SailPoint Tutorial

Quick answer

To learn SailPoint, first refresh IAM basics, then practise the core IdentityIQ loop in order: onboard an application, aggregate accounts, correlate them to identities, build roles, run an access certification, set up a joiner process and write a small BeanShell rule, before moving on to the Identity Security Cloud track. You need basic Java, SQL, XML and some Active Directory knowledge, and about 30 days of steady practice for the basics.

Key takeaways

1. SailPoint tutorial at a glance

Short answer: This tutorial has three parts: a setup part (prerequisites and practice environment), eight IdentityIQ lessons, and a cloud track, followed by a project and a study plan.

This post is about doing. If you want the theory of the product first, read our guide to SailPoint IdentityIQ, which explains its architecture, modules and versions in depth.

A note on names in October 2026. IdentityIQ is SailPoint's self-managed product (you or your company host it). The SaaS product is Identity Security Cloud (ISC, formerly IdentityNow, now sold as SailPoint Human Fabric within SailPoint Identity Security, announced on 4 August 2026). SailPoint's Getting Started documentation now calls it Human Fabric while still covering IdentityNow features (SailPoint, October 2026), but exams and most Indian job posts still say "ISC", so we use ISC. SailPoint announced IdentityIQ 9.0 on 6 October 2026, and the live IdentityIQ help site now shows the 9.0 documentation.

2. What you will learn and the prerequisites

Short answer: You will learn the everyday tasks of a junior SailPoint engineer, and you should arrive with basic Java, SQL, XML and directory (Active Directory or LDAP) knowledge.

By the end, you should be able to onboard a CSV application, aggregate and correlate accounts, build roles, run a manager certification, explain a joiner process, write a short BeanShell rule and describe the ISC building blocks.

Prerequisites checklist

Two terms to know now. SSO (single sign-on) lets a user log in once and reach many apps. MFA (multi-factor authentication) asks for a second proof, such as a code on your phone. SailPoint is not mainly an SSO or MFA tool; it governs who should have which access.

Weak Java is not a blocker. Developer JDs we read on 24 October 2026 asked for Java and BeanShell, but operations and support roles lean more on Active Directory, ServiceNow and troubleshooting.

3. How to get a legal SailPoint practice environment

Short answer: SailPoint is licensed enterprise software, so practise through official SailPoint training on Identity University, an employer or partner non-production environment, or a reputable training course, and use the free official documentation and Developer Community alongside.

This is the question most tutorials skip. Here are your honest options:

Avoid cracked or "leaked" IdentityIQ builds from file sites or chat groups. They are unlicensed, may carry malware and can hurt your reputation with employers.

Free resources map

Looking for a "SailPoint tutorial PDF"? The official documentation is the most reliable reference, and you can save pages for offline reading. On your own laptop, for free, you can practise Java and BeanShell-style logic, SQL, CSV files for practice applications and JSON transforms.

4. Lesson 1: IAM concepts refresher

Short answer: IAM is about managing identities and their access; SailPoint focuses on IGA, the governance part that decides and proves who should have what access.

NIST describes identity and access management, in enterprise IT, as setting up and maintaining users' roles and access privileges (NIST glossary, October 2026). SailPoint describes IGA (identity governance and administration) as the governance layer: making sure access is appropriate, running access reviews, provisioning and deprovisioning, and audit reporting. PAM (privileged access management) tools control powerful admin accounts and work alongside IGA.

Here is the glossary you need before you touch a screen:

Two principles sit behind every lesson. Least privilege means users get only the access they need for their work, and separation of duty means no single person should hold enough privilege to misuse a system alone, for example the person who approves a payment should not also prepare it (NIST glossary, October 2026).

Practise: list three systems at your college or office, the accounts one person has on each, and the access a new joiner needs on day one. That is your first access model.

5. Lesson 2: IdentityIQ installation overview

Short answer: IdentityIQ is a Java web application that runs on an application server with a relational database; installation means preparing those pieces, deploying IdentityIQ, connecting it to its database and loading its base configuration.

On a first job, the platform team usually installs IdentityIQ. But interviewers ask about it, and the IdentityIQ Engineer exam has an "Installation, Build and Deployment" domain (SailPoint exam prep guide, October 2026). The high-level flow:

Supported versions change by release and patch, so follow the official installation guide for your version, not a blog or video. On Windows the same flow applies, but only with a legally licensed build, usually in a company or training lab. SailPoint says 9.0 adds a rebuilt foundation on modern application servers, time-based access for roles and entitlements, a refreshed UI and an automated upgrade tool (SailPoint, October 2026); the core concepts below stay the same.

6. Lesson 3: Onboarding a delimited-file application

Short answer: A delimited-file application reads accounts from a CSV-style file, which makes it the easiest way to learn application onboarding before you touch live systems.

Onboarding means teaching SailPoint where a system's data is, what an account looks like and which attribute is the unique ID. SailPoint's documentation says the Delimited File connector reads account data from a file, handles multi-valued attributes and supports customised account schemas (SailPoint, October 2026). A direct connector talks to the live system; a delimited file connector reads an exported file.

Create a practice HR file first. Simplified example:

employeeId,firstName,lastName,email,department,title,managerId,status
E1001,Ravi,Kumar,ravi.kumar@shopkart.test,Finance,Accountant,E1000,Active
E1002,Sneha,Reddy,sneha.reddy@shopkart.test,IT,Support Engineer,E1003,Active
E1003,Arjun,Rao,arjun.rao@shopkart.test,IT,IT Manager,E1000,Active
E1000,Meena,Iyer,meena.iyer@shopkart.test,Management,Director,,Active

Onboarding steps in IdentityIQ (screen names vary by version, so check your docs):

Practise: build a second file called "ShopKart AD" with columns such as sAMAccountName, mail, memberOf and employeeId. You will use it to practise correlation next.

7. Lesson 4: Aggregation and correlation

Short answer: Aggregation reads accounts into SailPoint; correlation links each account to the right identity, using attribute mapping, conditions or a rule.

Aggregation step by step

SailPoint's documentation says aggregation reads data from a target system into IdentityIQ through the Account Aggregation and Account Group Aggregation tasks, and aggregating from an authoritative source creates an Identity Cube for each account (SailPoint documentation, October 2026).

Correlation step by step

SailPoint's application concepts page lists three ways to correlate: direct attribute mapping (for example, map an account's "mail" attribute to the identity's email), conditions, and custom BeanShell rules (SailPoint, October 2026).

Identity Refresh

After aggregation, run an Identity Refresh task. It re-checks identities to keep their data current. The Identity Refresh task page lists options such as "Refresh identity attributes", "Refresh manager status", "Refresh assigned and detected roles and promote additional entitlements", "Provision assignments", "Process Events" and "Check active policies" (SailPoint, October 2026). As a beginner, switch on only the options you need and read what each does.

A real JD shows why this lesson matters: a UST "IAM Analyst - SailPoint IIQ" listing in Bengaluru, seen on 24 October 2026, named orphan-account remediation and manual account correlation in IdentityIQ as daily tasks.

8. Lesson 5: Creating roles and entitlements

Short answer: Entitlements are single permissions; roles bundle them so that managers and auditors can understand and assign access by job, using IT roles for technical access and business roles for job functions.

First, make sure entitlements exist. When you aggregate account groups (for AD, the groups in memberOf), SailPoint learns each group as an entitlement. Add a plain-English description to each one, because reviewers will see it during certifications.

IdentityIQ ships with four role types, according to its role management documentation (SailPoint, October 2026):

Steps to create a working role pair:

Then add a policy. IdentityIQ policy types include Role SOD, Entitlement SOD, Effective Entitlement SOD, Activity, Account, Risk and Advanced (SailPoint documentation, October 2026). Create an Entitlement SOD policy blocking FIN-Payments-Prepare plus FIN-Payments-Approve, give one test account both groups, aggregate, run Identity Refresh with "Check active policies" and watch the violation appear.

9. Lesson 6: Running an access certification

Short answer: An access certification sends access reviews to reviewers, who approve, revoke, forward or delegate each item, and SailPoint records every decision as audit evidence.

IdentityIQ supports many certification types, including Manager, Application Owner, Entitlement Owner, Targeted, Role Membership, Role Composition, Identity and Event-Based. A certification moves through phases: Staging (optional), Active, Challenge (optional), Revocation and End (SailPoint documentation, October 2026).

Run your first Manager certification:

10. Lesson 7: Configuring a joiner workflow

Short answer: A joiner process detects a new hire from the HR source and automatically gives them birthright access, using Lifecycle Manager features such as Rapid Setup's Joiner configuration and workflows.

Lifecycle Manager is a separately licensed IdentityIQ module covering access requests, approvals and provisioning, and its Rapid Setup area has Joiner, Mover and Leaver configuration sections (SailPoint documentation, October 2026). A workflow is a set of steps, such as approvals, notifications and provisioning, that runs when something happens.

Joiner flow for ShopKart:

Practise: write the joiner flow for a mover (Kiran moves from Finance to IT) and a leaver (Kiran resigns). What must be added, removed or disabled in each case? This is a classic interview question.

11. Lesson 8: Writing a simple BeanShell rule

Short answer: A rule is a small piece of BeanShell code that adds custom logic at a set point, such as during correlation, aggregation or provisioning; BeanShell is Java-based and can use the Java classes available to IdentityIQ.

SailPoint's documentation says rules are created in the Rule Editor or imported as XML, scripts sit inside objects such as policies and workflows, rule libraries are called by workflow steps, and Javadocs ship with each installation (SailPoint, October 2026).

The example below follows the pattern in SailPoint's correlation rule documentation: read the aggregated account and return a map with identityAttributeName and identityAttributeValue (SailPoint, October 2026). That page covers the cloud version; IdentityIQ correlation rules follow a similar idea, so check your version's docs.

Simplified example (BeanShell correlation rule):

import java.util.HashMap;
import java.util.Map;

Map returnMap = new HashMap();
String username = account.getStringAttribute("username");

if (username != null) {
    String email = username.toLowerCase() + "@shopkart.test";
    returnMap.put("identityAttributeName", "email");
    returnMap.put("identityAttributeValue", email);
}
return returnMap;

The rule reads the account's username, builds an email address from it and tells SailPoint to find the identity whose email matches. The identity attribute you correlate on must be searchable. Practise by attaching a rule like this to your "ShopKart AD" application on the Rules tab, removing the attribute-based correlation, and re-running aggregation.

12. Identity Security Cloud (ISC) track for beginners

Short answer: In ISC you connect sources (on-premises ones through a virtual appliance), make one source authoritative with an identity profile, shape attributes with JSON transforms, bundle access into access profiles and roles, and automate with workflows and APIs.

Learn this track after the IdentityIQ lessons. The ideas carry over; the terms change.

Step 1: Sources

A source is where identity and access data originates. The tenant loads accounts through a direct connection with a connector, or through a flat (CSV) file. Entitlements are aggregated from each source (SailPoint documentation, October 2026). Add your ShopKart HR file as a delimited-file source.

Step 2: Virtual appliance

A virtual appliance (VA) is a small virtual machine you run in your network. It connects the ISC tenant to on-premises sources, such as Active Directory, without opening your firewall. Direct-connect sources need a VA cluster, while SaaS connectors upload data without one (SailPoint documentation, October 2026).

Step 3: Identity profile and transforms

Create an identity profile on the HR source so its accounts become identities, then map identity attributes. A transform is a configurable JSON object that changes an attribute value during aggregation or provisioning without code. Each transform has a name, a type (such as lower, concat or e164phone) and attributes, it is uploaded through the Transform REST APIs and it cannot exceed 400KB, according to SailPoint's transforms documentation (SailPoint, October 2026). You choose a transform when you map an identity attribute in the identity profile's mappings.

Simplified example (lowercase the department from the HR source):

{
  "name": "Lowercase Department",
  "type": "lower",
  "attributes": {
    "input": {
      "type": "accountAttribute",
      "attributes": {
        "attributeName": "department",
        "sourceName": "ShopKart HR"
      }
    }
  }
}

Here, accountAttribute reads the department value from the ShopKart HR source, and lower converts it to lowercase before it is saved on the identity.

Step 4: Access profiles and roles

Entitlements are the most granular access; access profiles bundle entitlements from a single source; roles bundle access profiles and entitlements from various sources. Standard roles assign by criteria, dynamic roles add birthright access by role dimensions, and role changes apply through identity processing (SailPoint documentation, October 2026). Build an access profile "Finance AD Basic" and a role "Finance Accountant" with criteria department equals finance.

Step 5: Workflows

Each ISC workflow has exactly one trigger, such as Identity Created or Account Aggregation Completed, followed by actions such as Send Email, Get Identity or Create Campaign, and operators; Manage Access is the step for creating access requests (SailPoint documentation, October 2026). Build a joiner workflow: trigger Identity Created, then Get Identity, then Send Email to the manager.

Step 6: APIs and SDKs

Much ISC work runs through REST APIs. On the Developer Community you will find API specs, an authentication guide and Postman collections, plus SDKs in Golang, PowerShell, Python, TypeScript and Angular (SailPoint, October 2026). Start by authenticating with Postman, listing identities and uploading your transform with the Transform APIs.

13. Practice project: ShopKart HR to AD

Short answer: Build a small, fictional end-to-end IGA setup in which an HR file drives identities, an AD application holds accounts and groups, and roles, a policy, a certification and a joiner process tie it together.

ShopKart is a fictional e-commerce company in Hyderabad with 50 employees. Your job is to bring its HR and AD under SailPoint governance.

The UST JD mentioned in Lesson 4 also listed removing access of terminated users and entitlement-owner reviews, which this project shows.

14. Common beginner mistakes and how to fix them

Short answer: Most beginner problems come from bad source data, wrong identity or correlation attributes, skipping Identity Refresh, and copying old screens from a different version.

15. 30-day SailPoint study plan

Short answer: Spend the first week on IAM basics and prerequisites, the next two weeks on the IdentityIQ lessons, a few days on ISC, and the last days on the project and revision.

At about 2 hours a day, this gives you working basics, not job-ready depth. Most SailPoint listings we read on 24 October 2026 asked for 3 or more years of experience, and no genuine 0-year SailPoint developer listing was found, so freshers usually enter through IAM operations or support roles and grow into development. For the full multi-month sequence, see our SailPoint roadmap.

16. Where certification fits after this tutorial

Short answer: Once you finish these lessons and an official learning path, the SailPoint Certified IdentityIQ Associate is the natural first credential for IdentityIQ learners, while role-based exams suit people with 1 to 3 years of hands-on work.

SailPoint's program lists seven credentials (SailPoint Community, September 2026). The IdentityIQ Associate exam has up to 43 questions in up to 90 minutes, and its prerequisite is the Identity Security Engineer (IdentityIQ) learning path courses, including IdentityIQ Introduction and IdentityIQ Essentials. Its domains, such as Applications, Identity Modeling, Access Modeling, Governance and Provisioning, map closely to Lessons 3 to 7 here. Training-based exams are free with the matching training path, or cost 2 training units (about $200 USD) when bought standalone. Results are pass/fail with no published passing score.

The role-based SailPoint Certified IdentityIQ Engineer and SailPoint Certified Identity Security Engineer exams recommend 1 to 3 years of hands-on experience, and JDs we read list SailPoint certification as "good to have", never mandatory. See our SailPoint certification guide for every exam, and revise with our SailPoint interview questions when you apply.

17. How Brolly Academy helps

Short answer: Brolly Academy's SailPoint course in Hyderabad follows the same IdentityIQ loop as this tutorial, with trainer-led labs and projects, so you do not have to set up practice access alone.

Brolly's SailPoint Certification Training in Hyderabad is IdentityIQ-focused, with an introduction to IdentityNow (Brolly Academy course page, October 2026). Here is what the page lists:

Frequently asked questions