Scenario:
Currently, the Active Directory (AD) team is manually creating Groups/Entitlements. The customer has now expressed a requirement to automate this process using SailPoint ISC.
Can someone please confirm whether SailPoint ISC supports the automated creation of groups in an on-premises Active Directory?
Yes, SailPoint ISC supports automated creation of groups in on-premises Microsoft Active Directory, but not through standard access requests alone.
Typically, this is implemented using:
AD Group source with group provisioning enabled
Workflows + Provisioning Plans
Or a Web Services/API-based process if additional governance is required.
The AD connector supports Create, Modify, and Delete operations for groups when properly configured.
Sailpoint has introduced few time ago a new feature PTA : New Capability: Privileged Task Automation! - Announcements / Product News - SailPoint Developer Community
Privileged Task Automation - SailPoint Identity Services
Which can be use to build and let enduser perform some administrative operations like create active directory groups, …
This can combine workflows + interactive forms and require to enable Privileged Access Gateway on your virtual appliance as mentionned in the documentation.
To see how its look like, you can try to create new worflow from the UI :
With select a Template option and select the template “Create a Security Group in Active Directory”
This will automatically create and display a sample AD group creation workflow, including interactive forms and a launcher.
This should give you an idea of how it works, allowing you to adapt it to your specific use case.
Hi jetendra to acheive these you need to go with workflows+forms and you need a seperate privileged virtual appliance to acheive these
Yes, that’s a standard approach but customer don’t want to go with this approach, anyway thanks for respond.
Nice to see this capability, will try to use thanks for the update !
Not sure, if customer allow to touch VA but let me recheck
do you know if the separate VA can communicate with the same IQService instance? or does it need another one of those too?
Yes, technically, separate VAs can communicate with the same IQService machine.
Alternatively, you can configure multiple IQService instances (using different ports) on the same Windows server hosting IQService.
However, this is recommended only for non-production environments.
