Updated this quarter
Last updated:
Birthright provisioning is the automation of access assignment based on user attributes like department, job title, and location. Done well, it removes 80% of manual access tickets and ensures every new joiner has the right access on day one. Done poorly, it grants excessive entitlements and creates compliance risk. This guide walks through the steps to set up birthright provisioning correctly in SailPoint IdentityIQ.
What is birthright provisioning?
Birthright provisioning is the automatic assignment of access based on user attributes, with no user action required. A new employee in the Sales department automatically gets Salesforce, the CRM dashboard, and the Sales team SharePoint. The opposite is request-based provisioning, where the user must ask for access.
Step 1: Identify your authoritative source
Connect your HR system (Workday, SuccessFactors, Darwinbox) as the authoritative source. This is the system of record for joiners, movers, and leavers. In IdentityIQ, this is done via the authoritative source connector. Configure daily incremental loads.
Step 2: Build your birthright rule catalog
For each job function, list the entitlements that should be automatically granted. Example: a Sales Associate in Chennai gets Salesforce Standard, Sales SharePoint, and the company phone extension. Codify each as a rule in IdentityIQ Rules (a BeanShell or Java class).
Step 3: Build a workflow
Create a workflow that triggers on joiner lifecycle event. The workflow reads the user’s attributes, evaluates the rule catalog, and creates provisioning plans for the matching entitlements. Use IdentityIQ’s Workflow Composer or XML editor.
Step 4: Connect to downstream applications
For each application, configure a connector (SCIM 2.0, JDBC, LDAP, flat file, web services). Test the connector end-to-end before going to production. Most modern apps (Salesforce, ServiceNow, Workday) support SCIM out of the box.
Step 5: Add safety checks
Before granting any entitlement, run a SoD check. Block the request if it violates a separation-of-duties policy. For privileged entitlements (Global Admin, Production DB write), require explicit approval even if birthright would grant it.
Step 6: Test with shadow mode
Before flipping the switch, run the workflow in "shadow mode" — calculate what access would have been granted but do not actually provision. Compare against your manual baseline. Once you have 95% accuracy over 30 days, go live.
Step 7: Monitor and tune
Once live, monitor the volume of joiner/mover/leaver events daily. Track the number of entitlements granted per user, the rejection rate, and the time to grant. Tune the rule catalog monthly. Re-attest the rule catalog quarterly with the business.
Talk to a Chennai Counsellor
Birthright provisioning is one of the most in-demand skills for IAM engineers in 2026. The SkilBrill SailPoint Training in Chennai covers this end-to-end, with a real capstone that builds a 10,000-employee BFSI joiner-mover-leaver workflow.
Ready to start? Call +91 8610964691, WhatsApp us, or enrol online. Visit us at No 22, 200 Feet Radial Road, Thoraipakkam, Chennai 600097.
