SailPoint IdentityIQ

Quick answer

SailPoint IdentityIQ (IIQ) is SailPoint's self-managed identity governance product: you install and run it on your own servers or a hosting of your choice, and it controls who has access to which applications, why they have it, and whether they should keep it. It pulls accounts from HR systems, Active Directory, databases and business apps into one view of each person (the Identity Cube), automates joiner, mover and leaver changes, runs access reviews, and flags risky combinations of access. In October 2026 SailPoint announced IdentityIQ 9.0, a modernised version for on-premises and hybrid customers, so IIQ is very much alive alongside the cloud product.

Key takeaways

1. SailPoint IdentityIQ at a glance

Short answer: IdentityIQ is an enterprise IGA platform you host yourself, built around the Identity Cube, extended with BeanShell rules, and sold with separately licensed modules.

Use this table as a quick reference before we go deeper.

The table draws on SailPoint's IdentityIQ product page and the IdentityIQ 9.0 announcement (SailPoint, October 2026).

2. What is SailPoint IdentityIQ?

Short answer: IdentityIQ is software that answers three audit questions for a company: who has access to what, how did they get it, and should they still have it.

If you are new to SailPoint the company and its full product family, read our guide on what SailPoint is first. Here we stay on IdentityIQ itself.

SailPoint describes IdentityIQ as enterprise identity governance that secures access at scale across on-premises, cloud, mainframe, database and legacy applications (SailPoint IdentityIQ product page, October 2026). In plain words, a large bank, insurer or manufacturer may run hundreds of applications. Each has its own user list. IIQ connects to them, builds one view per person, and then automates and checks access.

A few terms you will meet in every IIQ project:

"Self-managed" is the key word. SailPoint's own pages position IdentityIQ as the option for on-premises and hybrid deployments, and the cloud-native product as Identity Security Cloud, now delivered as SailPoint Human Fabric (SailPoint, October 2026). With IIQ, your company or its IT partner installs, patches, upgrades and backs up the system. That gives more control and deeper customisation, and it also means more technical work, which is where IIQ developers and engineers come in.

3. IdentityIQ architecture explained

Short answer: IdentityIQ is a Java web application that runs on an application server, stores everything in a relational database, talks to target systems through connectors, and does heavy work through scheduled tasks.

Here is the architecture as a numbered flow. Read it top to bottom as the path data takes through the system.

What about the server stack? SailPoint says IdentityIQ 9.0 brings a rebuilt technical foundation on modern application servers (SailPoint, 6 October 2026). Exact supported Java, application server and database versions for 9.0 change by release, so always check the release notes for your version before you install or upgrade.

4. IdentityIQ modules and features

Short answer: IdentityIQ sits on a shared governance platform and adds four named modules: Compliance Manager for reviews and policies, Lifecycle Manager for requests and JML, Password Manager for self-service passwords, and File Access Manager for unstructured data.

SailPoint names these modules on its IdentityIQ product page (October 2026). Lifecycle Manager is separately licensed, according to SailPoint's IdentityIQ 9.0 documentation (October 2026), so not every customer has every module.

The AI-Driven Identity Security add-on for IdentityIQ is a SaaS data-analysis service, according to SailPoint's IdentityIQ 9.0 documentation (October 2026). That means an IIQ customer can keep the core system on-premises and still use cloud-based recommendations if they choose.

Lifecycle Manager also includes Rapid Setup, which has separate configuration areas for Joiner, Mover and Leaver events, and supports access requests with start and end dates (SailPoint IdentityIQ documentation, October 2026). We use it in the JML example in section 10.

5. Key IdentityIQ objects explained

Short answer: most IIQ work comes down to ten objects: identity, application, account, entitlement, role, policy, certification, workflow, rule and task.

When you read IIQ screens, XML exports or job descriptions, these words come up again and again. Learn them well.

The Identity Cube is the heart of this. SailPoint's documentation calls it a multi-dimensional data model that gives a single logical view of each managed user, holding attributes, entitlements, accounts, policy violations, risk scores, IdentityIQ capabilities and access history (IdentityIQ identity management documentation, October 2026). The same page describes the Identity Warehouse (the list of every identity), Identity Correlation (linking cubes to accounts on other applications) and the Identity Risk Model (how risk is scored).

6. Aggregation and correlation, step by step

Short answer: aggregation reads accounts into IIQ; correlation decides which person each account belongs to. Together they build the Identity Cubes.

Aggregation means reading data from a target system into IdentityIQ. It is done by the Account Aggregation and Account Group Aggregation tasks. When you aggregate an authoritative source such as HR, IIQ creates an Identity Cube for each account on that source (SailPoint IdentityIQ documentation, October 2026).

Correlation means matching aggregated accounts to existing identities. IIQ can correlate by direct attribute mapping, by conditions, or by custom rules. Accounts that do not match stay uncorrelated and can be linked manually, and those manual links survive later aggregations (SailPoint IdentityIQ documentation, October 2026).

Here is how it plays out on a real project:

A common real-world problem: orphan accounts, which are accounts with no matching person. Operations job descriptions we read in October 2026 listed orphan-account clean-up and manual correlation in IIQ as daily work, so expect this in your first IAM role.

For a hands-on version of these steps with a practice application, follow our SailPoint tutorial.

7. Roles in IdentityIQ: business roles vs IT roles

Short answer: IIQ uses roles to group raw entitlements into units people understand; business roles describe job functions and IT roles hold the actual system access.

SailPoint's IdentityIQ documentation (October 2026) says IIQ ships with four role types:

Business roles connect to IT roles through two lists. Required IT roles are given automatically. Permitted IT roles may be requested but are not automatic.

A worked example for an Indian bank's finance team:

When a new clerk joins Finance-AP, IIQ assigns the business role, which brings the required IT roles, which provision the actual groups and roles. Reviewers later certify "Accounts Payable Clerk" instead of ten cryptic group names. That is why role design is such a valued skill.

8. Policies and separation of duties

Short answer: policies tell IIQ which access combinations are not allowed or are risky, and IIQ flags violations during requests, reviews and scans.

Separation of duties (SoD) means no single person should hold enough access to misuse a process alone. The classic case is that the person who creates a vendor payment should not also approve it.

IdentityIQ supports these policy types (SailPoint IdentityIQ documentation, October 2026):

Example: an Entitlement SoD policy says "SAP Vendor Create" and "SAP Payment Approve" must not sit on the same identity. If Priya requests the second while holding the first, IIQ shows the violation to the approver, who can deny it or approve it with a documented reason. Policy violations also appear on the Identity Cube and in certifications.

9. Access certifications: a campaign walkthrough

Short answer: an access certification is a review campaign in which managers or owners approve or revoke each person's access, and IIQ tracks every decision for auditors.

SailPoint's documentation says a certification contains access reviews assigned to reviewers, who can approve, revoke, forward or delegate each item (IdentityIQ certifications documentation, October 2026). The same page lists the certification types: Targeted, Manager, Application Owner, Entitlement Owner, Advanced, Account Group Membership, Account Group Permissions, Role Membership, Role Composition, Identity and Event-Based.

Each certification moves through phases: Staging (optional), Active, Challenge (optional), Revocation and End. Here is a typical quarterly manager review, step by step:

Event-Based certifications run when something changes, for example a mover review that asks the new manager to confirm the person's old access is still needed. Role Composition reviews ask role owners to confirm that each role still contains the right entitlements.

10. Lifecycle events: a joiner, mover, leaver worked example

Short answer: Lifecycle Manager watches HR changes and automatically gives, changes or removes access when people join, move or leave.

Follow one fictional employee through a year at a Hyderabad bank GCC.

Here is the joiner in more detail:

Lifecycle Manager also supports access requests with start and end dates (SailPoint IdentityIQ documentation, October 2026). IdentityIQ 9.0 adds granular time-based access, with start and end times and time zones for roles and entitlements (SailPoint, 6 October 2026). That helps with contractors and temporary project access, which is common in Indian IT services teams.

11. Rules, BeanShell and workflows in IdentityIQ

Short answer: rules are small pieces of BeanShell code that add custom logic at set points in IIQ, and workflows are the step-by-step processes, such as access requests, that call those rules.

BeanShell is a Java-based scripting language. SailPoint's documentation says IIQ rules are written in BeanShell, can use all the Java classes available to IdentityIQ, can be created in the Rule Editor or imported as XML, and that scripts can also be embedded directly inside objects such as policies and workflows (IdentityIQ rules documentation, October 2026). So if you know core Java, you can read most IIQ rules.

Where rules are used:

Rule libraries let you write a method once and reuse it. The simplified example below follows the structure shown in SailPoint's rules documentation: a rule that references a library, then calls a method defined there.

<Rule name="My Calling Rule">
    <ReferencedRules>
        <Reference class='Rule' name='My Library'/>
    </ReferencedRules>
    <Source>
        doSomething();
    </Source>
</Rule>

Here, "My Library" holds the method doSomething(), and any rule that references it can call it. One warning from the documentation: a faulty correlation rule can link accounts to the wrong people or leave them uncorrelated, so test rules on a small data set first.

Workflows in IIQ are business processes made of steps, variables, approvals and transitions. The standard access request flow, for example, collects the request, checks policies, routes approvals to the manager and application owner, provisions on approval and sends notifications. You customise workflows by changing steps, approvals and the rules they call.

12. IdentityIQ versions and deployment in 2026

Short answer: the latest IdentityIQ version is 9.0, announced on 6 October 2026, and the live IIQ help site now shows the 9.0 documentation, with 8.5 and 8.4 still in the version selector.

SailPoint announced IdentityIQ 9.0 at its Navigate event in Austin on 6 October 2026 and called it a "parallel modernization path" for hybrid and on-premises customers (SailPoint, October 2026). The announcement lists:

SailPoint positions 9.0 for customers with data residency, regulatory or heavy customisation needs. This matters for Indian learners: it shows SailPoint is still investing in IIQ, and companies with big IIQ estates will need people to plan and run 9.0 upgrades. SailPoint has not announced an end-of-life date for IdentityIQ.

A typical IIQ deployment has three environments: development, test (or UAT) and production. Developers build rules, roles and workflows in development, export them as XML, test them, and then promote them. Job descriptions we read in October 2026 mentioned CI/CD with GitHub and Jenkins for this.

13. IdentityIQ vs Identity Security Cloud (IIQ vs ISC)

Short answer: IdentityIQ is self-managed and highly customisable with BeanShell; Identity Security Cloud is SailPoint's SaaS product, run by SailPoint, customised mostly through configuration, transforms and APIs.

First, the naming. Identity Security Cloud (ISC, formerly IdentityNow, now sold as SailPoint Human Fabric within SailPoint Identity Security) is the cloud product. Exams, documentation titles and Indian job posts still widely say "Identity Security Cloud" or "ISC" in October 2026, so you will see all three names.

A virtual appliance is a small virtual machine the customer runs inside its network so the cloud tenant can reach on-prem systems such as AD. A transform in ISC is a JSON object that changes attribute values during aggregation or provisioning without code (SailPoint developer documentation, October 2026).

Which should you learn in 2026? The concepts are the same: identities, sources or applications, aggregation, correlation, roles, certifications and lifecycle. Many people learn IIQ first because it exposes how everything works underneath, then add ISC. Job descriptions we read in October 2026 often asked for IIQ and named IdentityNow or ISC as a plus, and some roles were ISC-only. Learning both is the safest plan, in the order shown in our SailPoint roadmap.

14. IdentityIQ use cases by industry

Short answer: IIQ suits large, regulated or heavily customised organisations that need tight control over access and strong audit evidence.

These are typical patterns, not a customer list:

In India, much of this work happens in the global capability centres (GCCs) of banks and insurers, and in the IAM practices of Big Four and IT services firms in Hyderabad, Bengaluru, Pune and Chennai. Those teams implement and run IIQ for clients worldwide.

15. Skills you need to work on IdentityIQ

Short answer: IIQ work needs IAM concepts, core Java and BeanShell, XML, SQL, directory knowledge (AD/LDAP) and comfort with connectors, workflows and troubleshooting.

We read 11 SailPoint and IAM job descriptions from Indian listings on 24 October 2026. Here is what they asked for most often:

Experience: almost every listing we read asked for 3 or more years, and we found no genuine 0-year SailPoint developer listing. Freshers usually start in IAM operations or support roles, such as access management analyst or IGA support, where tasks include access reviews, orphan accounts and ticket handling. From there, they move into IIQ development.

Certification: SailPoint's current credentials include the SailPoint Certified IdentityIQ Engineer (role-based) and the SailPoint Certified IdentityIQ Associate (training-based). The job descriptions we read listed SailPoint certification only as "good to have", never as a must. Results are pass/fail with no published passing score. See our SailPoint certification guide for exam details.

To prepare for interviews on these topics, our SailPoint interview questions page has about 60 questions on IIQ concepts.

16. How Brolly Academy helps

Short answer: Brolly Academy's SailPoint course is IdentityIQ-focused, with an introduction to IdentityNow, and covers the same modules and objects explained in this guide.

Our SailPoint Certification Training in Hyderabad is a 2-month program (course page, October 2026). The 10-module syllabus covers:

You build six capstone projects, including user onboarding, certification campaigns, joiner-mover-leaver provisioning, roles and policies, request workflows and application integration. Modes are classroom, online and hybrid, plus a self-paced video plan. Fees listed on the course page in October 2026: Video Recording ₹9,999, Online ₹24,999 and Classroom ₹29,999, with EMI on the Online and Classroom plans. SailPoint exam fees are separate and paid to SailPoint. The next batch listed starts on Monday, 2 November 2026, and you can attend a free demo class first.

Frequently asked questions