What if I'm not the only one? Responding to cases where other systems operate independently
Source: YouTube · SailPoint · published Jul 1, 2026 · 29:46
This video demonstrates how to use SailPoint Identity Security Cloud's (ISC) native change detection alongside Privileged Task Automation (PTA) to identify who added a user to an Active Directory group when ISC isn't the exclusive group manager 0:14.
Key Takeaways:
• Native change detection can be configured on ISC sources to emit workflow triggers when an aggregation discovers a change not made by ISC, such as an AD group membership update 1:12.
• PTA allows workflows to execute administrative-level Windows tasks, like running PowerShell scripts, but requires enabling the Privileged Access Gateway on your Virtual Appliance cluster (adding 2 CPUs and 4GB RAM) and a WinRM-enabled Windows server 2:47.
• Sensitive credentials and server addresses for the PTA connection are securely stored in SailPoint's Parameter Store rather than being hardcoded into the workflow 2:17.
• The solution uses a PowerShell script passed via PTA to query domain controller security logs (Event ID for group member add), iterating across multiple DCs since audit logs don't sync across them 5:49.
• The workflow filters events for specific entitlement additions, loops through them, and uses a compare strings operator to branch logic—ignoring approved accounts (like a Grouper service account) and sending alert emails for unauthorized changes 11:02.
By combining these native ISC features, organizations can intelligently detect and respond to out-of-band Active Directory group modifications in near real-time.
Sources:
- 0:14 Introduction to the problem of non-exclusive AD group management
- 1:12 Explanation of native change detection configuration
- 2:17 Overview of Parameter Store for secure credential management
- 2:47 Introduction to Privileged Task Automation (PTA) requirements
- 5:49 Querying AD security audit logs and DC sync limitations
- 11:02 Workflow filtering and branching logic for approved vs. unauthorized changes
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Identity & Access Management. Commonly maps to: Identity and Access Management (IAM), Security Architecture and Engineering. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
[music] >> Hey everybody. My name is Steven Hollern Audi and I'm one of the solution architects over here at SailPoint. And I'm here today to talk to you about leveraging identity security cloud's native change detection in a world where other systems are allowed to add and remove group membership alongside us. So, what does that mean? Whether it's the start of your ISC journey or some legacy system that manages specific active directory groups, exclusive administration might not be possible. Um we might have to play well with others. So, we're going to achieve this by using native change detection and privileged task automation to query the domain controllers themselves and find out who or what user account performed a group add and make decisions based on that. I will go over some backgr…