AD integration
Governing Active Directory accounts and groups.
This project connects Active Directory to SailPoint to govern accounts and group memberships as the core directory.
- Aggregate AD accounts and groups
- Correlate to identities
- Govern group membership via roles
- Automate AD provisioning
Active Directory is almost always the first and most important target in a SailPoint deployment, because so much other access depends on AD accounts and group membership. This project brings AD accounts and groups under clean correlation and automated lifecycle.
The goal
Aggregate AD accounts and groups, correlate them reliably to identities, govern group membership through roles, and automate account creation, disable and group changes across the lifecycle.
How to build it
- Configure the AD connector and aggregate accounts and groups.
- Establish reliable correlation on a stable key so no accounts are orphaned.
- Model important AD groups as entitlements/roles with owners and descriptions.
- Automate account create/enable on joiner and disable on leaver.
- Govern group membership through requests, roles and certifications.
Design considerations
AD is foundational, so get correlation right first, orphaned or mis-correlated AD accounts undermine every downstream control. Pay attention to nested groups and to service/shared accounts, which are common in AD and often ungoverned. Because AD underpins so much, immediate disable on leaver here is one of your highest-value controls.
Common pitfalls
- Weak correlation leaving orphaned AD accounts.
- Ungoverned service/shared accounts.
- Ignoring nested group effective membership.