Azure and Azure AD Connector

[tejovempaty]

Connector Architecture (saviyntcloud.com)

This document says we need to use:

Since Azure Connector relies on Azure AD Connector for accounts. So, you must run the account and access imports in the following order:

• perform account import for Azure AD endpoint

• perform access import for Azure endpoint

But, We can import accounts using Azure AD Endpoint as well. Is there any specific reason why we need to use Azure Connector Type again to import only access and map these 2 end points? Is it recommended by Saviynt to use Azure AD connector to import both accounts and access ?

[stalluri · Accepted solution]

@tejovempaty 

Azure and Azure Ad connectors are used for two different integrations.

Azure AD Microsoft Graph API is used for integration between EIC and Azure AD.

• Supports Rest connectors or OOTB Azure AD connectors. This brings all the accounts and access under single connectors using Grap API's
  
  

                      Use Case                                                           Connection Type

Import accounts and groups from Azure AD	Azure AD For integration information, see Configuring the Integration for Account and Group Import.
Import users from Azure AD	REST For integration information, see Configuring the Integration for Importing Users.
Manage Azure AD groups	Azure AD For integration information, see Configuring the Integration for Managing Azure AD Groups.
Provision or deprovision accounts and access to Azure AD	REST / Azure AD from 23.10 For integration information, see Configuring the Integration for Provisioning and Deprovisioning.
Provision distribution group membership	Win-PS For integration information, see Configuring the Integration for Provisioning Distribution Group Membership.

Azure is used to bring anything related to Azure objects like (VM,NetworkSecurityGroup,..etc)

                 Use Case                                                                                           Connection Type

Import accounts from the target Azure application to EIC	Azure AD For integration information, see Azure AD Integration Guide.
Import access from the target Azure application to EIC	Azure
Provision or deprovision accounts from EIC to the target Azure application	REST

[rushikeshvartak · Accepted solution]

In Saviynt, the Azure AD Connector and the Azure Connector serve different purposes within identity and access management:

1. Azure AD Connector:

• Primary Focus: It handles user account management within the Azure Active Directory (AAD). This connector is responsible for importing and managing user identities, including creating, updating, and deleting users.
• Use Case: Typically used to synchronize and reconcile user accounts from Azure AD into Saviynt, which allows for identity governance operations such as provisioning and deprovisioning of users across multiple systems.
• Capabilities: It imports Azure AD users, groups, and sometimes certain directory-specific attributes, but it doesn’t directly deal with Azure resources such as subscriptions or roles that are outside of AD.

2. Azure Connector:

• Primary Focus: This connector is used to manage Azure resource access, focusing on user permissions and roles for resources hosted in Azure (e.g., subscriptions, resource groups, or specific services).
• Use Case: Used to handle role-based access control (RBAC) for Azure resources, importing the roles and permissions a user holds within the Azure cloud platform. This is crucial for governing access to specific Azure resources rather than directory-level identities.
• Capabilities: It imports access-related data like roles, subscriptions, and other permissions from Azure environments, which can then be linked to user accounts previously imported via the Azure AD Connector.

Main Differences:

• Scope: Azure AD Connector deals with identity management in Azure AD, whereas the Azure Connector is focused on access management for Azure resources.
• Data Imported: Azure AD Connector imports user accounts and groups from AAD, while the Azure Connector brings in permissions and resource roles from Azure subscriptions.
• Order of Operation: In general, it is recommended to run account imports first from the Azure AD Connector, followed by access imports from the Azure Connector, to ensure proper mapping and correlation between accounts and access.

[tejovempaty]

Thank you both for detailed answers.