Viewing Accounts with Access Under Fake Endpoint

[theosveg]

Hello Saviynt Community,

We have created a fake endpoint in our Saviynt environment to keep track of accounts with access to entitlements and for certification purposes. These entitlements grant access to Azure/AD groups through the mapped entitlement feature. Currently, we can only see the accounts with access under the Azure endpoint by default.

Our client would like to know if there is a way to view the accounts given access under this fake endpoint specifically. Is there a feature or method in Saviynt that allows us to view or track access under custom or non-Azure endpoints for the above purpose?

Any assistance or advice on how to accomplish this would be greatly appreciated.

Thank you!

[rushikeshvartak]

Refer https://forums.saviynt.com/t5/tag/Default%20SAV%20Role/tg-p/board-id/iga 

• Accounts / entitlements are controlled with connection. 
  
  
• You need to add sav role under connection attached to security system 
• under Default sav role
• 
• Refer https://forums.saviynt.com/t5/identity-governance/disconnected-application-accounts-are-not-listing-...

[theosveg]

I understand. Now, if say the users are added on azure Ad group but we want to import it under the fake endpoint, because, the group was mapped to a fake entitlement, is that possible?

[rushikeshvartak]

You can use sav4sav

[stalluri]

@theosveg 
You can map the specific entitlements to a separate endpoint as below.

Creating New Endpoints

To create endpoints in EIC for each application hosted on Azure AD cloud as different endpoints, specify a value of the CREATE_NEW_ENDPOINTS parameter.

Filtering Endpoints

Note

• Ensure that the filter conditions that you specify are supported by the Graph API. For information about the filter conditions that Microsoft supports, see basic query in the Microsoft documentation.

• The connector supports only basic query for entitlement filter.

• If filter conditions are defined in this parameter and the ENTITLEMENT_FILTER_JSON element of the Application Data Import job, the filter criteria defined in the Application Data Import job trigger takes precedence. For more information, see Customizing Entitlement Import.

 

Specify the ENDPOINTS_FILTER parameter to create logical endpoints based on AAD groups and associate accounts with access to these groups. The endpoint and group details are specified in the JSON format.

Example 1- To create an endpoint named APPLICATION_DEV under AzureAD groups, GROUP_IN_ENGG, GROUP_IN_FINANCE, and GROUP_IN_MARKETTING use a format similar to the following:

JSON

{
  "APPLICATION_DEV": [
    {
      "AADGROUP": [
        "GROUP_IN_ENGG",
        "GROUP_IN_FINANCE",
        "GROUP_IN_MARKETTING"
      ]
    }
  ]
}

Example 2- To create an endpoint named APPLICATION_QA under AzureAD groups whose name starts with group, use the % wildcard after the group name as illustrated below:

JSON

{
  "APPLICATION_QA": [
    {
      "AADGROUP": [
        "group%"
      ]
    }
  ]
}

Example 3- To create multiple endpoints named APPLICATION_DEV and APPLICATION_QA under AzureAD groups, GROUP_IN_ENGG, GROUP_IN_FINANCE, and GROUP_IN_MARKETTING, use a format similar to the following:

JSON

{
  "APP1": [
    {
      "AADGROUP": [
        "GROUP_IN_ENGG",
        "GROUP_IN_FINANCE",
        "GROUP_IN_MARKETTING"
      ]
    }
  ],
  "APPLICATION_QA": [
    {
      "AADGROUP": [
        "group%"
      ]
    }
  ]
}