Top identity Interview Questions & Answers

SailPoint provides identity governance — managing who has access to what across an organisation, certifying that access regularly, and provisioning changes as employees join, move, and leave.

IdentityIQ (IIQ) is SailPoint’s on-premise / customer-managed governance platform. IdentityNow (IDN) is the SaaS successor with a modern UI, AI-driven insights, and a connector ecosystem built for cloud-first deployments.

A certification (also called an access review) is a periodic process where a manager, application owner, or role owner reviews each user’s access and either approves, revokes, or delegates it.

A source is a target system or authority that IDN reads or writes. Common sources: HR authoritative (Workday), identity authoritative (Active Directory), and non-authoritative (Salesforce, ServiceNow, GitHub).

IDN uses HR-driven lifecycle events to drive provisioning:

• Joiner: new hire detected via HR feed → create accounts in target systems based on role.
• Mover: employee changes role/department → update access to match the new role.
• Leaver: termination detected → disable / delete accounts across all target systems.

Access profiles bundle entitlements into reusable sets. Roles bundle access profiles into higher-level job functions. Users are assigned roles, not profiles directly.

A provisioning plan is the sequence of operations IDN will execute on target systems for a given change (joiner, access request, certification revocation). Plans can be reviewed and approved before execution.

IdentityAI analyses historical entitlement assignments and peer-group behaviour to:

• Recommend new roles and access profiles based on common patterns.
• Detect anomalies in access requests.
• Suggest role optimisation (merge similar roles, retire unused ones).

A typical first-year plan:

• 0–30: Stand up the IDN tenant, integrate HR source (Workday) and AD, build the initial identity cube.
• 30–60: Onboard the top 5 SaaS apps via pre-built connectors; configure joiner / leaver provisioning.
• 60–90: Launch first manager certification cycle for the top 3 apps; iterate on campaign tuning.
• 90+: Roll out role mining (AI), expand to remaining apps, integrate with SIEM for audit.

Define SoD policies that flag entitlements which conflict (e.g. Create Vendor + Approve Vendor Payment). IDN evaluates policies at request time and during certification:

• Preventive SoD: block the request before provisioning.
• Detective SoD: flag existing violations during access reviews.
• Mitigation: allow the violation but require compensating controls and documented sign-off.

A few proven patterns:

• Role-based certification instead of entitlement-by-entitlement.
• Auto-approval for low-risk entitlements that have been held for >1 year and matched peer-group patterns.
• Smaller, more frequent campaigns instead of one giant annual review.
• Clear revocation UI with bulk actions.

SailPoint doesn’t own passwords for end users. For service accounts and shared accounts, integrate with a dedicated vault (CyberArk, HashiCorp Vault). IDN:

• Catalogs service accounts and their privileged entitlements.
• Owns the access-request workflow that grants checkout from the vault.
• Records the audit trail of who checked out what and when.