Click HERE to see how Saviynt Intelligence is transforming the industry. |
09/04/2024 10:13 AM
Hello Saviynt Community,
We have created a fake endpoint in our Saviynt environment to keep track of accounts with access to entitlements and for certification purposes. These entitlements grant access to Azure/AD groups through the mapped entitlement feature. Currently, we can only see the accounts with access under the Azure endpoint by default.
Our client would like to know if there is a way to view the accounts given access under this fake endpoint specifically. Is there a feature or method in Saviynt that allows us to view or track access under custom or non-Azure endpoints for the above purpose?
Any assistance or advice on how to accomplish this would be greatly appreciated.
Thank you!
09/04/2024 10:31 AM
Refer https://forums.saviynt.com/t5/tag/Default%20SAV%20Role/tg-p/board-id/iga
09/11/2024 05:53 PM
I understand. Now, if say the users are added on azure Ad group but we want to import it under the fake endpoint, because, the group was mapped to a fake entitlement, is that possible?
09/11/2024 06:38 PM
You can use sav4sav
09/11/2024 06:41 PM - edited 09/11/2024 06:41 PM
@theosveg
You can map the specific entitlements to a separate endpoint as below.
To create endpoints in EIC for each application hosted on Azure AD cloud as different endpoints, specify a value of the CREATE_NEW_ENDPOINTS parameter.
Ensure that the filter conditions that you specify are supported by the Graph API. For information about the filter conditions that Microsoft supports, see basic query in the Microsoft documentation.
The connector supports only basic query for entitlement filter.
If filter conditions are defined in this parameter and the ENTITLEMENT_FILTER_JSON element of the Application Data Import job, the filter criteria defined in the Application Data Import job trigger takes precedence. For more information, see Customizing Entitlement Import.
Specify the ENDPOINTS_FILTER parameter to create logical endpoints based on AAD groups and associate accounts with access to these groups. The endpoint and group details are specified in the JSON format.
Example 1- To create an endpoint named APPLICATION_DEV under AzureAD groups, GROUP_IN_ENGG, GROUP_IN_FINANCE, and GROUP_IN_MARKETTING use a format similar to the following:
{ "APPLICATION_DEV": [ { "AADGROUP": [ "GROUP_IN_ENGG", "GROUP_IN_FINANCE", "GROUP_IN_MARKETTING" ] } ] }
Example 2- To create an endpoint named APPLICATION_QA under AzureAD groups whose name starts with group, use the % wildcard after the group name as illustrated below:
{ "APPLICATION_QA": [ { "AADGROUP": [ "group%" ] } ] }
Example 3- To create multiple endpoints named APPLICATION_DEV and APPLICATION_QA under AzureAD groups, GROUP_IN_ENGG, GROUP_IN_FINANCE, and GROUP_IN_MARKETTING, use a format similar to the following:
{ "APP1": [ { "AADGROUP": [ "GROUP_IN_ENGG", "GROUP_IN_FINANCE", "GROUP_IN_MARKETTING" ] } ], "APPLICATION_QA": [ { "AADGROUP": [ "group%" ] } ] }