Updated recently
Last updated:
Quick Answer: These SailPoint IIQ interview questions for 2026 are not a vocabulary test. A SailPoint IdentityIQ (IIQ) interview probes whether you understand the identity warehouse, can onboard an application, explain aggregation and correlation, build a safe provisioning plan, and debug a rule or workflow when it fails. The 30 questions below cover what freshers, developers and senior consultants are actually asked, with short answers you can defend in a follow-up.
What Interviewers Actually Test in a SailPoint IIQ Interview
Most Indian IIQ hiring loops have three or four stages: a screening call, a technical round, a scenario or manager round, and sometimes a client round. The technical round is usually run by someone who has been on a failed go-live. That person is less interested in your definition of identity governance than in whether you can keep an aggregation from overwhelming production.
| Role | What the panel digs into | Typical mistake |
|---|---|---|
| IIQ Administrator | Tasks, aggregation, certifications, reports, access requests | Knowing the menus but not the object model |
| IIQ Developer | BeanShell rules, workflows, connectors, provisioning plans | Writing code without null checks or rollback logic |
| Consultant | Requirements, application onboarding, client communication | Jumping to configuration before understanding the source system |
| Lead / Architect | Deployment design, performance, upgrade, security model | Treating IIQ as a standalone tool instead of part of the IAM estate |
SailPoint IIQ Interview Questions for Freshers
1. What is SailPoint IdentityIQ?
IdentityIQ is SailPoint’s on-premises identity governance and administration platform. It aggregates identities and accounts from connected systems, correlates them into a single identity view, and then governs access through roles, policies, certifications, requests and provisioning. It is not an SSO product; it governs who has access to what, and why.
2. Explain the core IIQ architecture.
At a high level: a Java web application running on an application server such as Tomcat, a relational database that stores the identity warehouse and configuration, connectors that talk to target systems, and IQService for Windows-based operations such as Active Directory. Tasks, workflows and rules run inside the application; the database is the system of record for IIQ’s own objects.
3. What is the difference between an identity, an account and a link?
An identity is the governed person or non-human entity in IIQ. An account is the actual account on a target application. A link is the relationship between that identity and that account. One identity can have many links across many applications; the link is where IIQ stores correlation and provisioning state.
4. What is an application in IdentityIQ?
An application is the configuration object that tells IIQ how to connect to a target system, what account and entitlement attributes to collect, how to correlate accounts, and how to provision access. It includes the connector, connection parameters, schemas, correlation logic and provisioning policies.
5. What is aggregation, and how is it different from a refresh?
Aggregation pulls accounts and entitlements from a target system into IIQ. A refresh recomputes identity attributes, roles and policies from data already in the warehouse. Aggregation is about collecting source data; refresh is about recalculating the identity model. Running a refresh will not discover a new account on the target system.
6. What is correlation?
Correlation decides which identity an aggregated account belongs to. IIQ can use built-in matching, a correlation rule, or a combination. Good correlation is the difference between a clean identity warehouse and a queue of orphan accounts. The rule should be deterministic and tested against duplicate names, contractors and shared accounts.
7. What is a provisioning plan?
A provisioning plan is the structured set of account changes IIQ intends to make: create an account, add or remove an entitlement, update an attribute, or disable an account. It is generated from a request, role or policy, then executed by the provisioner. A plan can be previewed and approved before execution, which is why it is central to safe automation.
8. What is the difference between a role and an entitlement?
An entitlement is a specific right on a target system, such as an Active Directory group or a SAP role. A business role is a collection of entitlements and profiles that represents a job function. Users are assigned roles; IIQ translates those roles into the underlying entitlements during provisioning.
9. What is a certification campaign?
A certification is a periodic access review. IIQ generates certification items for managers, application owners or role owners, who approve or revoke access. The campaign records the reviewer, decision, date and comments for audit evidence. A certification is not the same as an access request; it is a control, not a request channel.
10. What is IQService?
IQService is a Windows service that lets IIQ perform operations that require Windows APIs, most commonly Active Directory account creation, group membership changes and password operations. It is not the main IIQ server. If IQService is down, IIQ may still aggregate some data but provisioning to AD will fail.
Intermediate and Developer Questions
11. When would you write a custom connector?
When the target system has no supported connector, or the supported connector cannot expose the specific operations the business needs. Before writing one, check whether a generic connector, web-service connector, SCIM connector or file-based integration can do the job. Custom connectors are expensive to maintain and need a clear owner.
12. What are the main types of BeanShell rules in IIQ?
Common types include identity attribute rules, correlation rules, build-map rules, provisioning policy rules, before/after provisioning rules, workflow rules, custom validation rules and connector rules. Each runs in a different context and has different objects available, so the first question is always: where does this rule execute, and what can it safely change?
13. What is a workflow in IdentityIQ?
A workflow is a state machine that coordinates a business process: joiner onboarding, mover approval, leaver revocation, access request approval, certification remediation or a custom task. It can contain steps, approvals, subprocesses, scripts and provisioning actions. Workflows are not a replacement for a scheduled task; use the right construct.
14. What is a lifecycle event?
A lifecycle event is a trigger that runs logic when an identity is created, changed or deleted, or when an account is created or removed. It is often used for joiner, mover and leaver automation. Keep lifecycle events small and idempotent; a slow event can block the operation that triggered it.
15. What is a task definition?
A task definition is a scheduled or on-demand job in IIQ: aggregation, refresh, certification generation, report, policy scan or custom task. Tasks have owners, schedules, arguments and run history. In production, task concurrency and timing matter as much as the task logic.
16. How does IIQ handle separation of duties?
IIQ models SoD policies as combinations of entitlements or roles that should not coexist. A policy scan detects violations, and the result can block a request, create a remediation task or feed a certification. The hard part is not writing the policy; it is agreeing which combinations are genuinely toxic and keeping the policy data current.
17. What does an identity refresh do?
It recalculates identity attributes, role assignments, policy violations and related state. Refresh options matter: a full refresh is heavier than a targeted refresh, and refreshing roles can trigger provisioning if the configuration allows it. Never run a broad refresh in production without understanding the side effects.
18. How would you troubleshoot a slow aggregation?
Start with the connector and target system, not IIQ. Check how many accounts and entitlements are being read, whether the connector is paging, whether the query is indexed, and whether the task is running during a peak window. Then look at IIQ task logs, database load and rule execution. Throwing more memory at the JVM rarely fixes a bad source query.
19. What is your approach to an IIQ upgrade?
Inventory custom rules, workflows, connectors and integrations first. Read the upgrade notes, test in a copy of production, and run the full joiner/mover/leaver and certification paths, not just a login test. Upgrades fail on custom code and schema changes far more often than on the core product.
20. IdentityIQ vs IdentityNow: which should a company choose?
IdentityIQ is the on-premises option with deep customization and connectors, often chosen by large enterprises with existing infrastructure and complex legacy systems. IdentityNow, now part of Identity Security Cloud, is SaaS and reduces platform maintenance but changes the customization model. The decision is about operating model, data residency, integration complexity and long-term ownership, not which product has a better demo.
Advanced and Scenario Questions
21. You find duplicate accounts for the same person on one application. What do you do?
First determine whether the duplicates are a correlation problem, a source-data problem or a provisioning problem. Check the correlation rule and the authoritative source, then decide whether to merge, disable or leave the accounts. Do not delete accounts to make the report look clean; preserve audit history and document the remediation.
22. An aggregation completes with errors, but the dashboard shows success. How do you investigate?
Open the task result, not just the summary status. Look at the partition results, connector errors, skipped records and the application log. A task can complete with partial results and still report success. Compare the account count with the source system and check whether a specific partition or connector operation failed.
23. Provisioning to Active Directory fails for one user. Walk me through it.
Check the provisioning plan, the IQService health, the service account permissions, the target OU and the account attribute mapping. Then inspect the provisioner log and the IQService log. The most common causes are a missing IQService connection, a permissions issue on the target OU, or a required attribute that the plan did not supply.
24. A manager goes on leave during a certification campaign. What happens?
IIQ supports delegation and reassignment. The clean approach is to configure delegation before the campaign or have the certification administrator reassign the items with an audit comment. Do not let the campaign expire silently; an unreviewed certification is an audit finding, not a neutral outcome.
25. How do you prevent role explosion?
Start with a role taxonomy tied to job families, not individual requests. Use birthright roles for common access, business roles for job functions, and entitlements only where a role would be artificial. Review role membership and unused roles regularly. If every exception becomes a new role, the model has already failed.
26. A joiner starts on Monday, but the HR feed arrives on Tuesday. What do you do?
Make the process tolerant of late data: a pre-hire identity can be created from the HR record with a future start date, and access can be held until the start date. If the feed is late, the workflow should queue or alert rather than create a partial identity. The business needs a defined grace period and an owner for exceptions.
27. How do you prove to an auditor that access was removed?
Show the request or leaver event, the provisioning plan, the execution result, the target-system confirmation and the date. A closed ticket is not enough. For sensitive systems, reconcile the target account state after the change; the audit evidence is the end state, not the intent.
28. A target application has no connector and no API. How do you onboard it?
Consider a file-based or scheduled import for read-only visibility first, then a controlled manual provisioning process with evidence. If write access is required, evaluate a custom connector or an RPA bridge only after a risk review. Do not pretend a spreadsheet import is automated provisioning.
29. What would you check before making a rule change in production?
Who calls the rule, what objects it can modify, whether it is on a hot path, and how to roll it back. Test with representative identities, including nulls and orphans. Capture the before/after behavior, deploy in a window, and monitor task errors and provisioning failures immediately after.
30. Why should we hire you for this IIQ role?
Answer with evidence, not adjectives. Pick one project: what you owned, what was broken, what you changed, and what improved. A concrete story about reducing orphan accounts, fixing a failed provisioning path or making a certification campaign close on time is stronger than claiming to be passionate about identity security.
What a Real IIQ Interview Looks Like
One interview I sat in on started with a simple question: “What happens when a user requests a role?” The candidate recited the Lifecycle Manager screens. The panel then asked what happens if one entitlement in the role is already assigned, and the candidate froze. That is the real test: not whether you know the request page, but whether you understand the provisioning plan, the duplicate-attribute handling and the approval state.
The strongest candidates draw the flow on a whiteboard: request, approval, plan, provisioner, target, reconciliation. They say where it can fail. They admit when they would check the logs rather than guess. That is what a hiring manager trusts at 2 a.m. during a go-live.
How to Prepare Without Memorising 200 Questions
Build one end-to-end story around a fictional application. Onboard it, aggregate it, correlate it, request access, provision it, certify it and revoke it. Then write down every object and log you touched. Most interview questions are a variation on that story. If you cannot explain the story without notes, you are not ready for a developer or consultant round.
For the technical depth behind the answers, read our SailPoint IIQ architecture guide and the beginner tutorial. If salary is your next question, the SailPoint IIQ salary guide for India breaks down the bands by role and experience.
Training Resources
If you want a guided lab environment instead of piecing together screenshots, join SkilBrill’s SailPoint IdentityIQ training. The programme covers application onboarding, aggregation, correlation, provisioning, certifications, BeanShell rules and interview scenarios. For a broader IAM foundation, the IAM training track covers the surrounding concepts.
FAQ
How many rounds are in a SailPoint IIQ interview?
Most Indian hiring processes have three to four rounds: a screening call, a technical interview, a scenario or manager round, and sometimes a client round. Senior roles may add an architecture or design discussion.
Can freshers get a SailPoint IIQ job in 2026?
Yes, but usually through an IAM support, analyst or trainee role first. Employers look for a lab project, SQL basics, Java or scripting exposure, and a clear understanding of identity lifecycle concepts rather than certification alone.
Is SailPoint IIQ certification required for an interview?
It is not a universal requirement, but it helps clear initial filters at some service companies. A hands-on project story and the ability to explain aggregation, correlation and provisioning matter more in the technical round.
What salary should I expect after an IIQ interview?
For 2026 India, fresher and analyst roles typically sit around ₹4–8 LPA, developers with two to four years around ₹8–14 LPA, and senior consultants or leads higher. The exact band depends on city, project type and whether you have implementation experience.
Can I learn SailPoint IIQ without company access?
You can learn the concepts, SQL and Java foundations without access, but real IIQ practice needs a licensed lab or a training environment. Avoid pirated installs; they are unsafe and do not reflect a supported deployment.
