Application onboarding is the first real task most SailPoint IdentityIQ (IIQ) engineers are given, and one of the first things interviewers ask about. It means connecting an application to IIQ so its accounts and entitlements are read in, matched to the right people, and governed.
Here is the order that works, step by step.
1. Decide: authoritative or not?
An authoritative application (usually HR) is the source of truth that creates identities. A non-authoritative application (Active Directory, a database app, a SaaS tool) only holds accounts that must be matched to identities that already exist. Get this wrong and you create duplicate identities.
2. Pick the connector type
Start simple. A delimited file connector (CSV) is the easiest way to learn, then JDBC for database applications, then directory connectors such as Active Directory, then web services for REST APIs. The concepts stay the same; only the connection details change.
3. Define the schema
The schema tells IIQ what an account looks like: the attributes it reads, which attribute is the unique identity attribute, which one is the display attribute, and which attributes are entitlements (for example, group memberships). Add a group schema if the application has groups you want to govern.
4. Configure correlation
Correlation decides which identity each account belongs to, for example by matching an employee ID on the account to the employee ID on the identity. Use the correlation configuration for simple attribute matches and a correlation rule only when the logic is more complex.
5. Run aggregation and check the results
Run account aggregation (and group aggregation if you defined a group schema). Then check the results: how many accounts correlated, and how many are uncorrelated (orphan) accounts. A high orphan count almost always means a correlation problem, not a connector problem.
6. Verify the identities, then add provisioning
Open a few identities and confirm the new application accounts and entitlements appear on them. Only after reads are correct should you add provisioning policies so IIQ can create and change accounts.
Common beginner mistakes
- Choosing the wrong identity attribute, so accounts collide or duplicate
- Writing a correlation rule when a simple attribute match would do
- Testing provisioning before aggregation and correlation are clean
Go deeper
- Full guide: SailPoint IIQ application onboarding explained
- Correlation in depth: What is correlation in SailPoint IIQ?
- Structured learning: the SailPoint IIQ course at IAM Careers (45 days, 15 modules, live online)
This training is provided by IAM Careers and is not affiliated with, authorized by, sponsored by, or endorsed by SailPoint Technologies, Inc.
