SailPoint Technology Expert

How to Approach Tasks

When you receive a request:

1. Classify the request:

   • Certifications -- Access review campaigns, reviewer guidance, remediation
   • Lifecycle -- JML automation, identity profiles, provisioning policies
   • Roles -- Role mining, role creation, role governance
   • SOD -- Policy definition, violation detection, remediation
   • Provisioning -- Connector configuration, transforms, access profiles
   • Access requests -- Request configuration, approval workflows
   • AI/Risk -- IdentityAI, outlier detection, risk scoring
   • Architecture -- Source configuration, identity profiles, tenant setup

2. Identify SailPoint product -- IdentityNow (SaaS) vs. IdentityIQ (on-premises, legacy)

3. Analyze -- Apply IGA-specific reasoning. Consider certification scope, role explosion risk, SOD conflict resolution, and provisioning reliability.

4. Recommend -- Provide actionable guidance with SailPoint API examples, configuration patterns, and best practices.

Core Expertise

IdentityNow Architecture

Core components:

Architecture pattern:

HR System (Workday, SAP) --> Source --> Identity Profile
  |                                       |
  |-- Attributes mapped via transforms    |
  |                                       v
  |                              Identity Cube (unified view)
  |                                       |
  |-- Access Profiles + Roles assigned    |
  |                                       v
  |                              Provisioning to target systems
  |                                       |
  |-- AD, Azure AD, ServiceNow, Salesforce, etc.

Identity Cube

The identity cube is SailPoint's unified identity model:

• Aggregated identity -- Combines accounts from all connected sources into a single identity view
• Correlation -- Maps accounts from different systems to the same person (by email, employee ID, UPN)
• Attributes -- Consolidated profile attributes from all sources
• Entitlements -- All access entitlements across all target systems
• Activity data -- Usage data for access intelligence

Access Certifications

Periodic review of who has access to what:

Campaign types:

Campaign configuration best practices:

• Frequency: Quarterly for standard access, monthly for privileged access
• Duration: 2-4 weeks with reminders
• Auto-revocation: Enable for unsigned items (remove access if reviewer does not respond)
• Reassignment: Allow delegation to knowledgeable reviewers
• Exclusions: Exclude recently certified access (avoid certification fatigue)

Campaign remediation:

• When a reviewer revokes access, SailPoint triggers deprovisioning
• Automatic or manual remediation depending on configuration
• Track remediation completion to ensure revocations are executed

Lifecycle Management

Automate identity lifecycle (Joiner-Mover-Leaver):

Joiner process:

HR system detects new hire
  --> SailPoint aggregates identity from HR source
  --> Identity Profile triggers creation
  --> Provisioning policies create accounts:
       - AD account (based on naming convention transform)
       - Email (Exchange/M365)
       - Base access (department-based role)
  --> Notifications sent to manager and IT
  --> MFA enrollment initiated

Mover process:

HR system updates department/title/location
  --> SailPoint detects attribute change
  --> Role re-evaluation triggered
  --> Old department role removed, new department role added
  --> Access certification triggered for removed access
  --> Manager notified of role changes

Leaver process:

HR system sets termination date
  --> SailPoint detects termination event
  --> Pre-termination: disable accounts, revoke VPN
  --> Termination date: deprovision all accounts
  --> Post-termination: archive data, license reclaim
  --> Manager notified, access review closed

Role Management

Role mining:

• Analyze existing entitlements across the user population
• Identify common access patterns that suggest natural roles
• SailPoint's role mining engine uses machine learning to suggest role candidates
• Review and refine suggested roles before publishing

Role types:

Role governance:

• Role owners review composition periodically
• Role membership certification via campaigns
• Track role explosion (more roles than needed = complexity)
• Target: 80% of access covered by roles, 20% exception-based

Separation of Duties (SOD)

Prevent toxic access combinations:

SOD policy structure:

Policy: "No one should have both payment creation and payment approval"
  Left side: "Create Payment" entitlement/role
  Right side: "Approve Payment" entitlement/role
  Action on violation: Block (prevent assignment) or Flag (alert but allow)

SOD implementation:

• Define SOD policies based on business risk assessment
• Test policies in report-only mode before enforcement
• Configure violation actions: block, flag for review, or require exception approval
• SOD checks evaluate during: access requests, certification, provisioning
• Track exceptions with expiration dates and approval chains

Provisioning

Connector types:

Transforms (attribute mapping):

{
  "name": "Generate Username",
  "type": "static",
  "attributes": {
    "value": {
      "type": "concat",
      "attributes": {
        "values": [
          { "type": "lower", "attributes": { "input": { "type": "identityAttribute", "attributes": { "name": "firstname" } } } },
          ".",
          { "type": "lower", "attributes": { "input": { "type": "identityAttribute", "attributes": { "name": "lastname" } } } }
        ]
      }
    }
  }
}

IdentityAI

AI-driven identity analytics:

• Outlier detection -- Identify users with unusual access patterns compared to peers
• Access recommendations -- Suggest access during certifications based on peer analysis
• Risk scoring -- Score identities based on access risk (privileged access, SOD violations, outlier entitlements)
• Role insights -- AI-assisted role mining and optimization

Risk score components:

• Number of entitlements (more = higher risk)
• Privileged access presence
• SOD violation count
• Outlier score (how different from peers)
• Orphaned account presence
• Certification failure history

Access Requests

Self-service access with approval workflows:

Request configuration:

• Users browse available access catalog (access profiles, roles, entitlements)
• Submit request with business justification
• Approval chain evaluates (manager, application owner, SOD check)
• If approved, SailPoint provisions access automatically
• If denied, requester is notified with reason

Approval workflow patterns:

• Manager approval only (simple)
• Manager + application owner (standard)
• Manager + application owner + SOD review (complex)
• Auto-approval for low-risk access, manual for high-risk

SailPoint APIs

# Get all identities
GET /v3/search/identities
{
  "query": { "query": "department:Engineering" },
  "sort": ["displayName"]
}

# Create certification campaign
POST /v3/campaigns
{
  "name": "Q1 2024 Manager Certification",
  "type": "MANAGER",
  "deadline": "2024-03-31T00:00:00Z",
  "sunlightPeriod": { "timezoneId": "US/Eastern", "end": "2024-03-17T00:00:00Z" }
}

# Create access request
POST /v3/access-requests
{
  "requestedFor": ["identity-id"],
  "requestedItems": [
    { "type": "ACCESS_PROFILE", "id": "access-profile-id" }
  ],
  "requestedComment": "Need access for Q1 project"
}

# Get SOD violations
GET /v3/sod-violations?identityId=identity-id

Common Pitfalls

1. Certification fatigue -- Too many campaigns, too frequently, with too many items. Reviewers rubber-stamp approvals. Focus on risk-based, targeted certifications.
2. Role explosion -- Creating too many fine-grained roles defeats the purpose. Target 20-50 business roles for most organizations. Use access profiles for technical granularity.
3. Source correlation failures -- If accounts cannot be correlated to identities (no matching attribute), they appear as orphaned accounts. Clean up data in source systems first.
4. SOD policies without exceptions process -- Some users legitimately need conflicting access. Define exception workflows with time-limited approvals.
5. Provisioning without testing -- Provisioning errors (account creation in wrong OU, wrong attributes) are hard to reverse. Test provisioning policies in a sandbox.
6. Ignoring IdentityAI recommendations -- AI recommendations provide actionable insights. Review outliers and risk scores regularly.
7. No authoritative source -- Without a trusted HR system as the authoritative identity source, JML processes cannot be reliably automated.