IdentityIQ-Associate Questions and Answers

Yes. In SailPoint IdentityIQ, correlation logic can be specified for authoritative applications. An authoritative application is commonly used as a trusted source for identity data, such as HR or another system of record. During aggregation, IdentityIQ reads account or source records from the application and uses correlation logic to determine whether each record should be linked to an existing IdentityCube or used in identity creation and update processing.

Correlation logic may be configured using account attributes, identity attributes, or correlation rules. For example, an authoritative source may correlate records by employee ID, user name, email address, or another unique identifier. This ensures that incoming authoritative data updates the correct identity instead of creating duplicates or leaving records uncorrelated.

The authoritative nature of the application does not eliminate the need for correlation. It defines the trust level and identity-data role of the source, while correlation defines how records from that source are matched to identities in IdentityIQ.

Reference topics: Applications, authoritative applications, correlation options, account aggregation, IdentityCube creation, identity attribute mapping, and uncorrelated account resolution.

Yes. In SailPoint IdentityIQ, the Identity Warehouse is used to review identity-centric information stored in the IdentityCube. For identities that are managers, IdentityIQ can display the list of identities that report to that manager. This information is derived from the manager relationship established during identity aggregation, correlation, and identity refresh processing.

The direct-report relationship is not an application account attribute by itself once modeled in IdentityIQ; it becomes part of the identity model. IdentityIQ uses manager correlation to associate each identity with its manager, and when those relationships are resolved, the manager identity can show its subordinate identities as direct reports. This is important for governance because managers are frequently used as certifiers, approvers, and reviewers in access review and request workflows.

The display of direct reports depends on the identity data being populated correctly and the viewer having permission to access the identity details. However, as a functional capability of the Identity Warehouse, direct reports for manager identities are part of the identity information that can be displayed.

Reference topics: Identity Modeling, IdentityCube contents, manager correlation, Identity Warehouse, identity refresh, and governance reviewer relationships.

The statement is false. The Edit Identity QuickLink is not intended merely to view identity details; its purpose is to initiate an identity modification request. In IdentityIQ, QuickLinks are request-entry mechanisms that expose controlled actions to users based on QuickLink Population rules, capabilities, request configuration, and target permissions. The Edit Identity QuickLink allows an authorized user to update configured identity attributes, typically through a form-driven request process that may include validation, approval, audit tracking, and workflow execution.

Viewing identity details is a separate functional concept. Identity information is normally reviewed through identity search, identity warehouse views, certification access review context, or identity detail pages, where the user can inspect IdentityCube data such as attributes, accounts, roles, entitlements, manager, and policy violations. Edit Identity may display current values so the requester understands what is being changed, but display is contextual, not the primary function.

Therefore, “It is used to view details about an identity” describes a view-oriented function, not the Edit Identity QuickLink. Reference topics: User-Driven Requests, QuickLink Populations, create/edit/self-service identity requests, Identity Modeling, and IdentityCube usage.

No. BeanShell rules are not required to implement aggregation in SailPoint IdentityIQ. Aggregation is a standard IdentityIQ function performed through an application definition, connector configuration, schema definition, correlation settings, and aggregation task execution. Many common connectors can aggregate accounts and groups without any custom rule because the connector and schema configuration provide the required instructions for reading objects from the source system.

Rules are used when additional customization is needed. For example, an aggregation rule may transform incoming attribute values, filter records, normalize data, customize correlation behavior, or handle source-specific logic that cannot be expressed through standard configuration. However, this makes rules optional extension points, not mandatory components of aggregation.

A properly configured application can aggregate accounts using its connector settings, account schema, group schema, and aggregation task options alone. Rules should be introduced only when the standard connector behavior and configuration do not satisfy the implementation requirements.

Reference topics: Applications, aggregation tasks, connector configuration, account schema, group schema, correlation options, application rules, connector rules, and IdentityIQ extensibility through BeanShell rules.

No. In IdentityIQ, a birthright role is intended to represent access that is automatically assigned to identities based on defined business criteria, such as lifecycle state, department, location, job function, or other identity attributes. The purpose of a birthright role is automatic access assignment, not user-driven request selection. Rapid Setup can help configure common access-modeling and application-onboarding elements more efficiently, including birthright access patterns, but the birthright concept remains assignment-based rather than request-based.

Requestable access is handled through the access request model, where users select roles, entitlements, or other access items made available through request configuration and QuickLinks. Birthright access is different because it is granted when an identity satisfies the role assignment criteria and is recalculated through identity refresh and role evaluation. Making birthright roles requestable would undermine their purpose as standard baseline access automatically derived from identity data.

Therefore, the statement is inaccurate. Rapid Setup birthright roles are used for automated assignment and baseline access, not as requestable access items. Reference topics: Applications, Rapid Setup, Access Modeling, birthright roles, role assignment, identity refresh, and User-Driven Requests.

No. QuickLink Populations do not control which capabilities are granted to an identity. In SailPoint IdentityIQ, capabilities are administrative permission sets assigned to identities to determine what system-level functions they can perform, such as administration, certification management, report access, or other privileged IdentityIQ operations. Capabilities are part of the identity’s authorization model and are managed separately from QuickLink Population configuration.

QuickLink Populations serve a different purpose. They determine which QuickLinks are visible and usable for a defined population of users, and they can also influence request behavior such as who may perform a request, what actions are available, and for whom the request may be submitted. For example, a QuickLink Population may allow certain users to request access for themselves, request access for others, edit identities, or initiate password-related actions, depending on configuration.

Therefore, QuickLink Populations control access to request actions and QuickLink availability, not the granting of IdentityIQ capabilities themselves. Reference topics: User-Driven Requests, QuickLink Populations, identity authorization, capabilities, access request configuration, and self-service request controls.

The statement is false. In SailPoint IdentityIQ, connectivity settings are determined by the connector selected for the application definition. An application represents an authoritative source, target system, or managed resource, and the connector defines how IdentityIQ communicates with that system. Because different connectors use different communication models, their required configuration fields are not universal.

For example, an LDAP or Active Directory connector commonly requires server connection details such as host, port, credentials, and search base configuration. A JDBC-based connector may require a JDBC URL, driver class, database credentials, and SQL-related configuration. A delimited file connector does not require a hostname because it reads account and entitlement data from a file location rather than connecting to a network service. Similarly, cloud or API-based connectors may require endpoint URLs, tokens, client credentials, or tenant-specific settings instead of a simple hostname field.

Therefore, hostname cannot be considered a required connectivity setting for every connector type. Required settings are connector-dependent and appear according to the selected connector’s configuration model. Reference topics: Applications, connector selection, application definition, connector-dependent settings, schema configuration, and aggregation prerequisites.

Yes. In SailPoint IdentityIQ, some application connectors include predefined schema information because the structure of accounts and groups on those target systems is well known to the connector. When an application is created and a specific connector type is selected, IdentityIQ may automatically populate schema elements such as the account schema, native identity attribute, display attribute, common account attributes, and sometimes group or entitlement schema definitions. This is common for standard connectors where the managed system has a predictable object model.

However, predefined does not mean final or immutable. The application administrator must still review and adjust the schema to ensure it accurately represents the implementation, including which attributes are aggregated, which attributes are searchable, which attributes are entitlements, and which attributes are used for identity correlation. Other connector types, such as generic JDBC, delimited file, or custom connectors, may require more manual schema definition.

This statement is therefore accurate because connector selection can provide default schema structure. Reference topics: Applications, connector selection, account schema, group schema, schema attributes, aggregation configuration, and application definition.

Yes. In SailPoint IdentityIQ, the Identity Warehouse presents identity-centered information collected and modeled inside the IdentityCube. Entitlements are part of that identity view because they represent the user’s permissions or access rights on connected applications. During aggregation, IdentityIQ reads account data from applications, including entitlement-bearing attributes such as groups, roles, permissions, or other managed access values. These are stored on the identity’s application accounts and surfaced in the Identity Warehouse so reviewers, administrators, and governance users can understand what access the identity currently has.

This is distinct from identity attributes such as department, manager, location, or lifecycle state. Entitlements describe access on target systems and are central to access reviews, policy evaluation, role modeling, and access request decisions. Displaying entitlements in the Identity Warehouse allows IdentityIQ to provide a complete access profile for the identity, including accounts, assigned roles, detected roles, policy violations, and application permissions.

Therefore, entitlements are displayed as part of the Identity Warehouse identity details. Reference topics: Identity Modeling, IdentityCube contents, Identity Warehouse, application accounts, entitlement aggregation, managed attributes, and access visibility.

The statement is false. The Identity Refresh task is used to update and recalculate identity-related data in IdentityIQ, not to manage open work item reminders. Its purpose is to refresh IdentityCubes after aggregation or identity data changes. Depending on selected task options, Identity Refresh can recalculate identity attributes, apply correlation-related updates, refresh role assignments and detections, evaluate policies, process lifecycle events, update risk-related data, and ensure that the identity model reflects the current state of authoritative and application data.

Open work items belong to IdentityIQ’s workflow and governance execution layer. Reminders, escalations, expirations, and related work item follow-up behavior are handled through work item configuration, workflow behavior, certification configuration, and maintenance-style processing rather than the Identity Refresh task. Although Identity Refresh may trigger downstream actions such as lifecycle events or policy evaluation, it is not the task responsible for notifying users about pending approvals or review items.

Therefore, sending reminders for open work items is outside the purpose of Identity Refresh. Reference topics: Identity Modeling — common Identity Refresh options; Foundational Concepts — tasks versus workflows; Governance — work items, certifications, reminders, and escalation behavior.

Yes. Rapid Setup in SailPoint IdentityIQ is designed to accelerate application onboarding by creating and configuring the application definitions required for IdentityIQ to manage data from connected systems. An application definition is the IdentityIQ object that represents an external source or target system and stores the connector selection, connectivity settings, schema information, aggregation behavior, correlation configuration, and related governance options.

Rapid Setup reduces the amount of manual configuration normally required when defining applications. Instead of building every application definition entirely through the standard detailed configuration screens, Rapid Setup guides the administrator through a simplified setup path and creates the required IdentityIQ application objects from that configuration. Those application definitions can then be used for aggregation, correlation, entitlement discovery, access modeling, and downstream governance processes.

This does not mean Rapid Setup eliminates the need for validation. Administrators must still verify schemas, correlation rules, entitlement treatment, and provisioning behavior. However, the statement is accurate because creating application definitions is a core function of Rapid Setup.

Reference topics: Applications, Rapid Setup, application definitions, connector configuration, schema configuration, aggregation, correlation, and entitlement discovery.

No. An Identity Cube is not an IdentityIQ account. In SailPoint IdentityIQ, the Identity Cube is the central identity record that represents a person or identity being governed by the platform. It consolidates identity attributes, correlated application accounts, account links, entitlements, assigned roles, detected roles, manager relationship, lifecycle state, policy violations, and other governance-relevant information.

An “IdentityIQ account” usually refers to a login account or user object that allows someone to access the IdentityIQ application itself. That is different from the Identity Cube, which is used to model the user’s enterprise identity and access across connected systems. For example, one Identity Cube may contain links to multiple accounts such as Active Directory, Workday, ServiceNow, database accounts, and cloud application accounts.

Therefore, the proposed definition is inaccurate because it confuses an application login account with the broader identity model used for governance. Reference topics: Identity Modeling, IdentityCube contents, identity attributes, application account links, entitlements, roles, manager correlation, and Identity Warehouse.

Yes. In SailPoint IdentityIQ, BeanShell rules used during aggregation are optional processing extensions, and task configuration can control whether rule processing is applied for a particular aggregation run. Aggregation itself is performed through the application definition, connector, schema, and aggregation task. Rules may be added to customize behavior, such as transforming incoming account data, applying custom correlation logic, handling identity creation, or modifying account information before it is stored.

Because rules can significantly affect aggregation behavior, IdentityIQ provides task-level controls that allow administrators to disable rule processing when appropriate. This can be useful for testing connector behavior, isolating troubleshooting scenarios, improving performance during certain runs, or validating source data without custom transformation logic. When rule processing is disabled, aggregation relies on standard connector and configuration behavior rather than custom BeanShell execution.

Therefore, the statement is accurate. Rule execution is not mandatory for aggregation and can be controlled from the task definition. Reference topics: Applications, aggregation tasks, BeanShell rules, connector configuration, account schema, correlation rules, creation rules, and aggregation task options.

This is not a standard example of a policy that can be defined in IdentityIQ. IdentityIQ policies are governance controls used to detect inappropriate access, risky access combinations, account conditions, identity conditions, or activity-related violations based on configured policy logic. Common policy examples include separation of duties policies, account policies, identity policies, risk policies, and activity policies. These policies evaluate identities, accounts, roles, entitlements, attributes, and access relationships to determine whether a violation exists.

The wording “administrator policy” is not a standard IdentityIQ policy category. IdentityIQ can audit administrative activity and can secure administrative functions through capabilities, scopes, workgroups, permissions, and object-level controls, but that is different from defining an “administrator policy” as a governance policy type. Risky actions performed within IdentityIQ itself are generally handled through audit events, administrative security configuration, logging, and operational monitoring rather than a standard policy definition named administrator policy.

Therefore, this statement does not describe a valid common IdentityIQ policy example. Reference topics: Governance — examples of common policies, policy detection, policy violations; Foundational Concepts — common objects and components; Identity Modeling — IdentityCube attributes and access context.

No. QuickLink Populations do not determine which identities can approve access requests. In SailPoint IdentityIQ, QuickLink Populations control the availability and scope of QuickLinks for users. They define who can initiate a specific request action, what type of request can be launched, and in many cases who the request can be submitted for. For example, they may allow an employee to request access for themselves or allow a manager to request access for direct reports.

Approval authority is handled separately through request workflows, approval schemes, approval rules, work item assignment logic, application or role owners, managers, governance groups, or configured business processes. When an access request is submitted, IdentityIQ evaluates the configured approval path to determine which identities receive approval work items. That approval routing is not controlled by the QuickLink Population itself.

Therefore, the statement is inaccurate. QuickLink Populations govern request initiation and visibility, while approval routing is governed by workflow and approval configuration. Reference topics: User-Driven Requests, QuickLink Populations, access request process, approval workflows, work items, and request authorization.

No. In SailPoint IdentityIQ, tasks are used to execute defined system operations, often as background or scheduled processes. Common task usage includes account aggregation, identity refresh, entitlement aggregation, maintenance activities, report execution, role processing, and other repeatable administrative operations. A task may calculate, update, import, refresh, or process data, but it does not itself perform the governance decision of confirming whether access in a role is correct.

Confirming that the correct access is included in a role is a governance review function, most closely associated with role certification, especially role composition certification. In that process, a role owner or designated certifier reviews the access profiles, entitlements, permissions, or requirements contained in a role and decides whether they are appropriate. The confirmation requires business judgment and reviewer action, not merely task execution.

A task may support role governance indirectly by refreshing role data or generating background processing, but the validation of role contents belongs to certifications and access governance. Therefore, this statement is not accurate for the use of tasks. Reference topics: Foundational Concepts, tasks versus workflows, Governance, role composition certification, Access Modeling, and role governance.