Is Delta aggregation supported for groups (entitlements) for Custom connector, if yes how to use it?

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1
  • What have you tried?
    • Tried different connectors like Web-Service Connector and developed a basic CSV custom connector to enable delta aggregation. It worked for Account, but it is not working for Groups.
  • What errors did you face (share screenshots)?
  • Share the details of your efforts (code/search query, workflow JSON, etc.)?
    • Only the Account Delta Aggregation worked for the Web Service Connector; there is no Group Delta Aggregation available.
      • Account: accounts?updatedAfter=$application.lastAggregationDate_account$
  • What is the result you are getting, and what were you expecting?
    • I want to aggregate entitlement groups similar to Account. The first group should be Full, and only updated entitlements, based on modifiedTime, will be aggregated without affecting older ones.
2

Hi @shsakshi There is no functionality for delta aggregation of entitlements that I am aware of. Can I ask what Use Case you are trying to meet; what is driving your need for delta aggregation?

3

Hi @j_place

I want to aggregate entitlement [groups] similar to Account. The initial aggregation should be Full, followed by delta aggregation, where only updated entitlements based on modifiedTime will be aggregated without affecting older ones.

4

I appreciate that’s your requirement, I was just interested in why .

5

@shsakshi As far as I know, delta aggregation is supported for accounts but not for groups or entitlements as @j_place mentioned.

6

Hi @ssowmya567

Thank you for the update, I appreciate it.

7

Where do you have this information?
As far I observed, you might be right. But doesn’t the Sailpoint UI description says the exactly opposite? Or is it different based on connector? because for EntraID connector…

quote: “Select Delta Aggregation to aggregate delta changes for Accounts and Groups.”

image
image1038Ă—571 27.7 KB

8

Hi @vasilcin3 You’ve included a screen shot of an Entra Connector. The OP was asking about Web Services or CSV connector. Yes, ISC sometimes includes Entitlement Delta Aggregation as a supported feature in some of its more tailored Connectors where it has the ability to “hard code” the delta functionality.

9

thank you. Sorry, I didn’t noticed custom connector was mentioned.

Yes, for EntraID there is “Delta” and it says it applies for Groups too.

But I have an issue.
If i turn the “Delta” on….

When the Scheduled Account aggregation runs, it aggregates only accounts that were changed → ok
When the Scheduled Entitlement aggregation runs, it always aggregates all 100k+ Entitlements → not ok.

10

Entitlement aggregation speed for a csv or web services connector is generally in the realm of seconds to complete. Is yours so excessively long in duration that you need a delta aggregation?

11

Based on my understanding, delta aggregation for groups/entitlements is not something that is generically supported for custom connectors.

12

Hi @phil_awlings

We have a substantial amount of data, and we prefer that if the delta is supported, only changes are updated, allowing the process to complete quickly.

13

Hi @j_place @vasilcin3 @NikitaDeshmukh0811

If delta aggregation for entitlements/groups is supported and functioning for a specific connector type, such as the Entra Connector you mentioned, can it be similarly enabled in a custom connector?

For example, by using the same connector logic or configuration as implemented in the Entra Connector.

Or is this capability limited only to SaaS-based connectors?