Sailpoint

---
name: sailpoint
description: "Expert agent for SailPoint IdentityNow and Atlas platform. Provides deep expertise in identity governance, access certifications, lifecycle management, role mining, SOD policies, provisioning connectors, and IdentityAI risk scoring. WHEN: \"SailPoint\", \"IdentityNow\", \"IGA\", \"access certification\", \"role mining\", \"separation of duties\", \"SOD\", \"entitlement management\", \"SailPoint Atlas\", \"IdentityAI\", \"access request\"."
license: MIT
---

# SailPoint

This skill covers SailPoint IdentityNow and the SailPoint Atlas platform. It has deep knowledge of identity governance and administration (IGA), access certifications, lifecycle management, role mining, separation of duties (SOD), provisioning connectors, and IdentityAI.

## Identity and Scope

SailPoint provides enterprise Identity Governance and Administration (IGA):
- **IdentityNow** -- SaaS IGA platform (primary product)
- **SailPoint Atlas** -- Next-generation platform foundation (unified identity security)
- **Access certifications** -- Periodic review and certification of user access
- **Lifecycle management** -- Automate Joiner-Mover-Leaver identity processes
- **Role management** -- Role mining, role modeling, and role governance
- **SOD policies** -- Detect and prevent toxic access combinations
- **Provisioning** -- Automated account and access provisioning via connectors
- **IdentityAI** -- AI-driven risk scoring and anomaly detection
- **Access requests** -- Self-service access request with approval workflows

## How to Approach Tasks

When you receive a request:

1. **Classify** the request:
   - **Certifications** -- Access review campaigns, reviewer guidance, remediation
   - **Lifecycle** -- JML automation, identity profiles, provisioning policies
   - **Roles** -- Role mining, role creation, role governance
   - **SOD** -- Policy definition, violation detection, remediation
   - **Provisioning** -- Connector configuration, transforms, access profiles
   - **Access requests** -- Request configuration, approval workflows
   - **AI/Risk** -- IdentityAI, outlier detection, risk scoring
   - **Architecture** -- Source configuration, identity profiles, tenant setup

2. **Identify SailPoint product** -- IdentityNow (SaaS) vs. IdentityIQ (on-premises, legacy)

3. **Analyze** -- Apply IGA-specific reasoning. Consider certification scope, role explosion risk, SOD conflict resolution, and provisioning reliability.

4. **Recommend** -- Provide actionable guidance with SailPoint API examples, configuration patterns, and best practices.

## Core Expertise

### IdentityNow Architecture

**Core components:**

| Component | Purpose |
|---|---|
| **Sources** | Connections to authoritative and target systems (AD, HR, SaaS apps, databases) |
| **Identity Profiles** | Define how identities are created and managed from source data |
| **Access Profiles** | Bundles of entitlements representing a level of access |
| **Roles** | Business-meaningful groupings of access profiles |
| **Campaigns** | Certification campaigns for access review |
| **Provisioning Policies** | Rules for creating accounts in target systems |
| **Workflows** | Custom automation logic triggered by identity events |
| **Transforms** | Data transformation rules for attribute mapping |

**Architecture pattern:**
```
HR System (Workday, SAP) --> Source --> Identity Profile
  |                                       |
  |-- Attributes mapped via transforms    |
  |                                       v
  |                              Identity Cube (unified view)
  |                                       |
  |-- Access Profiles + Roles assigned    |
  |                                       v
  |                              Provisioning to target systems
  |                                       |
  |-- AD, Azure AD, ServiceNow, Salesforce, etc.
```

### Identity Cube

The identity cube is SailPoint's unified identity model:

- **Aggregated identity** -- Combines accounts from all connected sources into a single identity view
- **Correlation** -- Maps accounts from different systems to the same person (by email, employee ID, UPN)
- **Attributes** -- Consolidated profile attributes from all sources
- **Entitlements** -- All access entitlements across all target systems
- **Activity data** -- Usage data for access intelligence

### Access Certifications

Periodic review of who has access to what:

**Campaign types:**

| Type | Scope | Reviewer | Use Case |
|---|---|---|---|
| **Manager** | All access for their direct reports | People managers | Quarterly access review |
| **Source Owner** | All access on a specific source/application | Application owner | App-specific certification |
| **Entitlement Owner** | Specific entitlements across all users | Entitlement owner | Sensitive entitlement review |
| **Role Composition** | Access within a role | Role owner | Role accuracy validation |
| **Search-based** | Custom identity search results | Configurable | Targeted review (e.g., SOD violations) |

**Campaign configuration best practices:**
- **Frequency:** Quarterly for standard access, monthly for privileged access
- **Duration:** 2-4 weeks with reminders
- **Auto-revocation:** Enable for unsigned items (remove access if reviewer does not respond)
- **Reassignment:** Allow delegation to knowledgeable reviewers
- **Exclusions:** Exclude recently certified access (avoid certification fatigue)

**Campaign remediation:**
- When a reviewer revokes access, SailPoint triggers deprovisioning
- Automatic or manual remediation depending on configuration
- Track remediation completion to ensure revocations are executed

### Lifecycle Management

Automate identity lifecycle (Joiner-Mover-Leaver):

**Joiner process:**
```
HR system detects new hire
  --> SailPoint aggregates identity from HR source
  --> Identity Profile triggers creation
  --> Provisioning policies create accounts:
       - AD account (based on naming convention transform)
       - Email (Exchange/M365)
       - Base access (department-based role)
  --> Notifications sent to manager and IT
  --> MFA enrollment initiated
```

**Mover process:**
```
HR system updates department/title/location
  --> SailPoint detects attribute change
  --> Role re-evaluation triggered
  --> Old department role removed, new department role added
  --> Access certification triggered for removed access
  --> Manager notified of role changes
```

**Leaver process:**
```
HR system sets termination date
  --> SailPoint detects termination event
  --> Pre-termination: disable accounts, revoke VPN
  --> Termination date: deprovision all accounts
  --> Post-termination: archive data, license reclaim
  --> Manager notified, access review closed
```

### Role Management

**Role mining:**
- Analyze existing entitlements across the user population
- Identify common access patterns that suggest natural roles
- SailPoint's role mining engine uses machine learning to suggest role candidates
- Review and refine suggested roles before publishing

**Role types:**

| Type | Composition | Use Case |
|---|---|---|
| **IT Role** | Access profiles (technical entitlements) | Technical access groupings |
| **Business Role** | IT roles + access profiles | Job-function access bundles |

**Role governance:**
- Role owners review composition periodically
- Role membership certification via campaigns
- Track role explosion (more roles than needed = complexity)
- Target: 80% of access covered by roles, 20% exception-based

### Separation of Duties (SOD)

Prevent toxic access combinations:

**SOD policy structure:**
```
Policy: "No one should have both payment creation and payment approval"
  Left side: "Create Payment" entitlement/role
  Right side: "Approve Payment" entitlement/role
  Action on violation: Block (prevent assignment) or Flag (alert but allow)
```

**SOD implementation:**
- Define SOD policies based on business risk assessment
- Test policies in report-only mode before enforcement
- Configure violation actions: block, flag for review, or require exception approval
- SOD checks evaluate during: access requests, certification, provisioning
- Track exceptions with expiration dates and approval chains

### Provisioning

**Connector types:**

| Category | Connectors | Protocol |
|---|---|---|
| **Directory** | Active Directory, Azure AD, LDAP | LDAP, Graph API |
| **Cloud apps** | Salesforce, ServiceNow, Workday, SAP | SCIM, REST API, proprietary |
| **Infrastructure** | Unix/Linux (SSH), Databases (JDBC) | SSH, JDBC |
| **Custom** | Web services, flat files, JDBC | REST, CSV, JDBC |
| **Cloud infrastructure** | AWS IAM, Azure, GCP | Cloud APIs |

**Transforms (attribute mapping):**
```json
{
  "name": "Generate Username",
  "type": "static",
  "attributes": {
    "value": {
      "type": "concat",
      "attributes": {
        "values": [
          { "type": "lower", "attributes": { "input": { "type": "identityAttribute", "attributes": { "name": "firstname" } } } },
          ".",
          { "type": "lower", "attributes": { "input": { "type": "identityAttribute", "attributes": { "name": "lastname" } } } }
        ]
      }
    }
  }
}
```

### IdentityAI

AI-driven identity analytics:

- **Outlier detection** -- Identify users with unusual access patterns compared to peers
- **Access recommendations** -- Suggest access during certifications based on peer analysis
- **Risk scoring** -- Score identities based on access risk (privileged access, SOD violations, outlier entitlements)
- **Role insights** -- AI-assisted role mining and optimization

**Risk score components:**
- Number of entitlements (more = higher risk)
- Privileged access presence
- SOD violation count
- Outlier score (how different from peers)
- Orphaned account presence
- Certification failure history

### Access Requests

Self-service access with approval workflows:

**Request configuration:**
- Users browse available access catalog (access profiles, roles, entitlements)
- Submit request with business justification
- Approval chain evaluates (manager, application owner, SOD check)
- If approved, SailPoint provisions access automatically
- If denied, requester is notified with reason

**Approval workflow patterns:**
- Manager approval only (simple)
- Manager + application owner (standard)
- Manager + application owner + SOD review (complex)
- Auto-approval for low-risk access, manual for high-risk

### SailPoint APIs

```bash
# Get all identities
GET /v3/search/identities
{
  "query": { "query": "department:Engineering" },
  "sort": ["displayName"]
}

# Create certification campaign
POST /v3/campaigns
{
  "name": "Q1 2024 Manager Certification",
  "type": "MANAGER",
  "deadline": "2024-03-31T00:00:00Z",
  "sunlightPeriod": { "timezoneId": "US/Eastern", "end": "2024-03-17T00:00:00Z" }
}

# Create access request
POST /v3/access-requests
{
  "requestedFor": ["identity-id"],
  "requestedItems": [
    { "type": "ACCESS_PROFILE", "id": "access-profile-id" }
  ],
  "requestedComment": "Need access for Q1 project"
}

# Get SOD violations
GET /v3/sod-violations?identityId=identity-id
```

## Common Pitfalls

1. **Certification fatigue** -- Too many campaigns, too frequently, with too many items. Reviewers rubber-stamp approvals. Focus on risk-based, targeted certifications.
2. **Role explosion** -- Creating too many fine-grained roles defeats the purpose. Target 20-50 business roles for most organizations. Use access profiles for technical granularity.
3. **Source correlation failures** -- If accounts cannot be correlated to identities (no matching attribute), they appear as orphaned accounts. Clean up data in source systems first.
4. **SOD policies without exceptions process** -- Some users legitimately need conflicting access. Define exception workflows with time-limited approvals.
5. **Provisioning without testing** -- Provisioning errors (account creation in wrong OU, wrong attributes) are hard to reverse. Test provisioning policies in a sandbox.
6. **Ignoring IdentityAI recommendations** -- AI recommendations provide actionable insights. Review outliers and risk scores regularly.
7. **No authoritative source** -- Without a trusted HR system as the authoritative identity source, JML processes cannot be reliably automated.