SailPoint IIQ Connectors Explained — Direct Connect, Datafile and Special Connectors

What Is a Connector in SailPoint IIQ?

A connector in SailPoint IdentityIQ (IIQ) is the integration component that lets IIQ read accounts and entitlements from a target system and write changes back to it. Connectors handle the protocol-level communication — LDAP, JDBC, SCIM, web services, or flat files — so IdentityIQ can govern an application. They are introduced in Module 3 of the SailPoint Academy 14-module curriculum.

If application onboarding is the process, the connector is the tool that makes it possible. An application in IIQ is simply a configured instance of a connector — the connector supplies the "how to talk to this system" logic, and the application configuration supplies the specific hostname, credentials, and schema. SailPoint ships with 100+ out-of-the-box connectors for common enterprise systems, so most onboarding is configuration rather than code.

What Are the Main Types of SailPoint IIQ Connectors?

SailPoint IIQ connectors fall into four groups: Direct Connect connectors that talk live to a system, Datafile/Delimited connectors that read flat files, Special connectors that require a connector rule, and Custom connectors built in Java for unsupported systems. Most enterprise onboarding uses direct or datafile connectors out of the box.

What Are Direct Connect Connectors and When Are They Used?

Direct Connect connectors in SailPoint IIQ establish a live connection to a target system and support both reading accounts and provisioning changes back, making them the preferred choice whenever a system has a supported interface. Common examples are Active Directory, JDBC databases, SAP, ServiceNow, and SCIM or web-service applications.

Direct connectors are the default for production governance because they enable the full loop: aggregate accounts, detect changes, and push provisioning actions (create, modify, disable) automatically. The Active Directory connector, for instance, manages users, groups, contacts, and Exchange mailboxes across multiple domains and forests from a single configured application.

• Active Directory / LDAP — user, group, and contact management, often the first authoritative-adjacent system onboarded.
• JDBC — connects to relational databases; supports stored procedures and SQL-based schema discovery.
• SAP — aggregates and provisions users with their roles and profiles, including SAP Central User Administration.
• Web services / SCIM — for modern cloud applications exposing REST APIs.

What Is a Datafile (Delimited File) Connector?

A datafile or delimited file connector in SailPoint IIQ reads account and group data from a flat file such as a CSV, retrieved from local disk or over FTP, FTPS, SCP or SFTP. It supports customisable account schemas and multi-valued attributes, and is used when a system has no live API or when read-only governance is enough early on.

The delimited connector is one of the most common ways to onboard legacy or hard-to-reach systems. A target application exports its users to a CSV on a schedule, drops it on an SFTP location, and IIQ aggregates from that file. It is simple, reliable, and avoids needing direct network access into sensitive systems — which is why it is often the first onboarding pattern taught.

What Are Special Connectors and Connector Rules?

A special connector in SailPoint IIQ is one that needs a connector rule — custom Java/BeanShell logic — to aggregate or provision correctly, most commonly the Delimited File, JDBC, and SAP connectors. Connector rules run during aggregation or provisioning to transform data, call stored procedures, or handle formats the standard connector cannot process alone.

Connector rules are the bridge between out-of-the-box configuration and full custom development. Typical uses include: cleaning or reformatting attribute values as they are read, executing a database stored procedure during JDBC provisioning, or applying SAP-specific transformation logic. This is the point where Module 6 of the curriculum — Application Rules — connects directly to onboarding, and where Java-fluent professionals gain an advantage.

When Do You Need a Custom Connector?

You need a custom connector in SailPoint IIQ only when no out-of-the-box connector exists for a system — typically a homegrown or niche in-house application. A custom connector is built in Java, defining how IdentityIQ aggregates accounts from and provisions changes to that system. It is the highest-effort, developer-level connector option.

Before building one, experienced practitioners always check whether a generic connector can do the job: many "unsupported" systems can be onboarded with a JDBC connector (if they sit on a database) or a delimited connector (if they can export a file). A true custom connector is reserved for systems with a proprietary API and no simpler path. Knowing when not to build custom code is itself a mark of a trained engineer.

Which SailPoint Connector Should You Use?

Use a direct connector when the target system has a supported live interface, a datafile/delimited connector when there is no live API or read-only governance is enough, a special connector with a rule when data needs transformation, and a custom connector only when nothing else fits. The decision is driven by the system's interface and whether you need provisioning.

For the full picture of how connectors fit the onboarding workflow, read our companion guide on SailPoint IIQ application onboarding, and see where this sits in the live SailPoint IIQ course.

What Do Interviewers Ask About SailPoint Connectors?

SailPoint connector questions are common in IIQ technical interviews, focusing on connector types, the difference between direct and delimited connectors, when a connector rule is needed, and how to choose a connector for a given system. These appear in technical rounds at GCCs, Big 4 consulting firms, and IT services companies hiring IAM professionals.

• What are the types of connectors in SailPoint IIQ, and how do they differ?
• What is the difference between a direct connector and a delimited file connector?
• When would you use a connector rule, and which connectors commonly need one?
• How would you onboard a legacy system that has no API?
• When is a custom connector justified instead of JDBC or delimited?
• What does the Active Directory connector manage, and is it read-write?

If you can answer these with concrete examples, you are interview-ready on connectors. For more, see our SailPoint IIQ interview questions guide and the broader SailPoint career paths overview.