Updated recently
Last updated:
Quick Answer: this SailPoint IIQ glossary explains the 40 terms that matter in 2026 interviews and day-one project work — what each object is, what it does, and the one distinction people usually get wrong. Definitions are deliberately plain-English: exact enough to defend in an interview, short enough to actually read before one.
The Ten Terms Interviews Probe First
Short on time? These ten carry most definition-round traffic, each with the confusion interviewers test:
| Term | One-line version | Common confusion |
|---|---|---|
| Identity vs account | Governed person vs actual login | One identity, many accounts — links connect them |
| Aggregation vs refresh | Read from targets vs recalculate from warehouse | Refresh never discovers new accounts |
| Correlation | Deciding which identity owns an account | Not provisioning — matching, not writing |
| Entitlement vs role | Target-native right vs IIQ-native bundle | Roles are assigned; entitlements get executed |
| Plan vs transaction | Instruction set vs execution record | Plan is intent; transaction is what happened |
| IQService | Windows agent for AD operations | Only needed for AD-style operations, not all targets |
| Lifecycle event | Trigger on identity change | The event fires the workflow; it is not the workflow |
| Birthright provisioning | Automatic starter-pack access | Driven by roles plus events, not one magic rule |
| SoD | Policy forbidding toxic combinations | Prevents at request time; detects at scan time |
| Certification | Human access review with evidence | A control, not a report |
Core Objects and Architecture
- IdentityIQ (IIQ): SailPoint’s on-premises identity governance platform — aggregates accounts, correlates them to identities, and governs access via roles, policies, certifications and requests.
- Identity: the governed person (or non-human entity) in IIQ — the single view assembled from linked accounts and HR attributes.
- Account: an actual account on a target system, discovered by aggregation or created by provisioning.
- Link: the relationship object joining an identity to an account; where correlation and provisioning state live. Common confusion: link ≠ the account itself.
- Application: the configuration object describing a target connection: connector, schemas, correlation, provisioning policies.
- Identity warehouse: IIQ’s database store of identities, accounts, entitlements and history — the system of record for governance decisions.
- IQService: the Windows-side agent that performs operations requiring Windows APIs, mainly Active Directory provisioning and passwords. Common confusion: it is not the IIQ server itself.
- Task: a scheduled or ad-hoc job — aggregation, refresh, certification generation, reports.
- SailPoint Connectors: integration components for target systems (AD, LDAP, JDBC, web services); see the connectors guide.
- Authoritative source: the system (usually HR, e.g. Workday) whose records create identities.
Data Movement and Matching
- Aggregation: reading accounts and entitlements from a target into IIQ.
- Delta aggregation: processing only changes since the previous run, where the connector supports it.
- Refresh: recalculating identity attributes, roles and policies from warehouse data — no target reads. Common confusion: refresh never discovers new accounts.
- Correlation: deciding which identity an account belongs to — built-in matching or a rule; see the correlation rules guide.
- Orphan account: an account no identity claims — quarantined, not guessed.
- Build map rule: BeanShell that transforms source data as it is read into IIQ.
- Identity attribute: a named value on the identity assembled from mapped sources (department, manager, employee ID).
- Entitlement: a specific grantable right on a target — a group, role, or profile. Common confusion: entitlements are target-native; roles are IIQ-native.
Governance: Roles, Policies, Certifications
- Business role: an IIQ object bundling entitlements to represent a job function.
- IT role / Detached role: roles bound to application-level entitlement structures.
- Role mining: building roles from observed access patterns instead of designing them top-down.
- Birthright provisioning: automatic baseline access assigned by identity attributes (a “joiner’s starter pack”).
- SoD (Segregation of Duties): policies forbidding toxic entitlement combinations on one person; see the policy model guide.
- Policy: an IIQ rule set evaluated at request/refresh/scan time to detect or block violations.
- Mitigating control: a documented, owned, expiring exception to a policy violation.
- Certification campaign: a periodic access review where reviewers certify or revoke access; see the campaign guide.
- Certification item: the unit a reviewer decides on — an identity’s entitlement, a role, or an account.
- Remediation: the post-review phase executing revocations.
- JML (Joiner–Mover–Leaver): the lifecycle processes for hires, transfers and exits, driven by lifecycle events.
- Lifecycle event: a trigger on identity creation/change/deletion that runs handler logic or workflows.
Requests and Automation
- Identity request: the tracking object for an access change from submission to delivery; see the request lifecycle.
- Quicklink: a configured action button in the IIQ UI (request access, view my access, approve).
- Provisioning plan: the structured instruction set of account operations IIQ intends to execute.
- Provisioning transaction: the execution record grouping plan items with their results.
- Provisioning policy: per-application rules translating “what was approved” into “what gets written”.
- Workflow: IIQ’s state machine for processes — approvals, JML flows, remediation; see the workflow examples.
- Rule: a BeanShell extension point — correlation, build map, provisioning, policy logic; see the rule examples.
- REST API: IIQ’s HTTPS interface for identities, requests, workflows and certifications; see the REST API guide.
- Approval assignment: the configuration deciding who approves what — the most common source of “stuck” requests.
- Identity request scopes: limits on what a requester may ask for.
Using This Glossary Well
Three ways to make these definitions stick: pair each object with its failure mode (what does a broken correlation look like?); use them against the mock test and the interview question bank; and graduate from definitions to sequences — the IIQ roadmap is the bridge from vocabulary to working knowledge.
- For interviews: the table above answers the “define X” openers — then volunteer the common confusion unprompted and watch the panel relax.
- For projects: map each term to where it breaks (correlation to orphans, approvals to stuck requests) and you have a debugging index for your first month.
- For certification: exam questions trade in exactly these distinctions; the confusions column is your revision shortlist.
Training Resources
Vocabulary is week one of the SailPoint IdentityIQ Certification Training — the programme builds from these terms to lab competence, with the IAM training track covering the wider identity domain.
FAQ
What is the difference between an identity and an account in IIQ?
An identity is the governed person assembled in IIQ; an account is an actual login on a target system. Links connect them — one identity, many accounts, each link carrying its own state, which is why “delete the account” and “delete the person” are dangerously different sentences.
What is the difference between aggregation and refresh?
Aggregation reads from targets; refresh recalculates from warehouse data. Refresh will never discover a new account — if a joiner has not appeared, check the aggregation, not the refresh — the most practically useful sentence in this glossary.
What is IQService and why does it matter?
The Windows agent that lets IIQ perform AD operations like account creation and password changes. If AD provisioning fails while other targets work, IQService is the first suspect — the second is its version falling behind the IIQ patch level.
What is birthright provisioning in SailPoint?
Automatic baseline access granted by identity attributes at hire — email, base directory groups, standard app accounts. It is the “day-one starter pack” pattern, usually driven by roles plus lifecycle events, which is why role changes and hires behave differently.
What is the difference between a role and an entitlement?
An entitlement is a target-native right (an AD group, an app profile); a role is an IIQ-native bundle of entitlements representing a job function. Roles are assigned; IIQ translates them into entitlements via provisioning — which is why role-design sessions without entitlement mapping end in theory.
