I have a question regarding attribute synchronization from SailPoint Identity Security Cloud to NERM.
I created a source in ISC using the SailPoint Non-Employee Risk Management source type and enabled provisioning.
In NERM, I have an attribute called samaccountname. This attribute is also configured in the NERM source schema in ISC, and I enabled it for attribute synchronization.
In the ISC identity profile, I also have a samaccountname identity attribute whose current value is obtained from Active Directory.
What I need is for the samaccountname value stored on the identity in ISC to be sent to NERM and update the corresponding non-employee profile attribute.
However, I do not understand how to trigger provisioning from ISC to NERM so that this update is performed.
Is it possible to automatically provision this attribute from the ISC identity profile to the NERM profile? If so, what configuration, workflow, or action should be used to trigger the synchronization?
HI @MichaelCastillo7 Yes, this is possible. You can automatically provision the sAMAccountName attribute from your ISC Identity Profile back to your NERM profile. SailPoint provides native support for Attribute Synchronization with the Non-Employee Risk Management source, allowing attributes to be synchronized automatically between ISC and NERM. Please refer to the new capability documentation provided below for detailed steps.
Yes, this is a supported, native capability. Since mid‑2025, NERM sources in ISC support Attribute Sync, and NERM correlated accounts follow the same Attribute Sync mechanism as any other source. Here’s how to set it up and what actually triggers the push.
Prerequisites
The attribute must be in your Create Account definition; Attribute Sync only works on account attributes that are: Included in the NERM source’s Create Account definition and mapped directly from an identity attribute in that definition.
So on your NERM source, go to Account Management > Create Account and confirm samaccountname is mapped from the identity attribute samaccountname. If it isn’t in the create-account config, it won’t be eligible for sync.
Enable Attribute Sync on the NERM source Admin > Connections > Sources → select your NERM source Account Management > Attribute Sync
Check the box in the Sync with Identity column for samaccountname.
You don’t need a workflow — provisioning to NERM fires automatically, in real time, whenever:
So in your case: when AD is re-aggregated and the identity’s samaccountname identity attribute changes, ISC should automatically provision that new value to the correlated NERM account — no manual trigger, no workflow required.
If the samaccountname identity attribute is mapped in your Identity Profile and the same attribute is enabled for Attribute Sync on the NERM source, ISC will automatically generate an update when the identity attribute value changes and the account is correlated to the NERM source account.
A few things to verify:
Provisioning is enabled on the NERM source.
samaccountname exists in the NERM account schema and is marked for Attribute Sync.
The NERM account is correctly correlated to the identity.
A change occurs in the identity attribute value. Attribute Sync is event-driven and will not trigger if the value remains unchanged.
If Attribute Sync is not supported for that specific NERM attribute, an alternative approach is to use a Workflow that detects the identity attribute change and invokes the NERM API to update the non-employee profile directly.
The current NERM admin documentation states that Attribute Sync is supported for sources configured from NERM under Admin > System > Identity Security Cloud Connection Settings using a profile type. It also states that sources created manually from ISC > Connections > Sources > Create New cannot be configured for Attribute Sync.
However, the original 2025 capability announcement indicated both manually and automatically configured sources were supported, so the documentation is inconsistent. Since you mentioned creating the source directly in ISC, this may explain why the attribute is not being provisioned even though Attribute Sync appears in the UI.
For a supported NERM source, verify that:
The NERM profile account is correlated to the identity.
samaccountname is included in the source’s Create Account definition.
It is mapped directly from the samaccountname identity attribute.
It is selected under Account Management > Attribute Sync.
Once configured, select Sync to apply the configuration to existing correlated accounts. Future changes to the identity attribute should then be provisioned automatically. The full-source Sync is limited to three executions per 24 hours. You can also test a single identity from Identity Management > Identities > Actions > Synchronize Attributes, provided the identity attribute already contains the new value.
If the source must remain manually configured, a custom workflow using the Identity Attributes Changed trigger and a NERM profile update API may be possible, though it would require authentication and a reliable way to identify the corresponding NERM profile or ISC account.
Given the documentation conflict, I would confirm the manual-source limitation with SailPoint Support first.
