I am attempting to onboard the Azure CIEM adapter, and a subset of my data isn’t present.
From the Entra adapter, I can see details on my Cosmos / DocumentDB entries showing up that represent the correct data.
For example, one of my users has the entitlement listed as follows, with the well known value for a Cosmos DB reader role.
This shows up on the data being fed from the account aggregation, not the entitlement aggregation.
The entitlement name shows as follows, the raw format.
/subscriptions/<sub ID>/resourceGroups/<instance>-cosmos-prod-rg/providers/Microsoft.DocumentDB/databaseAccounts/yyyyy-cosmos-prod:5bd9cd88-fe45-4216-938b-f97437e15450
The closest that I can get where it’s properly formatted with metadata is as follows.
Entitlement Name: DocumentDB Account Contributor [on] -cosmos-dev-rg
With the value as follows:
/subscriptions/<sub ID>/resourceGroups/<instance>-cosmos-dev-rg:5bd9cd88-fe45-4216-938b-f97437e15450
I checked back in Azure, that would be if the permissions were being set at the resource group level, not onto the instance in question. Makes sense based on the value shown.
I’m filtering out nothing from the CIEM source, and I’ve verified that I can call the API with the CIEM adapter to get the information, so as far as I can tell everything outside of SailPoint is correct.
GET https://management.azure.com/subscriptions/<sub id>/resourceGroups/<instance>-cosmos-dev-rg/providers/Microsoft.DocumentDB/databaseAccounts/<instance>-cosmos-dev/providers/Microsoft.Authorization/roleAssignments?api-version=2022-04-01
It returns what I’m seeing on the user object as a an entitlement that isn’t enriched with the metadata.
{
"value": [
{
"properties": {
"roleDefinitionId": "/subscriptions/<sub ID>/providers/Microsoft.Authorization/roleDefinitions/5bd9cd88-fe45-4216-938b-f97437e15450",
....
"scope": "/subscriptions/.../resourceGroups/<instance>-cosmos-dev-rg/providers/Microsoft.DocumentDB/databaseAccounts/edw-cosmos-dev",
"condition": null,
"conditionVersion": null,
...
},
I’m not sure if the CIEM adapter itself is failing to pull the data for some reason - and it’s attempting to correlate these raw strings and there’s nothing there - or if there’s some kind of schema update I to make to the CIEM Azure or Entra adapters to get this working.
Where and how can I dump this data to determine where the issue is? I’ve tried doing a couple peek objects on the source in VS Code unsuccessfully.