Saviynt Technical Guide for Enterprise Identity Governance

Overview

Saviynt is an enterprise Identity Governance and Administration (IGA) platform designed to manage user identities, access requests, approvals, certifications, and separation-of-duties controls across on-premises and cloud systems. Enterprises use it to centralize identity data, automate joiner-mover-leaver workflows, reduce excessive access, and produce auditable evidence for frameworks such as SOX, ISO 27001, HIPAA, and GDPR.

Saviynt is commonly selected when organizations need a single governance layer across Active Directory, Azure AD, AWS, SAP, ServiceNow, databases, and business applications. Its strengths include cloud-native delivery, broad connector support, analytics-driven access governance, and strong support for privileged and application access use cases.

Architecture

A typical Saviynt deployment includes these core components:

• Saviynt Cloud Platform: hosts the application UI, workflow engine, policy engine, analytics, and reporting.
• Identity Repository: stores users, accounts, entitlements, roles, and audit records.
• Connectors: integrate with directories, HR systems, cloud providers, databases, and SaaS applications.
• Job Control Engine: runs imports, correlation, certifications, and provisioning tasks.
• REST APIs: support automation, external orchestration, and CI/CD-driven configuration promotion.

Deployment models

• SaaS: most common; Saviynt hosts the control plane.
• Hybrid: SaaS platform with enterprise-managed connectivity to internal targets.
• Private connectivity: via VPN, reverse proxy, or approved secure connector patterns for internal applications.

Data flow

1. HR or authoritative source imports identities.
2. Accounts and entitlements are aggregated from target systems.
3. Correlation links accounts to identities.
4. Roles, policies, and SoD rules evaluate access.
5. Requests and approvals trigger provisioning workflows.
6. Audit logs and certification evidence are retained for compliance.

Implementation Guide

1. Validate connectivity to Saviynt APIs

export SAVIYNT_TENANT="https://example.saviyntcloud.com"
export SAVIYNT_TOKEN="eyJhbGciOi..."
curl -s -X GET "$SAVIYNT_TENANT/ECM/api/v5/getConnections" -H "Authorization: Bearer $SAVIYNT_TOKEN" -H "Content-Type: application/json"

2. Define a connection payload

Create connection.json:

{
  "connectionname": "AWS-Prod-IAM",
  "connectiontype": "AWS",
  "description": "Production AWS IAM connector",
  "status": 1,
  "vaultConfiguration": "CyberArk",
  "accessKey": "${AWS_ACCESS_KEY_ID}",
  "secretKey": "${AWS_SECRET_ACCESS_KEY}",
  "regions": "eu-central-1,eu-west-1"
}

3. Create the connection through the API

curl -s -X POST "$SAVIYNT_TENANT/ECM/api/v5/createConnection" -H "Authorization: Bearer $SAVIYNT_TOKEN" -H "Content-Type: application/json" -d @connection.json

4. Trigger account aggregation

curl -s -X POST "$SAVIYNT_TENANT/ECM/api/v5/runJob" -H "Authorization: Bearer $SAVIYNT_TOKEN" -H "Content-Type: application/json" -d '{"jobname":"Account Import - AWS-Prod-IAM"}'

5. Configure role import as code

Create roles.yaml:

roles:
  - name: Finance-ReadOnly
    description: Read-only finance access
    entitlements:
      - system: SAP-PRD
        value: Z_FI_DISPLAY
      - system: Snowflake-PRD
        value: FINANCE_RO

6. Promote configuration via automation

Use a CI pipeline to store JSON and YAML definitions in Git, then call Saviynt APIs from a controlled runner. Ensure API tokens are stored in a secrets manager such as HashiCorp Vault or AWS Secrets Manager.

Code Examples

Example 1: Bash job status check

JOB_ID="845921"
curl -s "$SAVIYNT_TENANT/ECM/api/v5/getJobStatus?jobid=$JOB_ID" -H "Authorization: Bearer $SAVIYNT_TOKEN" | jq .

Example 2: YAML access policy definition

policy:
  name: SoD-SAP-Payments
  description: Prevent payment creation and approval by same user
  rules:
    - entitlement: SAP_FB60_CREATE
    - entitlement: SAP_F110_APPROVE
  riskLevel: high
  action: violation

Example 3: Python API authentication and request

import requests
base_url = "https://example.saviyntcloud.com"
token = "eyJhbGciOi..."
headers = {"Authorization": f"Bearer {token}", "Content-Type": "application/json"}
payload = {"jobname": "User Import - Workday"}
r = requests.post(f"{base_url}/ECM/api/v5/runJob", json=payload, headers=headers, timeout=30)
r.raise_for_status()
print(r.json())

Security Hardening

• Enforce SSO with MFA for all administrators through Azure AD or Okta.
• Restrict API access using least privilege service accounts and short-lived tokens.
• Store connector secrets in an external vault; avoid static credentials in job definitions.
• Require TLS 1.2+ for all integrations and validate certificate chains on proxies.
• Segment outbound connector traffic and allowlist only required endpoints.
• Enable detailed audit logging for access requests, approvals, policy changes, and provisioning events.
• Review high-risk roles and SoD violations through scheduled certifications.
• Encrypt exported reports and downstream evidence archives.

Comparison

Troubleshooting

Error 1: Authentication failure

Log sample:

2026-02-14 09:21:33,118 ERROR ApiAuthFilter - JWT validation failed for request /ECM/api/v5/runJob: token expired at 2026-02-14T09:15:00Z

Fix: Refresh the bearer token, verify IdP clock synchronization, and reduce token reuse in automation.

Error 2: Connector timeout during aggregation

Log sample:

2026-02-14 10:02:47,441 WARN JobControlService - Account import failed for connection AWS-Prod-IAM: java.net.SocketTimeoutException: Read timed out

Fix: Increase API timeout, verify firewall egress rules, and test target API latency from the integration path.

Error 3: Account correlation mismatch

Log sample:

2026-02-14 11:44:05,902 INFO CorrelationEngine - Uncorrelated account detected: accountName=jdoe_sap, endpoint=SAP-PRD, reason=No matching employeeID

Fix: Normalize authoritative identifiers, update correlation rules, and re-run user and account import jobs.

Best Practices

Do

• Use HR as the authoritative source for workforce identities.
• Keep roles business-aligned, for example Finance-Approver instead of system-specific names only.
• Version-control connection definitions, policies, and role mappings in Git.
• Run certifications on privileged access and toxic combinations monthly.

Don't

• Do not assign entitlements directly when a governed role can be used.
• Do not expose long-lived API tokens in CI logs or shell history.
• Do not import every entitlement without curation; noisy catalogs reduce certification quality.
• Do not skip correlation tuning before enabling automated provisioning at scale.