SailPoint IdentityIQ

Access Governance is a rapidly growing segment within IAM/IAG, centered on access request management, role management, access recertification, and segregation of duties (SoD) enforcement, increasingly enhanced by “Access Intelligence” for analytics-driven risk identification and entitlement analysis. Its purpose is to mitigate access-related risks such as information theft, fraudulent changes, and the subversion of IT systems to enable illegal activity. The broad range of recent incidents across industries underscores the business impact of access failures, including operational disruption, strategic loss (e.g., blueprints), financial fraud in ERP systems, reputational damage from privacy breaches, and exposure of confidential documents.

A complete approach must extend beyond standard users to privileged access (administrators, technical users, system-level accounts, and shared accounts). While privileged users can be governed similarly to standard users, true risk mitigation also requires privilege management capabilities like runtime elevation controls and shared password management—an integration most vendors still lack.

SailPoint, founded in 2005, is positioned as a pioneer with IdentityIQ 7.0, which unifies access governance and identity provisioning in one product. Since 2010, SailPoint strengthened provisioning through acquisition of the former BMC Control-SA team/assets and by expanding connector breadth and depth (including SAP). IdentityIQ supports standalone governance or deployment as a full IAM/IAG stack, and it can integrate with third-party provisioning systems, service request management tools, mobile device management tools, and cloud environments.

Architecturally, IdentityIQ is web-based (J2EE and database backend) with business-oriented, configurable interfaces. Its top layer includes Compliance Manager, Lifecycle Manager, and Identity Intelligence; the Governance Platform provides shared models and services; and the bottom layer delivers provisioning via SailPoint or external engines. Key capabilities include certification campaigns, policy enforcement with preventive checks and remediation, role mining/modeling, risk scoring, workflow automation, APIs (SCIM 2.0), expanded connectors, and integration with SecurityIQ, balanced by limited multi-tenancy.

• Access Governance focuses on access request management, role management, access recertification, and segregation of duties management and enforcement.
• Access Intelligence provides analytical capabilities for identifying access risks and analyzing entitlement status.
• Access-related risks include information theft, fraud via changes to information, and subversion of IT systems to facilitate illegal actions.
• A complete access governance approach is defined as including privileged access such as administrative access, technical users, and system-level accounts.
• SailPoint was founded in 2005 by executives with experience in IAM and the broader IT market.
• Since 2010, SailPoint invested in identity provisioning by acquiring the former BMC Control-SA team/assets and extending IdentityIQ capabilities.
• IdentityIQ integrates access governance and identity provisioning capabilities into a single product.
• IdentityIQ is web-based and uses a J2EE web/application server and a database as backend systems.
• IdentityIQ 7.0 provides an API interface based on SCIM 2.0 and an expanded connector library.
• A stated shortcoming is the lack of multi-tenancy support, alongside a separate cloud solution called IdentityNow.

• “Access Governance has emerged as one of the fastest growing market segments in the broader IAM/IAG market.”
• “Access Governance covers the mechanisms, processes relations and management of access controls in IT systems and thus is about mitigating access-related risks.”
• “The large number of prominent incidents within the last few years proves the need to address these issues – in all industries.”
• “A complete Access Governance approach has to go beyond the ‘standard users’ and to cover privileged access as well.”
• “Complete solutions would require tight integration between both groups of capabilities, to not only identify the risk in Access Governance but mitigate it.”
• “One differentiator for SailPoint is that the IdentityIQ user interfaces are geared towards business users.”
• “SailPoint IdentityIQ now integrates Access Governance and Identity Provisioning capabilities into a single product.”
• “IdentityIQ 7.0 provides a mobile-first user interface that delivers a consistent and unified user experience across all desktops, tablets and smartphones.”
• “One of IdentityIQ’s key features is risk scoring which uses risk metrics to identify the relevant areas for managers to focus on.”
• “Customers can choose to rely on purely manual interconnections… or they can interface directly with target systems through the Provisioning Engine.”