What Are Jobs (Tasks) in SailPoint IIQ?
Jobs (tasks) in SailPoint IdentityIQ (IIQ) are scheduled operations that keep identity data current, and the three main types are account aggregation (reads accounts from applications), identity refresh (analyses and updates identity cubes), and system tasks (background maintenance). Jobs are Module 4 of the SailPoint Academy 14-module curriculum.
If onboarding sets an application up and connectors define how to talk to it, jobs are what actually run on a schedule to keep governance accurate. Every night (or on whatever cadence is configured), IIQ aggregates fresh account data, refreshes identities, and runs maintenance so that certifications, access requests, and reports always reflect reality. Understanding which job does what — and in what order — is a daily operational skill on every SailPoint project.
Why this matters in real projects: When something looks wrong in IIQ — a stale role, a missed policy violation, an account that should have been disabled — the root cause is very often a job that did not run, ran in the wrong order, or ran with the wrong options. Diagnosing this is core L2/L3 and consultant work.
What Is the Difference Between Aggregation and Identity Refresh?
In SailPoint IIQ, account aggregation discovers and collects accounts and entitlements from applications and marks changed identities, while identity refresh analyses that collected data — recalculating roles, running policy scans, and provisioning assignments. Put simply: aggregation reads the data, and identity refresh processes it.
This is the single most important distinction in this module, and interviewers test it constantly. A helpful analogy: aggregation is like collecting everyone's updated details into a pile; identity refresh is sitting down and actually updating each person's record from that pile — recomputing their roles, checking them against policies, and triggering any provisioning that results. The two are separate jobs on purpose, so each can be scheduled, tuned, and partitioned independently.
What Does an Account Aggregation Task Do?
An account aggregation task in SailPoint IIQ scans an application, discovers its users and entitlements, and correlates them to identity cubes, flagging identities that changed so identity refresh can run faster. Common options include refreshing assigned and detected roles, checking active policy, enabling delta aggregation, and detecting deleted accounts.
The task pulls account data through the application's connector and correlates each account to the right person — the same correlation logic configured during application onboarding. Key options you will configure in practice:
- Refresh assigned and detect roles — recompute roles for aggregated identities.
- Check active policy — apply policies to identities during aggregation.
- Only create links if correlated — avoid creating identities from a non-authoritative source.
- Enable delta aggregation & detect deleted accounts — process only changes and catch removals.
Note a practical gotcha interviewers like: if you change correlation logic after a source is already aggregated, you must re-run aggregation with optimisation disabled, so unchanged accounts are re-examined.
Want to run and tune these tasks hands-on with a trainer?
Attend a free 60-minute live demo before you decide. No payment, no commitment — see real aggregation and refresh tasks run in IIQ.
What Does an Identity Refresh Task Do?
An identity refresh task in SailPoint IIQ scans identity cubes to keep them accurate — refreshing assigned and detected roles, provisioning assignments, running policy scans for violations, and updating risk scorecards. It can run incrementally on only changed (delta) identities and supports partitioning to speed up large environments.
This is where governance decisions actually happen. After aggregation has gathered the raw data, identity refresh recalculates each identity's effective access, detects and reports policy violations (such as segregation-of-duties conflicts), can launch event-based certifications, and can create provisioning requests to add roles. Because it touches every identity, refresh is the job most often tuned for performance through incremental processing and partitioning.
What Are System and Maintenance Tasks?
System tasks in SailPoint IIQ run in the background to maintain the platform rather than process a single application, and the most important is Perform Maintenance, which prunes identity snapshots, task results, and certifications and escalates orphaned work items. Other examples include Refresh Entitlement Correlation, Refresh Groups, and Policy Scan.
Perform Maintenance
Prunes old identity snapshots, task results, and certifications; escalates orphaned work items. The core housekeeping task.
Refresh Entitlement Correlation
Scans user entitlements and applications to update role assignments across the environment.
Refresh Groups
Scans all users and updates the group indexes for every identity group used in IIQ.
Policy Scan
Runs policies against identity cubes and updates scorecards with any violations found.
These keep IdentityIQ healthy and performant. Skipping Perform Maintenance, for example, lets task results and snapshots pile up and slowly degrades performance — a classic real-world support finding.
How Does Delta and Optimized Processing Keep IIQ Fast?
Delta aggregation in SailPoint IIQ processes only accounts that changed since the last run, and incremental (delta) identity refresh processes only changed identities, which together let enterprises keep huge identity populations current without long full-scan run times. Partitioning further splits refresh work across machines for speed.
In a large bank or GCC with hundreds of thousands of accounts, a full aggregation and refresh of everything every night would be impractical. Delta processing is the answer: aggregation marks which identities changed, and refresh then works only on those marked identities. This two-step optimisation is exactly why aggregation and refresh are separate jobs — and knowing when to disable optimisation (for example after a correlation change) is a senior-level operational judgement.
The performance trade-off to remember
Delta and optimised modes are fast but assume nothing changed in unchanged records. After any change to correlation, roles, or policy logic, you often need a full (non-optimised) run so IIQ re-evaluates everything. Choosing correctly is what separates trained engineers from trial-and-error.
What Order Do SailPoint Jobs Run In?
In a typical SailPoint IIQ schedule, account aggregation runs first to collect fresh data, identity refresh runs next to process and act on it, and system/maintenance tasks run periodically in the background. Aggregation feeds refresh, so running refresh before aggregation would process stale data.
The logical sequence on most projects is: aggregate authoritative sources (HR) first, then non-authoritative applications, then run identity refresh to recompute roles and run policy scans, with Perform Maintenance and other system tasks scheduled on their own cadence. This ordering is not arbitrary — it follows the data dependency, and it connects to lifecycle events (a Joiner detected during HR aggregation is acted on during refresh) and to workflows that the resulting provisioning triggers.
What Do Interviewers Ask About SailPoint Jobs?
SailPoint job questions are common in IIQ interviews, focusing on the difference between aggregation and identity refresh, account aggregation options, what system tasks like Perform Maintenance do, and how delta processing improves performance. These appear in technical rounds at GCCs, Big 4 consulting firms, and IT services companies hiring IAM professionals.
- What is the difference between account aggregation and identity refresh?
- What are the key options on an account aggregation task?
- What does an identity refresh task actually do to an identity cube?
- What is the Perform Maintenance task and why does it matter?
- How does delta aggregation improve performance, and when must you disable optimisation?
- In what order would you schedule these jobs, and why?
If you can answer these with examples, you are interview-ready on this module. For more, see our SailPoint IIQ interview questions guide, and the SailPoint career paths page shows where operational IAM roles sit.
Frequently Asked Questions
These are the questions IT professionals most often ask about SailPoint IdentityIQ (IIQ) jobs and tasks — drawn from practitioner forums, the SailPoint Developer Community, and questions students raise in SailPoint Academy live sessions. Each answer maps to Module 4 of the 14-module IIQ curriculum.
Run Real Tasks With a Trainer
Attend a free 60-minute live demo — see real aggregation, refresh, and maintenance tasks run in IIQ, ask the trainer anything, and decide with complete clarity. No payment. No commitment.