Filtering for Entra entitlements

Feedback Documentation Feedback
, ,
1

I wasn’t able to reply back on Managing Azure Entitlements - SailPoint Identity Services some reason, so I’m creating a new topic here. Enabling the azureRoleAssignment (in conjunction with the CIEM Azure adapter) in my environment created over a million unique entitlements. 99.9% of which are completely empty.

It drastically slows down the system - both the UI and my API calls - to have to sort through all of that useless information.

Since I really need to be able to see the permissions on my Azure resources, there should really be a way to filter the Entra source to only include resources that have been verified to have at least one account making use of it.

Copilot might have been hallucinating, but it did say that there’s supposed to be a way of doing something like the following. It did seem like it cut one of my test instances from around 17k entitlements down to under 10k temporarily, but it sounds unsupported.

"entitlementConfig": {
    "includeEmptyEntitlements": false
},
2

Hi @timbrighamOC! I’m going to talk with the engineering team and get back to you.

1 Like
3

Hi @timbrighamOC! Here is the response from engineering:

There is no such filter option available for azureRoleAssignment (RBAC).

You might want to check the generic group.filterString option to filter unwanted entitlements at the ISC level. However, if too many unique entitlements are created without any purpose, and 99.9% of which are completely empty, it is recommended to clean up those entitlements rather than using filtering.

If you have additional questions, you might want to post this question in the ISC Discussions and Questions forum to see how other users have handled this use case.