SailPoint Training in Chennai & Certification Course (72 Hours Master Program)

SailPoint IdentityIQ is an on-premises identity governance and administration (IGA) platform. It provides identity management, access certifications, provisioning, password management, and compliance reporting for enterprise environments.

IdentityIQ is the on-premises version with deep customization and full control over the database. IdentityNow is the cloud-native SaaS version with faster deployment, modern UI, and reduced operational overhead. Most new customers choose IdentityNow.

The Identity Cube is the central data structure that represents a user’s identity. It contains identity, entitlements, roles, capabilities, and risk scores. Workflows, certifications, and provisioning all operate against the Identity Cube.

Birthright provisioning automatically grants access based on attributes (e.g. department, job title) without any user action. Request-based provisioning requires the user to request access through a workflow with approvals. Birthright reduces admin overhead; request-based is for sensitive entitlements.

Role mining is the process of analyzing existing user-entitlement assignments to discover natural clusters that can be modeled as roles. It reduces entitlement sprawl and simplifies access reviews. IdentityIQ ships with a role mining tool that uses optimization algorithms.

An access certification (or attestation) is a periodic review where managers or application owners confirm that the entitlements of their direct reports or their application users are still required. SailPoint automates the campaign lifecycle, sends notifications, and revokes rejected entitlements.

SoD is the principle that no single individual should have conflicting entitlements that together enable fraud (e.g. creating a vendor and approving a payment to the same vendor). IdentityIQ detects SoD violations both at request time and during access reviews.

A workflow is a sequence of steps (approvals, provisioning actions, notifications) that runs in response to a lifecycle event. Workflows are written in XML and can include escalation, delegation, and integration with external systems via SCIM, JDBC, or web services.

Use the authoritative source connector to pull user records from the HR system (Workday, SuccessFactors, Darwinbox). Map attributes (employee ID, department, manager, hire/termination dates) to Identity Cube attributes. Schedule daily incremental loads.

Risk scores quantify the risk associated with an identity, entitlement, or role based on configurable factors (SoD violations, dormant accounts, privileged access, toxic combinations). IdentityIQ uses them to prioritize reviews and alerts.

A service account is a non-human identity used by an application or script. In IdentityIQ, service accounts are typically modeled as separate identities, marked with a flag, excluded from typical user certifications, and reviewed quarterly by the application owner.

An entitlement is a single permission on a single application. A role is a bundle of entitlements that can be assigned to users as a unit. Roles make access management scalable; entitlements give fine-grained control.

JML is automated through lifecycle events. Joiner: trigger provisioning when a new employee appears in the HR feed. Mover: detect attribute changes (department, manager) and adjust entitlements. Leaver: trigger de-provisioning immediately on termination date, revoke all access within minutes.

A compliance dashboard is a real-time view of identity governance metrics: certification completion, SoD violations, orphan accounts, risk posture, and provisioning latency. It is used by auditors and IAM managers to track governance maturity.

A refresh task is a scheduled or manual operation that re-aggregates identity data from source applications, recomputes the Identity Cube, and re-evaluates rules. It is typically run daily or after major provisioning changes.

Workflows in IdentityIQ are defined in XML inside the workflow definition. Each workflow contains a sequence of steps (Approval, Provision, Notify, Escalate, Script). You can also embed BeanShell or Java for custom logic.

Delegation allows a manager to temporarily assign their approval responsibilities to another user for a defined period (vacation, leave). Delegated items appear in the delegate’s inbox and are tracked for audit.

IdentityIQ flags accounts with no manager, no department, or no login for 90+ days. The recommended workflow is to disable the account, send a notification to the last-known manager, archive after 30 days, and delete after 90 days.

IdentityNow uses virtual appliances (VAs) deployed in the customer’s environment to connect to on-prem applications. The VAs pull data and forward it to the SailPoint cloud, where governance policies and the UI live.

IdentityAI applies machine learning to access decisions: it recommends roles based on peer-group analysis, predicts risky access, and prioritizes access-review items. It is available in IdentityIQ 8.x and IdentityNow as an add-on.

Migrations are typically done in phases: parallel run with identity sync, move sources and connectors, migrate roles and certifications, reconfigure workflows in the new format, switch off IQA. SailPoint Professional Services or partners like SkilBrill run the migration.

An access profile is a named collection of entitlements on a single application, often scoped to a specific business context. Access profiles are building blocks for roles and reduce entitlement sprawl.

Top use cases: automated joiner-mover-leaver, quarterly access certifications, SoD enforcement, role engineering, audit and compliance (SOX, GDPR), privileged access governance, and cloud application onboarding.

A quicklink is a saved filter on a SailPoint dashboard. It lets users jump to a specific subset of identities, certifications, or reports without rebuilding the filter every time.

A policy is a rule that detects violations, such as SoD, toxic combinations, or orphaned accounts. Policies are evaluated on a schedule or in real time, and violations trigger alerts, certifications, or auto-remediation.