In this guide, you connect a managed app to SailPoint Identity Security Cloud over SCIM through StackBob.ai, and then reconcile the app's existing accounts and entitlements with SailPoint. You configure a SCIM 2.0 source in SailPoint, choose how accounts are correlated, map and approve the SCIM groups that represent the app's entitlements, and aggregate accounts and entitlements into SailPoint.
When you finish, SailPoint governs the app's accounts and mapped entitlements like any other source. You can use them in its correlation, access profiles, roles, and certifications. StackBob.ai applies the changes SailPoint provisions to the app.
Prerequisites
A StackBob.ai organization where you hold the Org Admin role, with SailPoint set as the primary IGA. See Create your StackBob Org.
A managed app with a completed StackBob NCAP™ sync.
See Quickstart: Connect your first managed app.A SailPoint Identity Security Cloud account with the Admin or Source Admin role.
ℹ️ To setup SailPoint in current live version of StackBob.ai you would need to create Source in SailPoint and and aggregate accounts and groups manually. Automated setup through the SailPoint API is coming soon.
.
1. Start SCIM setup
In StackBob.ai, open the managed app that was synced with StackBob.ai through NCAP™. The app's status in StackBob.ai is Synced with App.
On the Set Up Provisioning from SailPoint banner, select Set Up SCIM.
ℹ️ This step sets all accounts to Unreconciled status. The status shows that reconciliation between the managed app (GitHub) and your primary IGA (SailPoint) still needs to happen.
2. Configure the SCIM 2.0 source in SailPoint
The Configure Connection Settings in SailPoint banner shows the Base URL and API token that StackBob.ai generated for this managed app. Keep the banner open while you add them to SailPoint. The banner tracks the test requests SailPoint sends to StackBob.ai, and it shows when the connection is working.
In SailPoint, go to Admin → Connections → Sources and select Create New.
Search for SCIM 2.0 SaaS and select Configure.
Under Base Configuration, enter a Source Name and a Source Description, and then select a Source Owner.
Under Connection Settings, select API Token as the authentication type and fill in these fields:
Base URL: paste the Base URL from StackBob.ai.
API Token: paste the API token from StackBob.ai.
Go to Review and Test and select Test Connection. SailPoint shows Test Success! and starts generating configuration recommendations, which can take several minutes.
Select Continue Editing to stay on the source, or Return to Source List.
✅ Name the source in SailPoint after the managed app and the workspace (with StackBob.ai tag), for example GitHub - Demo Incorporated (via StackBob). So your SailPoint admins can then see at a glance which app and workspace the source covers, and that it connects through StackBob.ai.
Finish testing
When StackBob.ai receives SailPoint's test request, the banner shows the latest test log and the message Success! StackBob established a connection with SailPoint, and the Finish Testing button becomes available.
Check that the latest test log shows a successful
GET /Usersrequest.Select Finish Testing.
⚠️ Until you select Finish Testing, StackBob.ai treats requests from SailPoint as tests. After you select it, setup moves to the next step, and all SCIM requests are treated as live. From then on, they affect reconciliation and provisioning in the managed app.
🔒 Treat the API token as a secret. Anyone who has it can provision the app through StackBob.ai.
3. Choose how accounts are correlated
This step appears only if the managed app doesn't provide email addresses for its accounts, as with GitHub. If you don't see the banner, go to step 4.
SailPoint usually correlates accounts to identities by email address. If the app doesn't provide email addresses, choose which account attribute StackBob.ai sends to SailPoint for correlation.
On the Emails are Missing banner, select one option:
Email: Every account needs an email address. Add the missing email addresses to the accounts on the Accounts tab in StackBob.ai.
Username: StackBob.ai uses each account's username as the unique identifier for correlation.
Select Save & Continue.
✅ Choose Email if your SailPoint identities have the same email addresses your users have in the app. SailPoint's default correlation then works without changes. If you choose Username, update the source's account correlation in SailPoint so it matches the account username to identity attribute that holds it.
4. Select entitlement types for SCIM group mapping
StackBob NCAP™ automatically discovers the types of entitlements the app uses. For GitHub, these are Role, Team, and Repository. Choose which types StackBob.ai reconciles with SailPoint through SCIM groups. StackBob.ai then suggests a SCIM group for each entitlement value of the selected types.
On the Select entitlements for SCIM groups mapping banner, turn on each entitlement type you want SailPoint to govern. In this example, Role, Team, and Repository are all turned on.
Select Save & Continue.
✅ Types with many values, such as Repository, can produce a large number of SCIM groups. Turn on only the types you actually want SailPoint to govern.
ℹ️ To change the selected entitlement types later, go to App → Settings → Provisioning → Entitlements for SCIM Groups Mapping in StackBob.ai. You can turn off only the entitlement types that haven't been synced with the IGA yet.
5. Review and approve the SCIM group mapping
StackBob.ai suggests a SCIM group for each entitlement value of the types you selected in step 4. In this GitHub example, that means a group for each role (such as Owner and Member), for each team, and for each repository's access.
When you approve a group, StackBob.ai exposes it over SCIM, and SailPoint aggregates it as an entitlement. Groups you don't approve aren't exposed, and they stay unmanaged until you approve them and run aggregation again.
On the Review and approve SCIM group mapping banner, select Show Unreviewed Groups. The SCIM Groups tab opens, filtered to show only unapproved groups.
For each group, review the entitlement it represents and the accounts that currently hold it.
For each entitlement you want to govern in SailPoint, do one of the following:
Map it to an existing group: select the Map action and enter the name of the group to match.
Approve it as a new SCIM group: approve the group with the name StackBob.ai suggests.
When you're ready to aggregate, select Continue on the setup banner. The button becomes available once at least one group is approved or mapped.
ℹ️ Only SCIM groups need approval. SailPoint aggregates all the app's accounts in step 6, whether or not their groups are approved.
✅ Start with a few groups to get familiar with the flow. You can map or approve the rest later, then run entitlement aggregation in SailPoint again to pick them up. Each entitlement mapping has its own status, so you can filter which groups are reviewed, aggregated, or not yet aggregated.
6. Aggregate accounts and entitlements in SailPoint
In SailPoint, aggregation completes the reconciliation. SailPoint pulls in the app's accounts and approved SCIM groups, and then correlates the accounts to identities. Until you run it, the app's status in StackBob.ai is SailPoint Aggregation Pending.
In SailPoint, open the source you created in step 2.
Run Entitlement Aggregation. SailPoint imports the approved SCIM groups as entitlements.
Run Account Aggregation. SailPoint imports all of the app's accounts and correlates them to identities.
When both aggregations finish, review the source's uncorrelated accounts. These are accounts with no matching identity in SailPoint.
When StackBob.ai receives SailPoint's aggregation requests, the app's status changes to Fully synced. You don't need to do anything else in StackBob.ai.
ℹ️ Run entitlement aggregation before account aggregation. That way, SailPoint recognizes each account's entitlements when it imports the account.
ℹ️ SailPoint handles uncorrelated accounts natively, so this flow has no separate rogue user review in StackBob.ai. Resolve uncorrelated accounts in SailPoint as you would for any other source: correlate each one to an identity manually, or remove its access.
Result
GitHub is now governed from SailPoint through StackBob.ai, and the app's status in StackBob.ai is Fully synced.
Accounts: GitHub accounts are aggregated into SailPoint and correlated to identities.
Entitlements: GitHub roles, teams, and repository access appear as entitlements on the source. You can add them to access profiles and roles, and include them in certifications.
Provisioning: When SailPoint grants or revokes one of these entitlements, StackBob.ai applies the change in GitHub.
Entitlements you didn't approve in step 5 stay unmanaged. You can approve them later from the SCIM Groups tab, then run entitlement aggregation in SailPoint again to pick them up.
Need help?
If something doesn't work as described, contact your StackBob.ai onboarding representative, or send us a message from the chat in the bottom-right corner of this page.