SailPoint IdentityIQ Tutorial: Your First 10 Concepts, Explained Simply

Search "SailPoint IdentityIQ tutorial" and you will mostly find product brochures — feature lists, benefit bullets, an architecture diagram, a call-to-action. Some of the highest-ranking ones are actively wrong: one popular page lists SailPoint's role types as "Management Role" and "Accounting Role", which are not IdentityIQ role types at all. IdentityIQ uses business roles and IT roles. If your first exposure to the platform teaches you the wrong vocabulary, every screen afterwards looks confusing for reasons you cannot name.

This tutorial explains each concept in plain English, gives a real enterprise example, and tells you exactly which module of the 14-module IIQ curriculum covers it in depth — so you always know where a concept sits in the bigger picture.

Where should a SailPoint IdentityIQ tutorial actually start?

It should start with vocabulary, not installation. Almost every beginner who gets stuck in IdentityIQ is stuck on a word, not a button. A "correlation failure" reads like a bug until you know that correlation is the logic matching an aggregated account to an existing identity — then it reads like a data problem you can fix.

IdentityIQ is an identity governance platform: it answers who has access to what, whether they should, and who approved it. Underneath the interface sits a small object model. Ten nouns describe almost all of it. Learn the nouns and the verbs — aggregate, correlate, provision, certify — start making sense on their own.

1. What is an identity and an Identity Cube in SailPoint?

An identity is one real person; the Identity Cube is IdentityIQ's single correlated record of everything that person has. SailPoint's documentation describes cubes as multi-dimensional data models of identity information that give one logical representation of each managed user, combining accounts, entitlements, activity and business context.

Picture Priya, an analyst at a Hyderabad bank. She has a Workday record, an Active Directory account, two AD groups, a SAP account and a database login. Five systems, one human being. The Identity Cube is the object that says: these five things are all Priya. Everything else in IIQ — roles, policies, certifications, provisioning — operates on that cube rather than on scattered accounts. Read our deeper explainer on the Identity Cube concept once the rest of this tutorial has settled.

2. What is the difference between an authoritative source and a target application?

An authoritative source decides who exists; a target application only holds what they can do. Aggregating an authoritative application creates and updates Identity Cubes. Aggregating a non-authoritative one produces accounts that must be correlated to cubes that already exist.

In almost every Indian enterprise the authoritative source is HR — Workday, SuccessFactors or SAP HR. Active Directory, LDAP, databases and business applications are target (non-authoritative) applications. This single distinction explains a behaviour that confuses every beginner: aggregate AD before HR and IIQ creates orphan-looking accounts with nobody to attach them to. The full mechanics live in Module 3, Application Onboarding — see our guide to SailPoint IIQ application onboarding.

3. What is aggregation in SailPoint IdentityIQ?

Aggregation is the process by which account and entitlement data is read from your enterprise systems into IdentityIQ. It is inbound only. An account aggregation task connects to an application through its connector, pulls the accounts and their attributes, and stores what it finds.

Think of it as IIQ taking attendance across every system it is connected to. Nothing is changed on the target system during aggregation — this is the read half of governance. Aggregation runs as a scheduled task, and in a large bank it may run nightly against forty applications. It belongs to Module 4, SailPoint Jobs, alongside the refresh and system tasks explained in our aggregation and refresh jobs guide.

4. What is correlation, and how is it different from aggregation?

Aggregation imports accounts; correlation decides which person each account belongs to. Correlation runs during aggregation and uses matching logic — typically employee ID, sometimes email or a custom rule — to attach an incoming account to the right Identity Cube.

Correlation is where real projects get messy, and it is the most common beginner question on the SailPoint Developer Community. If HR stores employee ID as E00451 and Active Directory stores it as 451, correlation fails and the account becomes uncorrelated. Nothing is broken in the software; the data simply does not match. Learning to read that failure — and to write the correlation logic that fixes it — is the moment most learners stop feeling like tourists in IIQ.

5. What is an entitlement in SailPoint IdentityIQ?

An entitlement is a single unit of access on one system — one Active Directory group, one SAP transaction code, one database privilege. Entitlements typically take the form of an account on an application or membership in a group, and they control what a user can do inside that application.

When an application's account schema marks an attribute as managed, IdentityIQ promotes the values it discovers during aggregation into the Entitlement Catalog — a central list of every entitlement across every onboarded application, where business-friendly descriptions and owners are attached. That catalogue is what turns CN=FIN-SAP-POST into "Post journal entries in SAP Finance", which is the difference between a certification campaign a manager can complete and one they rubber-stamp.

6. What is a role in SailPoint, and how do business and IT roles differ?

A role is a named bundle of entitlements. IdentityIQ uses two types: an IT role groups technical entitlements on a system, and a business role represents a job function and inherits the IT roles it needs. Entitlements say what access exists; roles say why a person should have it.

Example: the business role "Retail Branch Teller" inherits three IT roles — "AD Branch Users", "Core Banking Teller Profile" and "Cheque Imaging Read". A new teller gets one role assignment instead of eleven separate access requests. That is role-based access control (RBAC) in one sentence, and it is why roles are the heart of Module 7. Our role management and RBAC guide covers role modelling in detail.

7. What is provisioning in SailPoint IdentityIQ?

Provisioning is the outbound direction: IdentityIQ pushing an access change into a target system. Where aggregation reads data in, provisioning sends create, modify, enable or disable instructions out through the same connector.

Provisioning is triggered by an approved access request, a revocation decision in a certification campaign, a role assignment, or a lifecycle event. It can be fully automated — the connector performs the change directly — or manual, where IIQ raises a work item for an administrator and tracks it to closure. Both count as governed provisioning, because both leave an audit trail. Auditors do not ask whether the change was automatic; they ask who approved it and when.

8. What are lifecycle events (joiner, mover, leaver, rehire)?

Lifecycle events are configured triggers that fire provisioning automatically when a person's HR data changes. The four standard events are joiner (new hire), mover (transfer or promotion), leaver (exit) and rehire (returning employee).

A leaver event is the one every auditor tests. HR marks the employee terminated, the next aggregation brings that change in, the Identity Cube updates, the leaver event fires, and accounts are disabled across every connected system within hours instead of the weeks a manual email chain takes. This is Module 12, and it is the single most quoted capability in SailPoint job interviews — covered fully in our lifecycle events explainer.

9. What is access certification in SailPoint IdentityIQ?

Access certification is a campaign that asks the right reviewer to confirm, in writing, that someone's access is still appropriate. Also called an access review, it is how an enterprise proves control to an auditor rather than merely asserting it.

In a manager certification, every manager receives a list of their direct reports' access and must certify or revoke each item. Revocations flow straight into provisioning. IdentityIQ also supports entitlement owner, application owner, role and event-based certifications — all part of Module 11. If your organisation is subject to SOX in the US, UK GDPR and FCA rules in Britain, or RBI cyber-security guidance in India, certification campaigns are the evidence produced at audit time. Our access certification guide walks through a full campaign.

10. What is an SoD policy, and what is a risk score?

A separation-of-duties (SoD) policy defines combinations of access that no single person should hold, and IdentityIQ flags or blocks violations. A risk score turns an identity's accumulated access and violations into a number.

The classic SoD rule in banking: nobody may both create a vendor and approve payments to vendors. Alone, each entitlement is legitimate; together they enable fraud. IIQ evaluates policies during access requests, during refresh and during certifications, so a violation is caught at request time rather than at audit time. Risk scoring (Module 9) then lets a governance team prioritise — reviewing the 200 riskiest identities first instead of all 40,000. See our policy management and SoD guide for policy types and configuration.

In what order should you learn these 10 concepts?

Follow the data, not the menu. IdentityIQ's navigation is organised for administrators who already understand the platform; the learning order below follows how information actually moves through it, which is why it maps cleanly onto the 14-module curriculum.

Concept definitions follow SailPoint's public IdentityIQ product documentation (documentation.sailpoint.com), reviewed August 2026. Module names are taken verbatim from SailPoint Academy's published 14-module IdentityIQ curriculum. SailPoint Academy is an independent training provider and is not affiliated with, authorised by or endorsed by SailPoint Technologies, Inc.

What this tutorial deliberately leaves out

Three things belong to your second week, not your first: installation and architecture (Module 2), rules and BeanShell (Module 6), and custom workflows (Module 13). They are important — our rules and BeanShell guide exists for exactly that stage — but writing an aggregation rule before you understand what aggregation is for produces code that works and an engineer who cannot explain it. Interviewers notice.

If you want the structured version of this with a live environment, our live online SailPoint IIQ course covers all 14 modules over 2 months for a flat Rs. 25,000, capped at 25 students, with session recordings in the LMS and placement assistance afterwards. For the wider study plan, read how to learn SailPoint IIQ in 2 months, and for where these skills lead, see the IAM career roadmap from SailPoint Academy.