Ask ten candidates to explain SailPoint IdentityIQ architecture and nine will recite the same list of boxes: presentation layer, business logic layer, database. It is not wrong. It is also not an answer, and experienced interviewers know it the moment they hear it. What they are testing is whether you can trace a single change — one employee joining a bank in Hyderabad — all the way through the system and say what touched it, in what order, and what breaks if one piece is missing.
Quick answer: SailPoint IdentityIQ (IIQ) architecture is a three-tier Java web application. A presentation tier serves the browser interface, a business logic tier runs the governance platform, provisioning engine, workflow engine, rule engine and task scheduler inside a Java application server such as Apache Tomcat, and a data tier stores every Identity Cube in a relational database known as the Identity Warehouse. Connectors sit at the edges, aggregating account data in from source systems and provisioning approved changes back out to target systems.
This guide walks that architecture end to end — components, data flow, the runtime stack, production deployment topology, and how it differs from the cloud platform. It also does something most architecture pages skip: it tells you how much of this you actually need to know at each career stage, because the honest answer is that an IAM analyst and an IIQ architect need very different depths of the same diagram. Architecture is Module 2 of the 14-module IIQ curriculum for exactly that reason — it is the map everything else is drawn on.
What is SailPoint IdentityIQ architecture?
SailPoint IdentityIQ architecture is a three-tier, Java-based design in which a browser presentation tier, a business logic tier running inside a Java application server, and a relational database tier cooperate to govern enterprise access. The database tier stores the Identity Warehouse. Connectors link the platform to source and target systems.
The word "tier" is doing real work here. These are not decorative layers — they are separately scalable, separately deployable and separately failure-prone. An organisation can add application server nodes without touching the database, or move the database to a high-availability cluster without reinstalling IdentityIQ. In practice, when a production IIQ environment misbehaves in an Indian BFSI GCC, the first diagnostic question is always which tier the problem lives in, because that determines who gets paged.
Presentation tier — what users see
The browser-based SailPoint IdentityIQ interface. Business users raise access requests through QuickLinks, managers complete certification campaigns, and administrators configure applications and tasks. Nothing is calculated here; every click becomes a call into the tier below.
Business logic tier — where governance happens
The Java application server hosting the governance platform, provisioning engine, workflow engine, rule engine and task scheduler. Correlation, role evaluation, policy checks, risk scoring and provisioning plan generation all execute here. This is the tier your BeanShell rules run inside.
Data tier — the Identity Warehouse
A relational database holding every Identity Cube, account, entitlement, role, policy, certification record and audit event. SailPoint IdentityIQ cannot start without it. In large enterprises this database grows to millions of rows, which is why indexing and archiving are architecture decisions, not housekeeping.
What are the core components of SailPoint IdentityIQ?
The core components of SailPoint IdentityIQ are the governance platform, the Identity Cube, the Identity Warehouse, connectors, the provisioning engine, the workflow engine, the rule engine, the task scheduler, Lifecycle Manager and Compliance Manager. All of them read and write the same shared identity, role, policy and risk model.
That last sentence is the point most component lists bury. IdentityIQ is not ten tools sharing a login screen — it is one data model that ten engines operate on. When a certification reviewer revokes an entitlement, the provisioning engine can act on it immediately because both are looking at the same Identity Cube, not at two synchronised copies.
| Component | What it does | Where it lives |
|---|---|---|
| Governance platform | Holds the shared identity, role, policy and risk model every other engine reads | Business logic tier |
| Identity Cube | A correlated 360-degree view of one person: every account, entitlement, role and attribute | Data tier |
| Identity Warehouse | The IIQ database itself — the persisted store of all cubes and governance records | Data tier |
| Connectors | Read accounts from source systems and write approved changes to target systems | Edge of the business logic tier |
| Provisioning engine | Compiles provisioning plans and dispatches them to the right connector | Business logic tier |
| Workflow engine | Runs multi-step business processes: approvals, escalations, lifecycle event handling | Business logic tier |
| Rule engine | Executes BeanShell rules at defined extension points inside other engines | Business logic tier |
| Task scheduler | Quartz-based scheduler running aggregation, identity refresh, reports and system tasks | Business logic tier |
| Lifecycle Manager | Self-service access requests, password management, joiner-mover-leaver events | Functional module |
| Compliance Manager | Access certification campaigns, policy management and audit reporting | Functional module |
SailPoint IIQ Architecture Explorer
Click any tier or component below to see what it does, what breaks when it fails, and which of the 14 curriculum modules covers it. Data enters from the left and leaves through the right.
Presentation tier
The browser-based SailPoint IdentityIQ interface. Business users raise access requests through QuickLinks, managers complete certification campaigns, administrators configure applications and tasks. Nothing is calculated here — every click becomes a call into the tier below.
Business logic tier
The Java application server hosting every engine SailPoint IdentityIQ runs. Correlation, role evaluation, policy checks, risk scoring and provisioning plan generation all execute here. This is the tier your BeanShell rules run inside, and the tier that consumes the most memory.
Data tier — the Identity Warehouse
A relational database holding every Identity Cube, account, entitlement, role, policy, certification record and audit event. "Identity Warehouse" is the logical name for this governance data; physically it is just the IdentityIQ database schema.
Connector layer
Integration adapters that know how to read accounts and groups from a specific system and how to write changes back to it. Direct connectors talk to the target over the network; datafile connectors consume a flat file; special connectors handle systems with their own protocols.
Governance platform
The shared identity, role, policy and risk model that every other engine reads and writes. This is what makes SailPoint IdentityIQ behave as one governance system rather than several tools bolted together — a revocation decided in a certification is immediately visible to the provisioning engine.
Provisioning engine
Compiles a provisioning plan — a precise statement of what must change on which system — and dispatches it to the right connector. It also handles retries, partial failures and the manual work items raised when a target cannot be automated.
Workflow engine
Orchestrates multi-step business processes: approval chains, escalations, notifications and the handling of lifecycle events. Enterprise approval logic — two-level manager approval, application-owner sign-off, auto-approval for birthright access — is configured here rather than coded.
Rule engine
Executes BeanShell rules at defined extension points inside the other engines. Aggregation rules, provisioning rules, connector rules and schema rules each hook into a different moment in the pipeline — which is exactly why knowing the architecture is a prerequisite for writing one safely.
Task scheduler
A Quartz-based scheduler that runs aggregation jobs, identity refresh, reports and system tasks on a defined schedule. In a clustered deployment its work is pinned to designated task and request servers so it never competes with interactive users.
Lifecycle Manager & Compliance Manager
The two functional modules sitting on the governance platform. Lifecycle Manager covers self-service access requests, password management and joiner-mover-leaver events. Compliance Manager covers access certification campaigns, policy management and audit reporting.
IQService
A lightweight Windows service installed inside the target network so SailPoint IdentityIQ can perform native Windows operations — password resets, home directory creation, PowerShell-based provisioning — that a remote Java process cannot do directly.
Two of these deserve their own study time. The Identity Cube is the concept every beginner underestimates and every interviewer probes — our dedicated explainer on what an Identity Cube is in SailPoint IIQ covers it properly. Connectors are the other, because they are where architecture meets the messy reality of a client's estate; the SailPoint IIQ connectors guide breaks down direct connect, datafile and special connectors.
How does data actually flow through SailPoint IdentityIQ?
Data flows through SailPoint IdentityIQ in six stages: aggregation reads accounts from a source system, correlation matches them to people, identity refresh rebuilds the Identity Cube, a trigger raises a change, the workflow engine collects approvals, and the provisioning engine writes the change to the target system. The result is then stored back in the Identity Warehouse.
Follow one real case. A bank's Workday system records a new analyst starting in the Chennai treasury team. Press play below to walk the change through the system stage by stage, or click any stage to jump straight to it.
Trace a Joiner Through SailPoint IIQ
One new hire in a bank's Workday system, followed from HR record to provisioned Active Directory account.
01 · Aggregation — pulling the raw data in
A scheduled aggregation task calls the Workday connector, which reads worker records and loads them into SailPoint IdentityIQ. Nothing is interpreted at this stage — it only fetches. A full aggregation across a large source can run for hours, which is why it belongs on a dedicated task server.
Task schedulerConnector layerModule 4 — SailPoint Jobs02 · Correlation — matching accounts to people
SailPoint IdentityIQ matches each aggregated account to a person using correlation configuration or a correlation rule. A brand-new joiner correlates to nothing, so a new identity is created. Accounts that should have matched but did not become uncorrelated or orphan accounts — a permanent audit finding in most enterprises.
Rule engineIdentity WarehouseModule 3 — Application Onboarding03 · Identity refresh — rebuilding the Identity Cube
The identity refresh task rebuilds the Identity Cube, recalculates assigned and detected roles, recomputes the risk score and evaluates Separation of Duties policies. This is the single most performance-sensitive task in a large SailPoint IdentityIQ deployment, and the usual reason a portal crawls at 9am.
Governance platformModule 7 — Role ManagementModule 9 — Risk Score04 · Trigger — something has to start the change
A lifecycle event fires because the identity's status changed from nothing to active — the joiner event. The same stage handles the other two entry points: a user raising an access request, or a certification reviewer revoking an entitlement. All three converge on the same downstream path.
Lifecycle ManagerCompliance ManagerModule 12 — Lifecycle Events05 · Workflow and approval — routing the decision
The workflow engine runs the business process attached to that trigger, routing approvals to the line manager and the application owner. Rules configured at the workflow's extension points can alter the path — skipping approval for birthright access, or escalating when an approver does not respond inside the SLA.
Workflow engineRule engineModule 13 — Custom Workflow06 · Provisioning — writing the change out
The provisioning engine compiles a provisioning plan stating exactly what must change on which system, hands it to the Active Directory connector for execution, and writes the outcome back into the Identity Warehouse so the next certification campaign sees the new access. The loop is now closed.
Provisioning engineIQServiceModule 6 — Application RulesThe same six stages, written out for reference:
Aggregation
A scheduled aggregation task calls the Workday connector, which reads worker records and loads the raw data into SailPoint IdentityIQ. Nothing is interpreted yet — this stage only fetches.
Correlation
IdentityIQ matches each aggregated account to a person using correlation configuration or a correlation rule. A brand-new joiner correlates to nothing, so a new identity is created. Accounts that should have matched but did not become uncorrelated or orphan accounts — a permanent audit finding in most enterprises.
Identity refresh
The identity refresh task rebuilds the Identity Cube, recalculates assigned and detected roles, recomputes the risk score and evaluates Separation of Duties policies. This is the single most performance-sensitive task in a large SailPoint IdentityIQ deployment.
Trigger
A lifecycle event fires because the identity's status changed from nothing to active — the joiner event. Alternatively the trigger could be an access request raised by the user or a revocation decision made by a certification reviewer.
Workflow and approval
The workflow engine runs the business process attached to that trigger, routing approvals to the line manager and application owner. Rules configured at the workflow's extension points can alter the path — skipping approval for birthright access, for example.
Provisioning
The provisioning engine compiles a provisioning plan stating exactly what must change on which system, hands it to the Active Directory connector for execution, and writes the outcome back into the Identity Warehouse so the next certification campaign sees the new access.
Read that loop backwards and you have the answer to nearly every troubleshooting question in identity governance. Access missing on day one? Check aggregation, then correlation, then the lifecycle event. Access appearing that nobody approved? Check role assignment during refresh. The detail behind stages one and three lives in our guide to SailPoint IIQ aggregation and refresh jobs, and stage five is unpacked in SailPoint IIQ custom workflows explained.
What does SailPoint IdentityIQ actually run on?
SailPoint IdentityIQ ships as a Java EE web archive named identityiq.war, deployed into a Java application server such as Apache Tomcat, Oracle WebLogic, IBM WebSphere or JBoss, and backed by a relational database. The SailPoint IdentityIQ 8.5 Installation Guide, revised July 2025, lists Oracle, Microsoft SQL Server, MySQL, PostgreSQL and IBM DB2 as supported databases.
This matters more than it sounds. Because IdentityIQ is a WAR file on a servlet container, installing it is a deployment exercise, not a wizard: unpack the archive into the application server's webapps directory, point iiq.properties at the database, run the supplied schema scripts, restart. Upgrades and patches follow the same shape, which is why Module 2 of our curriculum covers installing, upgrading and patching SailPoint alongside the architecture itself — those three are the same skill.
Application server
Apache Tomcat is the most common host in Indian deployments. WebLogic, WebSphere and JBoss appear where an enterprise has already standardised on them. The choice changes the operations runbook, not the IIQ configuration.
Database
Oracle and Microsoft SQL Server dominate Indian BFSI environments because those platforms are already licensed and supported there. The database holds the entire Identity Warehouse, so its sizing and backup posture is an identity-programme risk, not a DBA detail.
IQService
A lightweight Windows service installed inside the target network so IdentityIQ can perform native Windows operations — password resets, home directory creation, PowerShell provisioning — that a remote Java process cannot do directly.
Source: SailPoint IdentityIQ 8.5 Installation Guide (revised July 2025), published on the SailPoint Community documentation portal. Supported platform lists change between releases — always confirm against the installation guide for the exact version your employer runs before quoting version numbers in an interview.
Architecture makes sense once you watch it run
Attend a free 60-minute live demo before you decide — no payment, no commitment. See a real SailPoint IdentityIQ environment, ask the trainer anything, then judge.
How is SailPoint IdentityIQ deployed in production?
Production SailPoint IdentityIQ deployments separate application server nodes by role: UI servers serve interactive users, task servers run scheduled background jobs, and request servers process queued and partitioned work. All nodes share one database, and a load balancer distributes user traffic across the UI nodes.
The role is set through ServiceDefinition configuration on each host, not by installing different software — every node runs the same identityiq.war. This trips up newcomers constantly, and it is a recurring theme on the SailPoint Developer Community, where practitioners ask how to designate task versus request servers and why partitioned refresh tasks keep landing on UI hosts. If you ever wondered why business users complain the portal is slow every Tuesday morning, the usual answer is that nobody separated the tiers and a full aggregation is running on the node serving their browser.
| Topology | Node layout | Availability | Typical use |
|---|---|---|---|
| Single server | One node, one database | None | Development, training labs, proof of concept |
| Multi-server | Separate UI and task nodes | Basic | Mid-size production where aggregation must not slow the UI |
| High availability | Redundant UI nodes behind a load balancer | Failover | Business-critical BFSI and regulated environments |
| Clustered | Many nodes, dedicated request servers, shared database | Highest | Large global enterprises and GCC-scale deployments |
Designing this topology — deciding node counts, partitioning strategy and database sizing for a client with 180,000 identities — is architect work, not analyst work. It is the substance of the SailPoint IIQ architect training path and is exactly what separates a senior consultant from someone who configures what a senior consultant designed.
How is IIQ architecture different from SailPoint ISC architecture?
SailPoint IdentityIQ is software an enterprise installs and operates on its own application servers and database, while SailPoint Identity Security Cloud (ISC) is a SaaS platform SailPoint operates, where the customer deploys only a Virtual Appliance inside their network to reach on-premises systems. The governance concepts are shared; the operational responsibility is not.
That difference explains the skills split in the job market. An IIQ engineer talks about Tomcat memory, database indexes and task partitioning. An ISC engineer never touches an application server, but must understand Virtual Appliances, tenant configuration and transforms. Identity Cubes, roles, certifications and the joiner-mover-leaver model carry over almost intact, which is why practitioners who learn IIQ architecture properly find ISC concepts familiar rather than foreign. Our comparison of SailPoint IIQ vs IdentityNow and ISC covers which to learn first.
How much SailPoint IIQ architecture do you actually need to know?
How much SailPoint IdentityIQ architecture you need depends on your role: an IAM analyst needs the data flow, a SailPoint developer needs to know which engine their code runs inside, and an IIQ architect needs deployment topology, sizing and migration design. Nobody needs all of it on day one.
This is the part product documentation cannot tell you, because it is a career question rather than a technical one. Fourteen-plus years of enterprise IAM delivery teaches you which architectural facts get used weekly and which get used once every three years, and the gap between those two lists is large.
IAM analyst — the data flow
Know the six-stage flow cold, know what aggregation and identity refresh each do, and know why an orphan account exists. You will troubleshoot access issues daily with exactly this. No Java required.
SailPoint developer — the extension points
Add the rule engine and workflow engine. You need to know which engine calls your BeanShell rule, what context it receives and what it can safely modify. Writing a rule without that map is how production outages happen.
IIQ architect — the topology
Add node roles, partitioning, load balancing, database sizing, HA design and upgrade paths. This is where the money is and where the eight-plus years of experience in job descriptions is actually justified.
Identity business analyst — the vocabulary
You need enough architecture to write requirements an engineer can build and to explain to an auditor why a certification report says what it says. Depth of concepts, not depth of configuration.
If you are worried that all of this implies heavy programming, it does not — our honest answer to whether SailPoint requires coding explains which IAM roles stay configuration-first. The broader progression from analyst to architect is mapped on the IAM career roadmap.
Which SailPoint IIQ architecture questions come up in interviews?
SailPoint IdentityIQ architecture interview questions cluster around six themes: the three-tier model, the Identity Cube and Identity Warehouse, the difference between aggregation and provisioning, task versus request servers, IQService, and supported databases and application servers. Scenario framing is now more common than definition recall.
The shift matters. Five years ago "what are the components of IIQ" was a viable question. In 2026 the same panel is likelier to ask "aggregation is taking nine hours and the portal is unusable during it — what do you check?" Both are architecture questions; only one can be answered from a memorised list. Prepare for the second kind:
- Explain the three tiers of SailPoint IdentityIQ and what executes in each.
- Walk me through what happens between an HR joiner record arriving and the user's Active Directory account being created.
- What is the difference between aggregation and provisioning, and which direction does each move data?
- How do task servers and request servers differ, and how is the role assigned to a host?
- What is IQService, and why can't IdentityIQ provision to Active Directory without it in most deployments?
- An account exists in the target system but not on any Identity Cube. What has gone wrong and where do you look first?
- Which databases and application servers does IdentityIQ support, and what constrains the choice at a given client?
Architecture Self-Check — 5 Questions
Answer before you scroll. Each one is a real SailPoint IdentityIQ architecture question, and each answer explains why.
Answer the scenario ones by narrating the data flow out loud — that single habit separates candidates who have seen a real environment from candidates who have read a blog. For broader preparation, work through our SailPoint IIQ interview questions and the harder scenario-based SailPoint interview questions.
Is SailPoint IIQ architecture still worth learning in 2026?
Yes — SailPoint IdentityIQ remains widely deployed in Indian enterprises, and Naukri listed 6,164 SailPoint job vacancies across India in September 2026. Naukri separately listed 3,918 SailPoint IdentityIQ vacancies in August 2026, which indicates IIQ-specific demand is a substantial share of the total SailPoint market.
The honest nuance is that new SailPoint deployments increasingly start on Identity Security Cloud rather than IdentityIQ. That does not retire IIQ architecture knowledge — it raises its value, because every migration from IIQ to ISC requires someone who understands the source platform deeply enough to map its configuration forward. Migration engineers who know both are among the more sought-after profiles in the Indian market right now, and we cover the timing of that window in our analysis of the IIQ-to-ISC migration decade.
Outside India the same architecture knowledge travels well. In the United States, SOX and HIPAA obligations keep large on-premises IdentityIQ estates running inside banks and healthcare providers. In the United Kingdom, FCA and UK GDPR requirements sustain IIQ deployments across BFSI, where the audit trail stored in the Identity Warehouse is precisely what regulators ask to see. Because SailPoint Academy delivers live online SailPoint IIQ training over Zoom, professionals in the US, UK, Australia, Canada, UAE and Singapore attend the same sessions as students in Hyderabad and Bangalore.
Job figures are counts published on Naukri.com's SailPoint listing pages and observed in August and September 2026. Listing counts fluctuate daily, include duplicate postings across recruiters, and are indicators of market activity rather than a precise measure of open roles.
Where architecture sits in structured SailPoint IIQ training
SailPoint Architecture is Module 2 of SailPoint Academy's 14-module IdentityIQ curriculum, taught immediately after the IAM Overview module and before any hands-on configuration work begins. The module covers installing SailPoint, upgrading SailPoint, patching SailPoint, and the architecture of SailPoint itself.
The sequence is deliberate. Application Onboarding is Module 3, SailPoint Jobs is Module 4, and Application Rules is Module 6 — each of them makes sense only if you already know which tier you are working in. Students who skip architecture can still click through an onboarding wizard, but they cannot explain why a task failed, and interviewers find that out in about four minutes.
The full live online course from SailPoint Academy runs 2 months at a flat Rs. 25,000, is capped at 25 students per batch, includes session recordings in the LMS, and is taught by a lead trainer with 14+ years of enterprise IAM and SailPoint experience. It awards a SailPoint Academy certificate of completion — not an official SailPoint Technologies certification, which is available only through SailPoint's own Identity University. Placement assistance and interview preparation are included; job outcomes are never guaranteed by us or by anyone who is being straight with you.
Frequently Asked Questions
Learn IIQ Architecture on a Live System
Rs. 25,000 flat, 2 months, 14 modules, 100% live on Zoom, batch capped at 25, recordings in the LMS, lead trainer with 14+ years of enterprise IAM experience. Attend a free 60-minute demo first. No payment. No commitment.