SailPoint IIQ Tutorial 2026: Beginner to First App

Quick Answer: This SailPoint IIQ tutorial for 2026 starts with a licensed lab and the object model, then walks you through one simple application end to end: connection, aggregation, correlation, provisioning and a small certification. Do not begin with BeanShell rules or custom connectors. The platform makes more sense after you have watched one identity move through the lifecycle.

SailPoint IIQ Tutorial: What You Need Before You Start

IdentityIQ is commercial software. There is no safe “download and install” path for a beginner, and pirated builds are a bad idea. Use a training provider’s lab, an employer’s sandbox, or a licensed evaluation environment. You need a supported IIQ version, a database, a Java application server, and for Active Directory work, IQService on a Windows host.

The Object Model in Plain English

Before the UI, learn six objects. Most beginner confusion comes from mixing them up.

• Identity: the person or non-human entity being governed.
• Application: the target system configuration, including connector and schemas.
• Account: the actual account on that target system.
• Link: the relationship between an identity and an account.
• Entitlement: a specific right, group or role on the target system.
• Role: a business-level bundle of access that can be assigned and provisioned.

When something goes wrong, ask which object is wrong. An orphan account is a correlation problem. A missing entitlement is often a role or provisioning-policy problem. A stale identity attribute is a refresh or authoritative-source problem.

Step 1: Learn the Two Consoles

The administrator console is where you configure applications, tasks, rules and workflows. Lifecycle Manager is where users and managers request access, track approvals and complete certifications. Beginners often learn only the admin console and then cannot explain the user experience. Spend an hour in each.

Log in with a test administrator account, open the application list, and identify the connector types. Do not change anything yet. Draw the object relationships on paper. If you cannot explain the difference between an application and an account, stop and fix that before moving on.

Step 2: Onboard One Simple Application

Pick a low-risk target: a flat-file application, a JDBC table or a test LDAP directory. Avoid Active Directory for your first onboarding; IQService adds a second system and more failure modes.

1. Create the application and choose the connector.
2. Set the connection parameters and test the connection.
3. Define the account schema and entitlement schema.
4. Configure the aggregation task.
5. Run the aggregation and inspect the accounts.
6. Create a correlation rule or use a simple matching attribute.
7. Run the identity refresh and check the links.

At the end, you should have one application, a set of accounts, and identities linked to those accounts. If you have orphan accounts, fix correlation before adding provisioning. A clean read path is the foundation for a safe write path.

Step 3: Aggregate, Then Correlate

Aggregation pulls data in. Correlation decides who owns it. A simple correlation rule might match on employee ID, then fall back to email, then leave the account orphaned for review. Do not match on display name alone; shared names and contractors will break it.

// Simplified correlation rule shape.
// Use the actual IIQ rule context and return an Identity or null.
import sailpoint.object.Identity;

String empId = account.getStringAttribute("employeeId");
if (empId != null) {
    return context.getObject(Identity.class, "employeeId", empId);
}
return null;

The exact API and variables depend on the rule type. The point is the decision order: deterministic identifier first, fallback second, manual review last. Log the fallback path so you can see how many accounts rely on it.

Step 4: Provision Access Safely

Provisioning is where a learning mistake becomes a production incident. Start with a provisioning policy that adds a single entitlement, request it through Lifecycle Manager, and inspect the plan before execution. Confirm the account attribute mapping and the approval path.

Ask three questions before every provisioning test: What will be created? What will be changed? How will I reverse it? If you cannot answer the third, you are not ready to run it against a shared system.

Step 5: Run a Small Certification

Create a certification definition for your test application, generate a campaign with a handful of identities, and complete the review as a manager. Then look at the audit record. You should be able to show who reviewed what, when, and what was revoked. This is the part that turns IIQ from a scripting exercise into a governance tool.

A Safe Eight-Week Lab Plan

Common Beginner Mistakes

The most common is starting with code. A developer who can write a BeanShell rule but cannot explain why an account is orphaned will struggle in a real project. The second is testing against a shared sandbox without a rollback plan. The third is treating a successful aggregation as proof that correlation is correct; it only proves the connector can read.

One trainee I worked with spent three days writing a custom connector for a system that already had a supported JDBC path. The connector worked, but the project did not need it. Learn the supported path first. Custom code is a last resort, not a badge of honour.

What a Real First Week Looks Like

In a real project, your first week is rarely a greenfield build. You inherit an application that has been live for years, a pile of correlation exceptions, and a business owner who wants reports yesterday. The senior developer asks you to run an aggregation and compare the account count with yesterday’s run. That is the job: establish a baseline before changing anything.

You discover that the count dropped by 40. The task says “success”. The application owner says nothing changed. You check the connector log and find that one partition timed out; the task completed with partial results. This is why “success” in the task list is not the same as a complete aggregation. The fix is not a code change; it is a retry, a longer timeout and a conversation with the source-system owner about the maintenance window.

That story is more useful in an interview than a perfect lab run. It shows you understand partial failure, evidence and ownership.

How to Read the Logs Without Guessing

IIQ logs are verbose. Start with the task result, then the application log, then the server log. The task result tells you which phase failed; the application log usually carries the connector exception; the server log tells you whether the JVM, database or a rule was involved. If IQService is in the path, check its log too.

# Typical places to look (paths vary by deployment)
$IIQ_HOME/logs/iiq.log
$IIQ_HOME/logs/task/<task-name>.log
$IIQ_HOME/logs/application/<application-name>.log
C:\IQService\logs\IQService.log

Do not tail a production log while a full aggregation is running and then assume the last line is the cause. Find the task’s start time, isolate that window, and search for the application name and the exception class. A log line that says “account skipped” is a symptom; the reason is usually a few lines above or in the connector-specific log.

First Aggregation Troubleshooting Checklist

Write down the baseline count, the run window and the source query before you change the configuration. Without a baseline, you cannot prove that your fix helped.

What to Learn After the First Application

Once one application works end to end, add a second one with a different connector type. The second application teaches you that IIQ is a framework, not a recipe: the object model stays the same, but the connection, schema and correlation details change. After that, learn roles and certifications before custom connectors. A developer who understands the governance model writes safer code than one who treats IIQ as a Java side project.

Keep a project notebook. For each application, record the source system owner, the account schema, the correlation key, the provisioning policy, the approval path and the rollback step. That notebook becomes your interview story and, later, your handover document.

Training Resources

If you want a lab that is already configured, SkilBrill’s SailPoint IdentityIQ training walks through application onboarding, aggregation, correlation, provisioning and certification. For the surrounding identity concepts, the IAM training track fills in the gaps.

Read next: IIQ architecture explained, interview questions, and the certification guide.

FAQ

Can I install SailPoint IdentityIQ for free?

IdentityIQ is commercial software. Use a licensed training lab, employer sandbox or approved evaluation environment. Avoid pirated installers; they are unsafe and do not represent a supported deployment.

How long does it take to learn SailPoint IIQ?

With a structured lab, you can understand the core lifecycle in six to eight weeks. Becoming independent on real application onboarding and troubleshooting usually takes several months of project exposure.

Should I learn Java before SailPoint IIQ?

Basic Java and SQL make BeanShell rules and troubleshooting much easier. You do not need to be a Java developer, but you should understand objects, methods, loops, exceptions and database queries.

What is the first application I should onboard?

Use a flat-file, JDBC or test LDAP application. Active Directory is a poor first choice because IQService and Windows permissions add failure modes before you understand the core object model.

Do I need certification to learn IIQ?

No. Certification is useful for resume screening, but a lab project and the ability to explain the lifecycle matter more. Learn the platform first, then decide whether the exam is worth the fee.

Written by SkilBrill Training Institute

October 25, 2026 · 9 min read