CyberArk Identity Administration & SailPoint SCIM Integration (2026) Complete Guide – Architecture, Security, User Provisioning & Identity Governance

• May 29 2026

CyberArk Identity Administration & SailPoint SCIM Integration (2026) Complete Guide – Architecture, Security, User Provisioning & Identity Governance

Modern cybersecurity is no longer limited to protecting servers, endpoints, or applications. In 2026, identity has become the new security perimeter. Organizations must continuously secure users, applications, cloud services, privileged accounts, APIs, workloads, and machine identities across hybrid infrastructures.

This is where the combination of CyberArk and SailPoint delivers one of the most powerful identity security and governance ecosystems available today.

CyberArk Identity Administration provides centralized administration and authentication services for CyberArk SaaS solutions, while SailPoint enables enterprise-grade Identity Governance and Administration (IGA). Together, these platforms help organizations automate provisioning, enforce governance, improve compliance, and strengthen security controls across enterprise environments.

In this detailed guide, you will learn:

▪ What is CyberArk Identity Administration
▪ CyberArk Identity Security Platform Shared Services (ISPSS)
▪ Identity Administration architecture and workflows
▪ Security fundamentals and MFA best practices
▪ Identity Connector deployment requirements
▪ User provisioning models
▪ Service users and role-based access
▪ SailPoint SCIM integration with CyberArk
▪ OAuth2 configuration and bearer token creation
▪ SCIM provisioning workflows
▪ Real-world enterprise implementation scenarios
▪ Security best practices for Identity Governance

---

What is CyberArk Identity Administration?

CyberArk Identity Administration is the centralized identity management and provisioning component of CyberArk Identity Security Platform Shared Services (ISPSS).

It provides a unified interface to:

▪ Provision users
▪ Configure authentication
▪ Manage identity lifecycle
▪ Apply role-based access control
▪ Configure MFA and passwordless authentication
▪ Generate audit and security reports
▪ Manage access to CyberArk SaaS services

Identity Administration acts as the core identity layer for CyberArk’s cloud ecosystem.

---

Understanding CyberArk Identity Security Platform Shared Services (ISPSS)

CyberArk Identity Security Platform Shared Services is a unified SaaS administration platform that integrates multiple CyberArk security solutions.

The Shared Services platform currently integrates with:

▪ CyberArk Privilege Cloud
▪ Dynamic Privileged Access
▪ Cloud Entitlements Manager
▪ Identity Administration

The platform provides:

▪ Centralized user administration
▪ Unified authentication controls
▪ Role-based access management
▪ Single Sign-On (SSO)
▪ Multi-Factor Authentication (MFA)
▪ Lifecycle management
▪ Cross-platform audit visibility

This centralized approach improves operational efficiency and simplifies enterprise identity governance.

Learn more about CyberArk architecture here:👉 CyberArk Privilege Cloud Complete Guide 2026

---

Why Identity Administration is Important in 2026

Identity attacks are now one of the biggest cybersecurity threats globally.

Attackers commonly target:

▪ Privileged accounts
▪ Cloud identities
▪ Session tokens
▪ MFA workflows
▪ Password reset mechanisms
▪ Identity providers

CyberArk Identity Administration helps organizations mitigate these threats through centralized identity security controls.

Key benefits include:

▪ Strong MFA enforcement
▪ Passwordless authentication
▪ Role-based authorization
▪ Identity lifecycle automation
▪ Unified audit visibility
▪ Compliance reporting
▪ Risk reduction across SaaS services

---

Security Fundamentals for Identity Administration

CyberArk strongly recommends implementing layered security controls to protect identity infrastructure.

The platform follows modern identity security principles aligned with:

▪ Zero Trust Security
▪ NIST recommendations
▪ Least Privilege Access
▪ Strong MFA enforcement
▪ Identity verification workflows

---

Multi-Factor Authentication (MFA) Best Practices

MFA is one of the most critical controls for protecting identities.

CyberArk recommends enabling MFA for:

▪ VPN access
▪ Identity Administration portals
▪ Server logins
▪ Workstation authentication
▪ Sensitive applications
▪ Privileged account access

Recommended authentication methods include:

▪ FIDO2 hardware keys
▪ Passkeys
▪ Biometrics
▪ Mobile push authentication
▪ MFA number matching

CyberArk also supports passwordless authentication to reduce credential theft risks.

---

Password Hygiene Recommendations

Strong password policies complement MFA protections.

CyberArk recommends:

▪ Passwords longer than 12 characters
▪ Complex passphrases
▪ Unique passwords per system
▪ Password expiration within 90 days
▪ Avoiding reused passwords
▪ Enterprise-grade password managers

Poor password hygiene remains one of the largest attack vectors in identity compromise.

---

Session Security and Timeout Management

Session hijacking remains a major threat in cloud environments.

CyberArk recommends:

▪ Restricting session duration
▪ Configuring short inactivity timeouts
▪ Monitoring session anomalies
▪ Applying session protection policies

Sessions should generally not exceed 12 hours.

---

Least Privilege Administration

One of the most important security principles is minimizing administrative access.

Organizations should:

▪ Reduce the number of privileged administrators
▪ Create role-specific permissions
▪ Use read-only roles where possible
▪ Separate administrative duties
▪ Use approval workflows for elevated access

This significantly reduces the attack surface.

---

Identity Connector Overview

The Identity Connector enables integration between on-premises identity systems and CyberArk cloud services.

It supports:

▪ Active Directory integration
▪ LDAP integration
▪ User synchronization
▪ Password management
▪ Authentication services
▪ Lifecycle management

The connector acts as a bridge between enterprise infrastructure and CyberArk cloud services.

---

Identity Connector Server Requirements

CyberArk recommends deploying at least two connectors for redundancy.

Minimum requirements include:

▪ Windows Server 2016 or later
▪ 8 GB RAM
▪ 2-core CPU
▪ Internet connectivity
▪ .NET Framework 4.5 or later

Best practices include:

▪ Avoid installing on Domain Controllers
▪ Harden the server using CIS benchmarks
▪ Install antivirus protection
▪ Restrict unnecessary network protocols
▪ Protect local administrator accounts

---

Hardening the Identity Connector

Connector hardening is critical for securing identity infrastructure.

Recommended controls include:

▪ Endpoint hardening
▪ PAM controls for administrative access
▪ Windows patch management
▪ Removal of unnecessary server roles
▪ Restriction of inbound traffic
▪ Secure RADIUS configurations
▪ Anti-malware protection

Identity infrastructure should always be treated as a Tier-0 security asset.

---

User Types in Identity Administration

Identity Administration supports two major user types.

Interactive Users

Interactive users access:

▪ User Portal
▪ Shared CyberArk services
▪ SaaS applications

Users can authenticate through:

▪ Active Directory
▪ LDAP
▪ Microsoft Entra ID
▪ Google Workspace
▪ SAML-based Identity Providers

---

Service Users

Service users are designed for:

▪ API integrations
▪ Automation workflows
▪ SCIM provisioning
▪ Machine-to-machine communication

Service users:

▪ Cannot access the User Portal
▪ Typically bypass MFA
▪ Operate with least privilege access
▪ Support OAuth2 authentication

---

Role-Based Access Control (RBAC)

Roles determine which CyberArk services and permissions users can access.

Administrators can:

▪ Assign users to roles
▪ Configure service-level permissions
▪ Apply least privilege models
▪ Restrict administrative functions

Users must belong to at least one role before accessing services.

---

User Provisioning Workflow

A typical CyberArk provisioning workflow includes:

▪ Preparing deployment prerequisites
▪ Receiving tenant onboarding details
▪ Configuring Identity Administration
▪ Installing Identity Connector
▪ Integrating external directories
▪ Configuring MFA
▪ Assigning roles
▪ Inviting users to services

This creates a centralized identity governance workflow.

---

Preparing for Deployment

Before onboarding users, organizations must:

▪ Collect ISPSS tenant details
▪ Configure InstallerUser credentials
▪ Validate server prerequisites
▪ Configure network and firewall rules
▪ Prepare Active Directory permissions

This ensures smooth deployment and integration.

---

Understanding InstallerUser

InstallerUser is a built-in Identity Administration account used for connector installation.

Important notes:

▪ Password expires every 24 hours
▪ Full login name format is required
▪ Only alphanumeric passwords are recommended
▪ Used during connector installation workflows

This improves security during deployment operations.

---

Network and Firewall Requirements

All CyberArk Identity Administration communications are outbound only.

Required outbound connectivity includes:

▪ TCP 443
▪ TCP 80 for certificate validation services

Organizations should avoid:

▪ Deep packet inspection of SSL traffic
▪ Blocking CyberArk cloud domains
▪ Restricting certificate validation endpoints

Proper network configuration is essential for reliable connector operations.

---

SailPoint SCIM Integration with CyberArk

One of the most powerful capabilities in modern identity governance is SCIM provisioning integration between SailPoint and CyberArk.

SCIM (System for Cross-domain Identity Management) enables automated synchronization between identity governance platforms and target systems.

Learn more about SailPoint Identity Security Cloud here:
👉 SailPoint Identity Security Cloud User Guide 2026

And compare IIQ vs ISC here:
👉 SailPoint IdentityIQ vs Identity Security Cloud (ISC) – Complete Comparison 2026

---

What SCIM Integration Supports

SCIM integration enables SailPoint to provision:

▪ Users
▪ Groups
▪ Group memberships
▪ Safes
▪ Safe permissions
▪ Privileged account data

This allows centralized identity governance using SailPoint while leveraging CyberArk privileged access controls.

---

Creating a Service User for SCIM

The SCIM integration begins by creating a service user.

This service user acts on behalf of SailPoint when sending provisioning requests to Identity Administration.

Configuration includes:

▪ Creating the user
▪ Enabling OAuth confidential client mode
▪ Configuring password policies
▪ Assigning service-user permissions

---

Creating Roles for SCIM Provisioning

The next step involves assigning administrative rights through roles.

Required permissions may include:

▪ Role management
▪ User management
▪ Vault management

These permissions depend on the CyberArk solution being integrated.

---

OAuth2 Client App Configuration

The OAuth2 Client App enables secure API authentication.

Configuration includes:

▪ JWT token settings
▪ Client Credentials grant type
▪ SCIM API scopes
▪ Automatic deployment permissions

OAuth2 secures API communication between SailPoint and CyberArk.

---

Bearer Token Generation

Bearer tokens are used by SailPoint to authenticate SCIM API requests.

The token includes:

▪ Client ID
▪ Client Secret
▪ Access permissions
▪ Token expiration policies

Organizations should rotate bearer tokens regularly for security.

---

SCIM User Provisioning Workflow

The provisioning process typically follows this sequence:

▪ SailPoint detects identity changes
▪ SCIM API request is generated
▪ Identity Administration validates the request
▪ User/group updates are processed
▪ CyberArk services receive updated identities

This creates automated identity lifecycle management.

---

Benefits of SailPoint + CyberArk Integration

The combined solution delivers:

▪ Automated identity governance
▪ Centralized privileged access management
▪ Reduced manual provisioning effort
▪ Faster onboarding and offboarding
▪ Improved compliance reporting
▪ Better audit visibility
▪ Stronger identity security posture

This is especially valuable for enterprise-scale environments.

---

CyberArk Privilege Cloud and PAM Integration

Organizations integrating SailPoint with CyberArk PAM solutions should understand the differences between deployment models.

Read more here:

👉 Difference Between CyberArk Privilege Cloud and PAM Self-Hosted

And here:

👉 CyberArk Secure Infrastructure Access (SIA) vs PSM Complete Guide

---

Monitoring and Security Analytics

CyberArk Identity Administration provides centralized monitoring capabilities.

Organizations should monitor:

▪ Authentication attempts
▪ Failed logins
▪ Provisioning activity
▪ API usage
▪ MFA enrollment status
▪ Suspicious behavior patterns

Logs should also be forwarded to SIEM platforms such as Splunk.

---

Best Practices for Enterprise Deployments

For successful implementation:

▪ Use MFA everywhere possible
▪ Enforce least privilege access
▪ Harden Identity Connector servers
▪ Monitor provisioning logs regularly
▪ Review policy assignments carefully
▪ Test SCIM integrations before production rollout
▪ Rotate bearer tokens periodically
▪ Use passwordless authentication where possible

Identity security should always be treated as a continuous process.

---

CyberArk Training and Learning Resources

If you want hands-on experience with CyberArk Privilege Cloud, Identity Administration, SCIM provisioning, and enterprise PAM deployments, explore the following training:

👉 CyberArk Privilege Cloud Self-Paced Online Training

---

Conclusion

CyberArk Identity Administration combined with SailPoint Identity Governance creates a powerful enterprise identity security ecosystem capable of managing both standard and privileged identities across hybrid infrastructures.

By integrating SCIM provisioning, OAuth2 authentication, centralized governance, MFA enforcement, and automated lifecycle management, organizations can significantly strengthen their cybersecurity posture while improving operational efficiency.

As identity attacks continue to rise in 2026, enterprises must adopt modern identity governance and privileged access management solutions to secure users, applications, cloud environments, APIs, and machine identities.

Organizations implementing CyberArk and SailPoint together gain:

▪ Stronger identity governance
▪ Centralized privileged access security
▪ Automated provisioning workflows
▪ Reduced compliance risk
▪ Improved operational efficiency
▪ Enhanced visibility across identities and access

Identity security is no longer optional. It is now the foundation of enterprise cybersecurity.