[Dhara Shah (dhara-shah-sp)]

Required items, please complete

Change(s):

• Created a CCF Connector for SailPoint IdentityNow Function App.

Reason for Change(s):

• The migration is being completed because the existing functionality is scheduled to be deprecated soon. Moving to new framework ensures continued support and avoids disruption once the earlier functionality is retired.

Version Updated:

• No

Testing Completed:

• Yes

Checked that the validations are passing and have addressed any issues that are present:

• Yes

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds/updates artifacts for a Codeless Connector Framework (CCF) connector to ingest SailPoint Identity Security Cloud (IdentityNow) Search API “events” into Microsoft Sentinel.

Changes:

• Added a new Log Analytics table schema for SailPointISC_Events_CL.
• Updated RestApiPoller config to use new connector identifiers, stream, and polling parameters.
• Updated connector definition UI strings and setup instructions for Identity Security Cloud.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 6 comments.

File	Description
Solutions/SailPointIdentityNow/Data Connectors/SearchEvent_CCF/table_SailPointISC_Events.json	Introduces the custom table schema for ingested events.
Solutions/SailPointIdentityNow/Data Connectors/SearchEvent_CCF/SailPointIdentityNow_PollerConfig.json	Re-points the poller to the new connector/table identifiers and adjusts polling/limit settings.
Solutions/SailPointIdentityNow/Data Connectors/SearchEvent_CCF/SailPointIdentityNow_DCR.json	Replaces prior DCR content with a table resource definition (likely unintended).
Solutions/SailPointIdentityNow/Data Connectors/SearchEvent_CCF/SailPointIdentityNow_ConnectorDefinition.json	Updates connector name, table reference, UI text, and setup steps.

Suppressed comments (2)

Solutions/SailPointIdentityNow/Data Connectors/SearchEvent_CCF/SailPointIdentityNow_DCR.json:1

• This file is named *_DCR.json but now defines a Log Analytics table resource (Microsoft.OperationalInsights/workspaces/tables) and no longer defines a Data Collection Rule (Microsoft.Insights/dataCollectionRules) with streamDeclarations/dataFlows. Since SailPointIdentityNow_PollerConfig.json still references dcrConfig (DCE + DCR immutable ID), removing the DCR resource is likely to break deployment/ingestion. Restore this file to an actual DCR resource (including stream declarations and transform KQL), and keep the table schema in table_SailPointISC_Events.json (or rename this file if the intent is to replace the DCR entirely).
  Solutions/SailPointIdentityNow/Data Connectors/SearchEvent_CCF/SailPointIdentityNow_DCR.json:1
• This file is named *_DCR.json but now defines a Log Analytics table resource (Microsoft.OperationalInsights/workspaces/tables) and no longer defines a Data Collection Rule (Microsoft.Insights/dataCollectionRules) with streamDeclarations/dataFlows. Since SailPointIdentityNow_PollerConfig.json still references dcrConfig (DCE + DCR immutable ID), removing the DCR resource is likely to break deployment/ingestion. Restore this file to an actual DCR resource (including stream declarations and transform KQL), and keep the table schema in table_SailPointISC_Events.json (or rename this file if the intent is to replace the DCR entirely).

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[v-maheshbh (v-maheshbh)]

Hi Dhara Shah (@dhara-shah-sp)

Kindly review the Copilot comments and mark them as resolved if they have been addressed.

Please package the solution using V3 tool
https://github.com/Azure/Azure-Sentinel/blob/master/Tools/Create-Azure-Sentinel-Solution/V3/README.md

Kindly attach a screenshot showing the CCF connector in a connected state for testing validation and reference.
Thanks!!

[v-maheshbh (v-maheshbh)]

Hi Dhara Shah (@dhara-shah-sp)

Kindly review above comments.

Thanks!

[Dhara Shah (dhara-shah-sp)]

v-maheshbh (@v-maheshbh) : Kindly review the latest commits and let me know if you have any questions.
Thank you.

[v-atulyadav]

Hi Dhara Shah (@dhara-shah-sp),
Validation is failing because the analytical rules were updated without incrementing their versions. Please update the version of each affected rule and repackage the solution.

Additionally, please review the Copilot suggestions and implement the applicable recommendations. Once all suggested changes have been implemented, click the Resolve Conversation button.

Lastly, please attach a screenshot showing the CCF connector in a connected state for testing, validation, and reference. Thanks

[Dhara Shah (dhara-shah-sp)]

v-atulyadav :

• Attached are the screenshots showing the data connector in connected status and the incoming events.
• Affected analytical rules are already updated from version 1.0.0 to 1.1.0.

[v-maheshbh (v-maheshbh)]

Hi Dhara Shah (@dhara-shah-sp)

Since the Analytic Rule content has been modified, please increment the Analytic Rule version and repackage the solution to ensure all generated artifacts are updated and to resolve the validation error.

Also, update the release notes with the latest changes separated by break tag, and update the release note date accordingly.
Thanks!