SailPoint Identity Security Cloud (IdentityNow)
Description
The SailPoint Identity Security Cloud (ISC) connector, formerly IdentityNow, uses the ISC v2025 REST API to bring in two independent things, each with its own tick box:
- The IGA tool itself - who has access to SailPoint: ISC identities, their ISC user levels (ORG_ADMIN, ROLE_ADMIN, HELPDESK, ...) and the roles assigned to them.
- The systems it governs - every source ISC manages, added as a child system with its accounts, entitlements and access profiles.
Roles and their makeup (the access profiles and entitlements each role contains) are read whenever either side is on. OrbisID can also write its privilege and risk classification back to ISC.
System Type Classification
| Field | Value |
|---|
| System Type | IGA Tool |
| Default Scan Priority | 500 |
Version Support
| OrbisID Edition | Supported |
|---|
| Community | No |
| Pro | Yes |
| Enterprise | Yes (including IGA write-back) |
Supported Protocol
| Protocol | Port | Notes |
|---|
| ISC REST API v2025 (HTTPS) | 443 TCP | OAuth 2.0 client credentials (POST /oauth/token) |
What OrbisID Discovers
| Data | Source | Shown in OrbisID as |
|---|
| Identities | GET /v2025/identities | Accounts on the SailPoint system (The IGA tool itself) |
| ISC user levels | GET /v2025/auth-users/{id} | Entitlements such as ISC ORG_ADMIN; admin levels are privileged |
| Role assignments | GET /v2025/roles/{id}/assigned-identities | Identity memberships of each role |
| Roles | GET /v2025/roles | Entitlements on the SailPoint system |
| Sources | GET /v2025/sources | Child systems named <this system> - <source> (The systems it governs) |
| Source accounts | GET /v2025/accounts, GET /v2025/accounts/{id}/entitlements | Accounts on each source's child system, with their entitlements |
| Entitlements | GET /v2025/entitlements | Entitlements on each source's child system; ISC's own privileged flag is kept |
| Access profiles | GET /v2025/access-profiles | Entitlements on the source's child system |
| Role makeup | Role access profiles and entitlements | Parent/child entitlement relationships (role → access profile → entitlement) |
| Tags | GET /v2025/tagged-objects | Used by write-back to see what is already set |
Connection Requirements
API client
Create a personal access token (or an API client) in ISC under Preferences → Personal Access Tokens (or Admin → Global → Security Settings → API Management). For scanning it needs read scopes for the data above, including idn:tag:read.
For write-back create a second token for a user with write access, with the idn:tag:manage scope and permission to update entitlements. Keep it in its own OrbisID credential; it is chosen separately in the write-back settings.
Credential Mapping
| OrbisID Field | ISC Value |
|---|
credential.username | Client ID of the personal access token / API client |
credential.password | Client secret |
system.ipAddress (the IP Address / Hostname field) | API host, e.g. acme.api.identitynow.com |
Network Requirements
The OrbisID server (or On-Premise Agent) must reach https://<tenant>.api.identitynow.com on port 443.
Configuration Steps
- Create the read-only token in ISC and a credential for it in OrbisID (Client ID as username, secret as password).
- Go to Systems → Add System and choose SailPoint Identity Security Cloud (IdentityNow).
- Set IP Address / Hostname to your API host, e.g.
acme.api.identitynow.com.
- Under What to bring in, tick The IGA tool itself, Systems it governs, or both, and choose whether to read Roles and role makeup.
- Click Test Connection, then Save and scan the system.
| Setting | Default | Notes |
|---|
| The IGA tool itself | On | ISC identities, user levels and role assignments |
| Systems it governs | Off | Each source as a child system |
| Roles and role makeup | On | |
| Maximum identities | 5000 | One user-level lookup is made per identity |
| Maximum sources | 500 | |
| Maximum governed accounts | 50000 | One entitlement lookup is made per account that has entitlements |
Each governed source can be linked to the system OrbisID scans directly (for example the Active Directory domain itself) to reconcile access between what ISC believes and what the system really contains.
Write-back
| Object | Privileged | Risk level |
|---|
| Entitlements | ISC's own privileged flag | Tag |
| Roles, access profiles, identities | Tag ORBISID_PRIVILEGED | Tag (default ORBISID_RISK_<LEVEL>) |
| Accounts | Not possible in ISC | Not possible in ISC |
OrbisID only replaces its own tags; other tags on an object are kept. ISC allows up to 30 tags per object and 500 distinct tags per tenant.
Troubleshooting
| Symptom | Cause |
|---|
| "authentication failed" | Wrong client ID or secret, or the token was revoked |
| "access denied for GET ..." | The token lacks a read scope for that endpoint |
| "Could not read tags" warning | The scan token lacks idn:tag:read; scanning continues, write-back may rewrite existing tags |
| Write-back fails with 403 | The write credential lacks idn:tag:manage or entitlement update rights |