SailPoint IIQ Policy Management and SoD Explained — How Enterprises Prevent Toxic Access

What Is Policy Management in SailPoint IdentityIQ?

Policy management in SailPoint IdentityIQ (IIQ) is the Module 8 capability that lets enterprises define rules describing access that is not allowed, then automatically detect or prevent it. The most important policy type is Separation of Duties (SoD), which stops one identity from holding a toxic combination of conflicting access.

In practical terms, a policy is a codified version of a business rule your auditors already care about — "the person who configures a payment cannot also approve it", or "a developer should not have production database admin rights". SailPoint IdentityIQ turns these written rules into machine-checkable controls that run continuously across every identity in the organisation, instead of relying on spreadsheets and manual reviews.

This guide walks through what policy management covers, the policy types SailPoint IdentityIQ supports, the difference between Role and Entitlement SoD, how detective and preventive enforcement work, how violations are remediated, and where this fits in a structured IIQ learning path.

What Is Segregation of Duties (SoD) and Toxic Access?

Segregation of Duties (SoD) in SailPoint IdentityIQ is a control that prevents a single identity from holding two conflicting entitlements or roles — a toxic combination. A classic example is one employee who can both create a vendor and approve payments to it, which SoD policies detect and block.

The phrase "toxic combination" describes any pair of permissions that, when held by the same person, creates fraud or error risk. Each permission alone is legitimate; the danger is in the combination. SoD breaks the dangerous pair across two different people so no single individual can complete a sensitive end-to-end process — the same principle behind requiring two signatures on a cheque.

What Are the Types of Policies in SailPoint IIQ?

SailPoint IdentityIQ supports five main policy types: Separation of Duties (SoD), Activity, Account, Advanced, and Risk policies. SoD is the most widely used and itself has three variants — Role SoD, Entitlement SoD, and Effective Entitlement SoD — covering conflicting roles, entitlements, and indirect access granted through nested groups or other roles.

Most enterprise projects spend the bulk of their policy effort on SoD, but it is worth knowing the full set so you can answer accurately in interviews and pick the right tool for each governance requirement.

Policy type definitions are based on SailPoint's official IdentityIQ documentation. See sources at the end of this guide.

Role SoD vs Entitlement SoD — What's the Difference?

In SailPoint IdentityIQ, a Role SoD policy flags identities that hold two conflicting business or IT roles, while an Entitlement SoD policy flags conflicting low-level entitlements within or across applications. Effective Entitlement SoD goes further, catching indirect access granted through nested groups, targets, or other roles that direct checks miss.

The choice depends on how mature your role model is. If access is cleanly packaged into roles, Role SoD is simpler to maintain. If conflicts live at the raw entitlement level — common when applications are onboarded before roles are designed — Entitlement SoD catches what role-level checks would miss.

Understanding when to use each variant is exactly the kind of practical judgement that separates a configurator from a consultant. It builds directly on role management and RBAC, which is why Module 8 is taught immediately after Module 7.

Detective vs Preventive: How Does SailPoint IIQ Enforce SoD Policies?

SailPoint IdentityIQ enforces SoD policies in two modes. Detective control runs the Refresh Identities task to scan existing identities and flag violations that already exist. Preventive control checks access at request and approval time, alerting requesters and approvers before a toxic combination is ever granted, stopping violations at the source.

Mature programmes use both. Preventive enforcement keeps new violations from being introduced through the access request workflow, while detective enforcement catches the backlog — conflicts that were granted directly in target systems, inherited through role changes, or that pre-date the policy. Running detective scans on a schedule keeps the certification and reporting data accurate for auditors.

How Are SoD Policy Violations Remediated in SailPoint IIQ?

SoD policy violations in SailPoint IdentityIQ are remediated through a defined workflow: the violation is detected, routed to a reviewer, and resolved by either revoking the conflicting access, or accepting it with a documented mitigating control and time-bound exception. Access certifications and reports then provide the audit evidence regulators require.

The important nuance — and a frequent interview point — is that not every violation can be revoked. In small teams, one person sometimes genuinely needs both halves of a conflict. SailPoint IIQ handles this honestly: the violation is accepted with a recorded mitigating control (such as extra monitoring or dual approval) and a time-bound exception, rather than being silently ignored. Here is the typical remediation flow:

1. Detect the violation — through the Refresh Identities task (detective) or a preventive check raised at access-request time.
2. Route to the reviewer — send the flagged violation to the responsible manager, application owner, or governance reviewer.
3. Decide: revoke or mitigate — revoke the conflicting access to clear it, or accept it when business-justified.
4. Apply the mitigating control & exception — record a time-bound exception and compensating control for any accepted violation.
5. Certify and capture audit evidence — confirm the decision in an access certification campaign and generate policy reports for auditors.

This is where policy management connects to access certification — certifications are the formal review point where SoD decisions are confirmed and signed off as compliance evidence.

Why SoD Compliance Drives SailPoint Hiring in India

Segregation of Duties is a mandated control under SOX, RBI IT governance norms, and the DPDP Act 2023, so Indian BFSI GCCs and IT services firms must run SoD policies in SailPoint IdentityIQ. This regulatory pressure makes policy and SoD configuration skills directly hireable, with SailPoint consultants in India earning roughly ₹12L–₹22L.

Unlike many IT skills where demand can soften during a slowdown, SoD is non-discretionary — regulators require it. That is what makes policy-management expertise a durable, recession-resistant part of an IAM career.

These are market estimates, not guarantees. Salary depends on prior experience, employer, and interview performance. SailPoint Academy provides placement assistance — not placement guarantees. For more, see our SailPoint salary guide and career paths.

Where Policy Management (Module 8) Fits in the Curriculum

Policy Management is Module 8 in SailPoint Academy's 14-module SailPoint IdentityIQ curriculum, taught right after Role Management (Module 7) because SoD policies build on roles. The two-month live online program covers policy types, SoD configuration, violation handling, and how Module 8 connects to Risk Score (Module 9) and Access Certification (Module 11).

Teaching the modules in this order is deliberate. You cannot configure a meaningful Role SoD policy without first understanding business and IT roles, and you cannot evidence a remediation decision without access certification. Module 8 is the hinge that turns access design into compliance enforcement.

For the full module-by-module breakdown, see the SailPoint IIQ curriculum or the SailPoint IIQ course page. Professionals in the BFSI GCC corridor can also explore SailPoint training in Hyderabad.

What SailPoint Policy and SoD Interview Questions Should You Expect?

SailPoint policy and SoD interview questions test whether you understand toxic access and can configure controls. Common questions include defining SoD with a real example, explaining detective versus preventive enforcement, listing the policy types in SailPoint IdentityIQ, and describing how you would remediate a violation surfaced during an access certification campaign.

Based on real practitioner and hiring discussions, these are the questions most worth preparing:

• "Explain Segregation of Duties with a real example you have seen." — Have a concrete vendor-creation/payment-approval style answer ready.
• "What is the difference between Role SoD and Entitlement SoD?" — Mention Effective Entitlement SoD for nested access to stand out.
• "How does IdentityIQ detect existing violations vs prevent new ones?" — Name the Refresh Identities task for detective control.
• "A user genuinely needs both conflicting accesses. What do you do?" — Explain mitigating controls and time-bound exceptions.
• "How do SoD violations connect to certifications and audit?" — Show you understand the end-to-end compliance flow.

For a broader set, read our SailPoint IIQ interview questions guide.