I’m seeking your guidance on how to effectively perform user access reviews for Microsoft EntraID guest users in SailPoint IIQ. Currently, we have 238,983 guest accounts, but since these are external identities, we are unable to correlate them with existing identities in SailPoint.
Onboarding all guest users as identities in SailPoint would significantly impact our license consumption. Therefore, we’re exploring alternative approaches to meet access review requirements without incurring excessive licensing costs and unnecessary identities in SailPoint.
Could you please suggest any best practices or solutions to handle this scenario?
@nailwalnavistar does these external identity has some attribute that can make different then normal identity and did you set owner for those identities ? if that part is done then you can start access review by either creating population and assigned the review to owners.
please share more details about those external identity.
The external guest users include dealers, suppliers, and customers. Currently, there is no direct linkage—such as a common attribute or ownership—between these guest users and the identities managed within SailPoint (employees and contractors).
Our primary concern is the large volume of guest accounts in Microsoft Entra ID, which currently stands at approximately 238,983 users. If we onboard all of them as identities in SailPoint, it would result in significant license consumption, which may not be cost-effective or necessary.
@nailwalnavistar
“If we onboard all of them as identities in SailPoint, it would result in significant license consumption, which may not be cost-effective or necessary” Sailpoint only charge for Correlated Active Users from workday, i mean real users. So don’t worry about license. you can create all external users in sailpoint for manage.
IdentityIQ is licenses are based on Correlated Identities coming from your HR source and from these only the Identities which are Active
I would suggest to perform an Application Owner Certification, since these Guest Users in Entra ID can not be correlated to Identities (so a Manager Certification is not possible).
To reduce the amount of Identity Cubes (Identities) created while aggregating I suggest to create 26 Uncorrelated Identity Cubes and a Correlation Rule. Where the Correlation Rule will correlate the Guest Users to one of the Uncorrelated Identity Cubes based on the first character of the User Principal of the Guest User.