Share via

Sailpoint Identity function failure

Isabella Baker 0 Reputation points
2025-08-21T00:27:32.4533333+00:00

Hi Everyone,

We have used the built in Sentinel Data connector for Sailpoint IdentityNow. The Sailpoint team have confirmed they followed the access token steps provided in the data connector.

We have successfully deployed it with the client ID, secret and tenant ID. However we are getting no events and the log stream only shows this error:

User's image

The Sailpoint team have confirmed they are getting no api logs from the client ID they have provided us and have used postman to confirm the client ID + secret work.

Any guidance on how to troubleshoot or a possible solution for this would be greatly appreciated!

Microsoft Security | Microsoft Sentinel

6 answers

Sort by: Most helpful
  1. Konstantinos Lianos 425 Reputation points Student Ambassador
    2026-03-21T13:04:50.71+00:00

    Hello @Isabella Baker ,
    This looks more like a Function App runtime/dependency issue than a SailPoint API permission problem.

    The SailPoint IdentityNow connector is a community Azure Functions connector and is intended to run on Python 3.9, not 3.8. There is also a known issue where the function fails during SearchEvent module import/startup, so no logs are ingested even though the credentials are correct.

    Also, changing the Python version in the portal alone is usually not enough. For Azure Functions, you need to rebuild and redeploy the app so dependencies are recreated for the new runtime. Using remote build is recommended.

    So the practical fix is:

    Redeploy the connector as a new Function App using Python 3.9

    Use remote build

    Verify all required app settings are present and case-sensitive

    If it still fails with import/dependency errors, treat it as a connector package issue, not an auth issue

    Because this connector is supported by SailPoint, not Microsoft, I would raise it with SailPoint support and reference the known GitHub issue if the built-in Sentinel deployment continues to deploy an incompatible runtime.

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments No comments

  2. Deleted

    This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.


    Comments have been turned off. Learn more

  3. Deleted

    This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.


    Comments have been turned off. Learn more

  4. Deleted

    This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.


    Comments have been turned off. Learn more

  5. Deleted

    This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.


    Comments have been turned off. Learn more

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.