Beyond Identity

Connect Beyond Identity to collect identity & sso evidence with automated compliance tests, switched on per workspace.

Connect with an API token

1. In Beyond Identity:

   1. Sign in to the Beyond Identity Admin Console for your region (console-us.beyondidentity.com or console-eu.beyondidentity.com).
   2. Under Apps, select Beyond Identity Management API.
   3. Select the API Tokens tab and click Create token.
   4. Enter a Name, reduce the Scopes to only the read access Safeguard needs, and click Create token.

   Where to find the other values:

   • Region: The console you sign in to: console-us.beyondidentity.com is US, console-eu.beyondidentity.com is EU.

   Beyond Identity's public documentation does not cover every step.

   The fetched pages do not say how to copy the token, whether it is shown only once, which scope grants read access to identities, or where to find the Tenant ID and Realm Id in the console.

   Source: developer.beyondidentity.com, developer.beyondidentity.com, checked 2026-10-07.

   The permissions Safeguard needs: identities:read.

2. On Compliance › Connectors, open Beyond Identity, click Connect, choose API token and fill in:

   Field	What to enter
   Tenant ID	Required.
   Realm ID	Required.
   Access token	Required. Stored encrypted and never shown again.
   Region	Required.

3. Click Connect with token.

Frameworks

Safeguard's automated tests read Beyond Identity and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

These tests are switched on per workspace by the Safeguard team.

Related

• Identity & SSO connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks