriptions.
- Automate account create/enable on joiner and disable on leaver.
- Govern group membership through requests, roles and certifications.
Design considerations
AD is foundational, so get correlation right first, orphaned or mis-correlated AD accounts undermine every downstream control. Pay attention to nested groups and to service/shared accounts, which are common in AD and often ungoverned. Because AD underpins so much, immediate disable on leaver here is one of your highest-value controls.
Common pitfalls
- Weak correlation leaving orphaned AD accounts.
- Ungoverned service/shared accounts.
- Ignoring nested group effective membership.
Want to learn this properly?
Our live, instructor-led SailPoint Training covers this hands-on, with real projects and a certification path.
Check your understanding
Why is AD a priority target?
- A. AD group memberships.
- B. Account create/disable through the lifecycle.
- C. It is the core directory most other access depends on.
Show answer
C. It is the core directory most other access depends on.
It is the core directory most other access depends on.
What is modeled as entitlements?
- A. Account create/disable through the lifecycle.
- B. It is the core directory most other access depends on.
- C. AD group memberships.
Show answer
C. AD group memberships.
AD group memberships.
What should be automated?
- A. AD group memberships.
- B. Account create/disable through the lifecycle.
- C. It is the core directory most other access depends on.
Show answer
B. Account create/disable through the lifecycle.
Account create/disable through the lifecycle.