An enterprise identity team is actively deploying SailPoint IdentityIQ integrated with CyberArk SCIM to automate secondary privileged account provisioning.

{
  "signal_id": "68224de7-eaa3-5ad8-a8e4-2ad6bb42b30f",
  "signal_type": "reddit-company",
  "signal_subtype": "customerFeedback",
  "detected_at": "2026-08-26T08:40:07+00:00",
  "company": {
    "name": "SailPoint",
    "domain": "sailpoint.com"
  },
  "data": {
    "nsfw": false,
    "stage": "none",
    "awards": 0,
    "timing": "in_progress",
    "topics": [
      "identity governance",
      "integration",
      "iga",
      "pam"
    ],
    "post_id": "1vyrazr",
    "summary": "An enterprise identity team is actively deploying SailPoint IdentityIQ integrated with CyberArk SCIM to automate secondary privileged account provisioning.",
    "category": "integration",
    "comments": [
      {
        "url": "https://www.reddit.com/r/CyberARk/comments/1vyrazr/comment/p5zknp5/",
        "depth": 0,
        "score": 2,
        "author": "b1xby2",
        "excerpt": "Option B is what was recommended to us by Sailpoint. Not sure why step 2 is needed though, if the account link didn’t already get added to the identity cube during creation you could always run a targeted aggregation.\n\n Option A would be great if CyberArk allowed for safe creation along with onboarding, but they make you onboard the account into a predefined safe. Good for system account, not good",
        "posted_at": "2026-08-26T11:31:16.000Z",
        "author_url": "https://www.reddit.com/user/b1xby2/"
      },
      {
        "url": "https://www.reddit.com/r/CyberARk/comments/1vyrazr/comment/p64o7fe/",
        "depth": 0,
        "score": 1,
        "author": "rukkro",
        "excerpt": "How do you manage the experience for end users to know / request access into CyberArk / Idira?\n\n We commonly see a daisy chain of request.\n\n Request privilege account.\n\n Request CyberArk access.\n\n Our environment, we don’t utilize the personal vault due to the dependency of requiring dual approval on every checkout. Therefore have vaults for personal accounts and separate them into smaller groups",
        "posted_at": "2026-08-27T01:43:13.000Z",
        "author_url": "https://www.reddit.com/user/rukkro/"
      }
    ],
    "evidence": [
      "[post] We are currently deploying the CyberArk SCIM integration with SailPoint IdentityIQ, and I would appreciate input on the recommended approach for managing privileged accounts (secondary IDs) through SailPoint",
      "[comment u/b1xby2] Option B is what was recommended to us by Sailpoint. Not sure why step 2 is needed though, if the account link didn’t already get added to the identity cube during creation you could always run a targeted aggregation."
    ],
    "virality": "low",
    "post_date": "2026-08-26T08:40:07.000Z",
    "post_kind": "text",
    "post_text": "Hello All,\n\nWe are currently deploying the CyberArk SCIM integration with SailPoint IdentityIQ, and I would appreciate input on the recommended approach for managing privileged accounts (secondary IDs) through SailPoint\n\n**Current state:** The end user raises a ServiceNow request for secondary ID creation, SailPoint provisions the ID in Active Directory, and the account is then added to CyberArk manually. I am looking to automate the final step via the SCIM integration.\n\nI have outlined two candidate approaches below and would welcome any alternatives.\n\n**Option A: Discovery-driven onboarding**\n\n **1.** SailPoint AD connector creates the secondary ID per the defined naming convention \n **2.** Account is placed in the designated OU \n **3.** A CyberArk discovery rule is scoped to that OU \n **4.** CyberArk scans, detects, and onboards the account automatically \n **5.** SCIM is used to assign the primary user identity to the relevant safe group\n\n**Option B: Chained provisioning via the SailPoint PAM module**\n\n **1.** SailPoint triggers the AD connector to create the account \n **2.** A custom workflow step pauses the pipeline to extract the newly created AD account details \n **3.** SailPoint issues an outbound REST API call to the CyberArk account onboarding endpoint\n\n**Note:** I have previously built full lifecycle automation for this use case at another client, though without the...",
    "sentiment": "neutral",
    "subreddit": "CyberARk",
    "event_date": "2026-08",
    "post_flair": [
      "Recommendations"
    ],
    "post_title": "Automating privileged (secondary) account onboarding - SailPoint IIQ + CyberArk SCIM integration",
    "prominence": "core",
    "source_url": "https://www.reddit.com/r/CyberARk/comments/1vyrazr/automating_privileged_secondary_account/",
    "entity_role": "vendor",
    "post_author": "aviral1402",
    "upvote_ratio": 0.88,
    "mention_count": 1,
    "mention_surge": false,
    "subreddit_url": "https://www.reddit.com/r/CyberARk/",
    "total_upvotes": 6,
    "comments_total": 4,
    "total_comments": 4,
    "event_date_text": "currently deploying",
    "other_companies": [
      {
        "name": "CyberArk",
        "role": "partner"
      }
    ],
    "post_author_url": "https://www.reddit.com/user/aviral1402/",
    "signal_category": "feedback",
    "comments_included": 2,
    "products_mentioned": [
      "SailPoint IdentityIQ"
    ]
  }
}

curl https://signals.autobound.ai/v1/signals/68224de7-eaa3-5ad8-a8e4-2ad6bb42b30f \
  -H "X-API-KEY: $AUTOBOUND_API_KEY"

curl -X POST https://signals.autobound.ai/v1/companies/enrich \
  -H "X-API-KEY: $AUTOBOUND_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain":"sailpoint.com","limit":20}'