Updated recently
Last updated:
Quick Answer: the SailPoint ServiceNow integration pattern pairs IIQ with two neighbours: Workday is the authoritative HR source that drives joiner/mover/leaver events into IIQ, while ServiceNow is the request-and-ticketing layer that either raises access requests into IIQ or receives IIQ’s provisioning tasks as actionable tickets. Both integrations are API-driven, both fail on data quality more than on code, and both are among the most-asked-about combos in IIQ interviews for experienced roles.
Workday to IIQ: The Identity Pipeline
Workday owns worker truth: who is hired, moved, terminated. The integration pattern:
- Extract: IIQ pulls worker data from Workday’s RaaS/XML endpoints on a schedule (or receives a feed).
- Transform: the build-map layer normalises Workday’s data shape — worker IDs, statuses, manager references — into identity attributes.
- Correlate: worker records link to identities (authoritative source — unmatched workers create identities).
- React: refresh detects status/attribute changes; lifecycle events fire the JML workflows that provision or revoke across the estate.
| Workday concept | IIQ counterpart | Field trap |
|---|---|---|
| Worker (employee/contingent) | Identity | Contingent workers often lack employee IDs — correlation keys need a plan |
| Position / job change | Identity attributes → role recalculation | Effective-dated changes arrive before they are true; mind the dates |
| Termination | Leaver lifecycle event | “Last day worked” vs “termination date” semantics decide 8 a.m. outages |
| Manager reference | Manager identity link | Manager lookups fail mid-reorg; guard the null |
ServiceNow and IIQ: Two Directions, Choose Deliberately
ServiceNow integration runs in two patterns, and picking the wrong one is the most common design mistake:
| Pattern | Flow | Use when |
|---|---|---|
| ServiceNow as request portal | ServiceNow catalog item calls IIQ’s REST API to submit an identity request; IIQ runs approvals and provisioning; status syncs back to the ticket | You want one front door for users; IIQ stays the governance brain |
| IIQ tasks as ServiceNow tickets | IIQ provisioning steps that need human hands (or non-connected targets) generate ServiceNow tasks; fulfilment teams action them; completion syncs back | Targets without connectors, manual fulfilment teams, or ITSM-driven audit trails |
Most mature estates run both patterns side by side — portal for self-service, tickets for manual fulfilment. The mechanics of the REST calls live in the IIQ REST API guide.
The Integration Triangle: Who Owns Which Truth
Three systems, three tempting places to store the same fact. Assign ownership explicitly: Workday owns who the person is (identity, org, status); IIQ owns what access they have and why (roles, entitlements, approvals, evidence); ServiceNow owns the work record (tickets, fulfilment state, SLAs). When a fourth system starts writing access decisions directly to targets, bypassing IIQ, you have a shadow-IT governance hole that audits find — flag it early.
A Failure You Will Eventually Meet
A services client’s ServiceNow catalog submitted access requests straight into IIQ — clean design. Then a portal update silently changed the requested-item payload field names. Requests arrived empty; IIQ created identity requests with no items; approvals routed fine; provisioning had nothing to do; tickets closed “successful”. Nobody noticed for eleven days because every layer reported green. Fixes that mattered: payload validation at IIQ’s custom endpoint, a reconciliation report comparing ServiceNow requests to IIQ items daily, and an alert on zero-item requests. Integration health is a monitoring design problem, not a coding one.
Interview Angle: What Panels Actually Ask
- “Walk me through a Workday hire reaching an AD account” — expect the full pipeline and its failure points (answer arc: the four steps above).
- “Why submit requests via ServiceNow instead of IIQ’s own console?” — user experience plus ITSM audit trails; governance still lives in IIQ.
- “What breaks first when the HR feed changes?” — data shape assumptions: attributes renamed, contingent workers, effective dates.
The deeper answer to all three is the same: know which system owns which truth, and where the handoffs are monitored.
Contractors and Non-Human Identities
The triangle diagram in vendor decks assumes employees. Real Indian enterprise stacks also carry contractors, vendor admin accounts and service accounts, and each breaks one assumption in the pattern. Contingent workers in Workday arrive with different data shapes (no employee-ID sequences, agency-owned managers), which is why correlation keys for the Workday integration need a contractor strategy from day one — the correlation rules guide covers the guarded-fallback pattern. Service accounts usually should not flow from HR at all: they belong in a separate governance lane (imported directly, certified on their own campaign rhythm), because HR-driven JML logic fired at a service account is a classic outage story. And vendor staff with unmanaged privileged access are exactly what auditors probe — if your ServiceNow flow can raise access for identities that neither IIQ’s governance model nor the HR feed owns, you have built a compliance hole with a service catalogue on top. Decide the ownership question in design, not in the audit finding.
Testing the Triangle Before Go-Live
Integration testing for this pair needs more than happy paths. The minimum scenario pack: joiner with complete data (provisions end to end); joiner with missing manager (should quarantine, not orphan); mover across cost centres (access deltas, not re-creation); leaver with open tickets (ServiceNow items should close or re-route, not hang); rehire (the classic — old links reactivate correctly); and effective-dated hire (Workday says starts Monday, account exists Sunday — correct or not, decide deliberately). Run the pack against production-shaped volumes, because an integration that aggregates 2,000 workers in test and 200,000 in production meets very different timeout behaviour. Then wire the reconciliation reports into actual monitoring — the number of programmes that “completed” with silent deltas and discovered it at the first audit is a genre. The two-week buffer most projects reserve for this testing is not padding; it is the cheapest insurance in the integration budget.
Training Resources
The SailPoint IdentityIQ Certification Training includes both integration patterns as labs — a Workday-shaped HR feed driving JML, and a ServiceNow-shaped ticket flow. Context: the connectors guide, the architecture guide, and the IIQ roadmap. If you are evaluating the ServiceNow platform itself for a career, see the ServiceNow training track; for the wider identity domain, the IAM training track.
FAQ
How does SailPoint integrate with Workday?
As the authoritative HR source: IIQ pulls worker data via Workday’s API endpoints, correlates workers to identities, and lifecycle events react to hires, moves and terminations to drive provisioning. Workday owns person-data truth; IIQ owns access truth — writing that division into runbooks prevents most ownership arguments before they start.
Can ServiceNow submit access requests into SailPoint?
Yes — the common pattern calls IIQ’s REST API from a ServiceNow catalog flow, and the request runs IIQ’s standard approval and provisioning lifecycle, with status updates synchronised back to the ticket.
What is the biggest failure point in these integrations?
Data semantics: effective dates, contingent-worker keys, renamed payload fields, manager nulls. The code rarely fails; the assumptions do. Monitor handoffs (reconciliation reports) rather than trusting each system’s own green status — a reconciliation delta report is the true health check of this triangle.
Do we still need IIQ if ServiceNow can manage access?
Different jobs: ServiceNow tickets work, IIQ governs access — policy checks, SoD, certifications, role models across the whole estate. Ticket-driven provisioning without a governance layer is how unreviewable access accumulates.
Is Workday integration different from other HR feeds?
Mechanically similar (API pull, transform, correlate, react) but Workday’s effective-dated model and contingent-worker handling add real design decisions. Treat it as an HR-feed pattern you adapt, not a magic connector, and budget extra testing for the effective-dated model specifically.
