Title: End-to-End Guide to Deploying SailPoint Virtual Appliances in Microsoft Azure

Identity Security Cloud (ISC) ISC Community Knowledge Base
,
1

Title: End-to-End Guide to Deploying SailPoint Virtual Appliances in Microsoft Azure

Overview
SailPoint Virtual Appliances (VAs) are a core component for securely connecting Identity Security Cloud (ISC) to on-premises and private network systems. In many enterprise implementations, a VA is the bridge that enables aggregation, provisioning, and connector communication without exposing internal systems directly to the internet.

This detailed guide explains how to deploy a SailPoint VA in Microsoft Azure using a practical, step-by-step approach. It is written for architects, IAM engineers, and platform administrators who want a repeatable deployment method with operational best practices.

What You Will Learn

  1. How to prepare Azure for VA deployment
  2. How to upload the SailPoint VA image efficiently
  3. How to create a managed image and deploy a VM from it
  4. How to validate connectivity and complete ISC onboarding
  5. How to avoid common issues in enterprise environments

Target Audience

  1. SailPoint ISC implementation teams
  2. Cloud infrastructure administrators
  3. IAM and security operations teams
  4. DevOps and platform engineering teams supporting identity services

Prerequisites
Before starting, confirm the following are available:

  1. Azure subscription with required permissions:

  2. Create resource groups

  3. Create storage accounts and blob containers

  4. Create managed images

  5. Create virtual machines, NICs, and NSGs

  6. SailPoint VA image URL:

  7. Tools (recommended):

  8. AzCopy for large file upload

  9. Azure Storage Explorer as an alternative

  10. SSH client (PuTTY, MobaXterm, or native SSH)

  11. Network prerequisites:

  12. Outbound internet access from VA subnet to SailPoint endpoints

  13. DNS resolution for required domains

  14. Firewall and proxy policies aligned with VA communication needs

  15. Governance prerequisites:

  16. Naming standards for Azure resources

  17. Approved region selection

  18. Ownership and support model defined for VA lifecycle

Reference Architecture (High Level)

  1. Download VA image locally
  2. Upload image to Azure Blob Storage
  3. Create managed image from uploaded blob/VHD
  4. Deploy VM from managed image
  5. Configure access and hardening
  6. Complete VA onboarding in SailPoint ISC
  7. Validate connector communication

Step-by-Step Deployment

Step 1: Validate Azure Subscription and Region Strategy
Choose the target Azure subscription and region based on:

  1. Proximity to connected systems
  2. Network compliance requirements
  3. Organizational cloud standards

Recommendation:
Use the same region for storage account, managed image, and VM to reduce complexity and avoid compatibility/performance issues.

Step 2: Download the SailPoint VA Image
Download the latest image from:
https://sppcbu-va-images.s3.amazonaws.com/va-azure-latest.zip

Important:
The file is large. Store it on a system with sufficient disk space and stable network bandwidth.

Step 3: Create a Dedicated Resource Group
Create a dedicated resource group for all VA resources.

Suggested naming pattern:
rg-isc-va-prod-eastus
rg-isc-va-nonprod-eastus

Why this matters:

  1. Easier access control management
  2. Cleaner cost tracking
  3. Simplified maintenance and cleanup

Step 4: Create an Azure Storage Account
In the same resource group and region, create a storage account for image upload.

image
image1920×571 118 KB

Suggested options:

  1. Standard performance
  2. General-purpose v2
  3. Redundancy based on enterprise policy (LRS often sufficient for staging image upload)

Step 5: Create Blob Container
Open the storage account and navigate to Containers. Create a new container dedicated to VA image storage.

image
image1920×814 159 KB

Suggested container name:
va-images

Step 6: Upload the VA Image
Upload the VA image file to the blob container.

image
image3337×967 238 KB

Best practice for large files:
Use AzCopy instead of browser upload.

If using AzCopy:

  1. Generate SAS token for container
  2. Run AzCopy copy command from local machine
  3. Validate transfer completion and blob integrity

Alternative:
Azure Storage Explorer for GUI-based upload.

Step 7: Create Managed Image from Uploaded Blob
Once upload is complete, create a managed image in Azure from the uploaded VHD/blob.

image
image3628×966 206 KB

image
image1920×542 125 KB

Configuration points:

  1. Region should match target deployment region
  2. OS type should align with the VA image metadata
  3. Ensure source URI points to correct blob object

Step 8: Deploy VM from Managed Image
Create a virtual machine using the managed image.

image
image1920×779 126 KB

VM planning recommendations:

  1. Use standardized VM size approved by your platform team
  2. Assign dedicated subnet if possible
  3. Apply NSG with least privilege rules
  4. Decide if public IP is needed (private-only access is preferred in enterprise designs)

Step 9: Configure Networking and Security
At deployment time, apply secure defaults:

image
image1920×815 125 KB

  1. Network:

  2. Place VM in controlled subnet

  3. Use route table aligned to egress policy

  4. Ensure DNS servers can resolve SailPoint endpoints

  5. Access:

  6. Restrict SSH access to approved admin IPs only

  7. Avoid open internet SSH access

  8. Prefer jump host or bastion model

  9. Hardening:

  10. Enforce tagging standards

  11. Enable monitoring/logging

  12. Use approved credential rotation processes

Step 10: Complete Deployment and Capture VM Details
After VM provisioning completes:

  1. Verify VM is running
  2. Capture VM hostname, private/public IP, region, resource IDs
  3. Store deployment metadata in your operations documentation

image
image3127×1336 263 KB

Step 11: Access the VA via SSH
Use approved SSH method to connect:

  1. PuTTY
  2. MobaXterm
  3. Native SSH terminal

Validate:

  1. Login success
  2. Basic network reachability
  3. DNS resolution working inside VM

Step 12: Register/Connect VA to SailPoint ISC
Follow SailPoint onboarding steps to register the VA with your ISC tenant.

Expected outcome:

  1. VA appears in ISC
  2. Status moves to healthy/connected
  3. Connectors can route communication through VA

Operational Validation Checklist
Use this checklist to confirm readiness:

  1. Infrastructure validation:

  2. VM is running and reachable

  3. NSG rules are correctly scoped

  4. DNS and outbound connectivity are confirmed

  5. SailPoint validation:

  6. VA is visible in ISC tenant

  7. VA status is healthy

  8. Source test connectivity succeeds

  9. Connector validation:

  10. Aggregation test succeeds

  11. Provisioning test succeeds

  12. Logs show successful call path through VA

Common Issues and Resolutions

Issue 1: Upload takes too long or fails
Cause:
Browser upload is inefficient for very large files.

Fix:
Use AzCopy with resumable transfer.

Issue 2: Managed image creation fails
Cause:
Region mismatch or invalid source blob settings.

Fix:

  1. Re-check region alignment
  2. Validate blob URL and access permissions

Issue 3: VM deploys but cannot connect to ISC
Cause:
Outbound network restrictions, DNS issues, proxy/firewall blocks.

Fix:

  1. Validate egress access rules
  2. Verify DNS resolution from VM
  3. Align firewall policy with SailPoint endpoint requirements

Issue 4: SSH access not available
Cause:
NSG inbound rules blocked or authentication mismatch.

Fix:

  1. Verify NSG SSH rule from approved source
  2. Recheck admin credentials/SSH key configuration

Issue 5: VA appears but unhealthy in ISC
Cause:
Partial onboarding, endpoint reachability issues, time sync problems.

Fix:

  1. Revalidate onboarding steps
  2. Check network path
  3. Check system time/NTP consistency

Security and Governance Best Practices

  1. Use dedicated resource groups per environment (prod, non-prod)
  2. Restrict management access with least privilege IAM roles
  3. Avoid public IP where possible; use private access patterns
  4. Implement central logging and alerting for VM/network events
  5. Maintain an ownership matrix (who patches, monitors, supports)
  6. Keep a documented recovery process for redeployment
  7. Track image versions and change history

Performance and Reliability Recommendations

  1. Keep image, storage, and VM in same region
  2. Use reliable upload tooling for large artifacts
  3. Standardize deployment with templates once validated
  4. Monitor resource health continuously
  5. Perform periodic VA connectivity tests after network changes

Suggested Post Tags for SailPoint Discuss Draft

  1. identity-security-cloud
  2. virtual-appliance
  3. azure
  4. deployment
  5. community-blog

Suggested Blog Draft Workflow

  1. Post this in Blog Drafts category first
  2. Start with tag WIP if still editing
  3. Change to Feedback Requested for peer review
  4. Move to Ready for Final Review when finalized

Conclusion
Deploying SailPoint Virtual Appliances in Azure is straightforward when approached with strong planning across storage, image lifecycle, networking, and onboarding. Following this process gives you a repeatable and secure deployment pattern that scales across environments and supports stable ISC connector operations.

Author
Shantanu

3 Likes