# CyberARK SAAS connector - Filter entitement in entitlement aggregation **URL:** \ **Category:** SHF Discussion and Questions\ **Tags:** aggregation, connectors, identity-security-cloud, entitlements\ **Created:** [February 13, 2026, 12:33pm UTC](https://developer.sailpoint.com/discuss/t/cyberark-saas-connector-filter-entitement-in-entitlement-aggregation/196098 "2026-02-13T12:33:31Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![papie66](https://avatars.discourse-cdn.com/v4/letter/p/7ba0ec/32.png) [@papie66](https://developer.sailpoint.com/discuss/u/papie66)\ **Post date:** [February 13, 2026, 12:33pm UTC](https://developer.sailpoint.com/discuss/t/cyberark-saas-connector-filter-entitement-in-entitlement-aggregation/196098/1 "2026-02-13T12:33:32Z")
Hi All, We are implementing **CyberArk Privilege Cloud Shared Services SaaS** connector, we want to filter some of the entitlements when we aggregate them, specifically the “System Administrator” group. The Reason we want to filter this out is that the “System Administrator” group is not aggregate trough Account Aggegration. Is it possible to filter this entitlement? Kind regards, Ahmet ---
**Author:** ![mcheek](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/mcheek/32/23705_2.png) [@mcheek](https://developer.sailpoint.com/discuss/u/mcheek)\ **Post date:** [February 13, 2026, 1:10pm UTC](https://developer.sailpoint.com/discuss/t/cyberark-saas-connector-filter-entitement-in-entitlement-aggregation/196098/2 "2026-02-13T13:10:45Z")
What is the end goal that’s met by filtering this out? Eventually that entitlement will get created through account aggregation if it’s assigned to an account. ---
**Author:** ![papie66](https://avatars.discourse-cdn.com/v4/letter/p/7ba0ec/32.png) [@papie66](https://developer.sailpoint.com/discuss/u/papie66)\ **Post date:** [February 13, 2026, 2:19pm UTC](https://developer.sailpoint.com/discuss/t/cyberark-saas-connector-filter-entitement-in-entitlement-aggregation/196098/3 "2026-02-13T14:19:58Z")
The CyberArk endpoint for users doesn’t include role “System administrator” assigned users. So the goals is to filter it out otherwise this will lead to an incomplete entitlement:(check screenshot, missing identites button) ![image](https://global.discourse-cdn.com/sailpoint/original/3X/6/b/6b0dbff430d55adc6ea89197c269dab284fa495d.png) ---
**Author:** ![mcheek](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/mcheek/32/23705_2.png) [@mcheek](https://developer.sailpoint.com/discuss/u/mcheek)\ **Post date:** [February 13, 2026, 2:44pm UTC](https://developer.sailpoint.com/discuss/t/cyberark-saas-connector-filter-entitement-in-entitlement-aggregation/196098/4 "2026-02-13T14:44:27Z")
Ok, I see what you mean now. I didn’t realize membership in the group id sysadmin wasn’t presented in the /Users resource of the SCIM API, but you can see the group membership in the /Groups SCIM endpoint. Unfortunately, the OOB connector doesn’t allow for entitlement aggregation filters, so you can’t do something like id ne “sysadmin” like you would in the filter query parameter in a REST call. ---
**Author:** ![papie66](https://avatars.discourse-cdn.com/v4/letter/p/7ba0ec/32.png) [@papie66](https://developer.sailpoint.com/discuss/u/papie66)\ **Post date:** [February 23, 2026, 8:20am UTC](https://developer.sailpoint.com/discuss/t/cyberark-saas-connector-filter-entitement-in-entitlement-aggregation/196098/5 "2026-02-23T08:20:49Z")
OK, thanks for sorting out. ---
**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\ **Post date:** [April 24, 2026, 8:21am UTC](https://developer.sailpoint.com/discuss/t/cyberark-saas-connector-filter-entitement-in-entitlement-aggregation/196098/6 "2026-04-24T08:21:31Z")
This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.