Best practices
Quick answer
The best IdentityIQ deployments favour configuration over code, keep roles clean and owned, promote changes through environments with deployment (not hand edits), keep rules small and null-safe, and schedule aggregation and refresh sensibly. The goal is a system that is auditable and survives upgrades.
Key takeaways
- Configuration first; code only when needed
- Design and own roles; review their contents
- Promote via deployment, never hand-edit production
- Keep rules small, reusable and null-safe
- Schedule aggregation and refresh deliberately
Best practices are the hard-won habits that separate a SailPoint deployment that thrives from one that becomes a fragile, unmaintainable liability. Enterprise teams search for these constantly, because getting the fundamentals right early saves years of pain.
Data and identity
- Treat the authoritative source as sacred, clean HR data drives everything.
- Get correlation right so no accounts are orphaned.
- Always run an identity refresh after aggregation.
Access model
- Model access as business-meaningful roles, not raw entitlements.
- Enrich entitlements as Managed Attributes with owners and descriptions.
- Design for least privilege; automate revocation on mover and leaver.
Governance operations
- Enforce SoD at request time, not just detect after the fact.
- Scope certifications so reviewers make real decisions, not rubber-stamps.
- Automate the leaver process above all, it is the highest-value control.
Engineering discipline
- Keep configuration as XML in source control.
- Keep rules small, null-safe, tested and documented.
- Test every change in a lower environment before production.
- Size and index the database; partition heavy tasks.
Common pitfalls
- Governing raw entitlements instead of roles.
- Rubber-stamped certifications that add no control.
- Untested changes deployed straight to production.
Want to learn this properly?
Our live, instructor-led SailPoint Training covers this hands-on, with real projects and a certification path.
Check your understanding
The default preference should be?
- A. Configuration over code. Configuration first keeps deployments clean and upgradable.
- B. Small, reusable, null-safe. Lean, reusable, null-safe rules avoid performance and bug issues.
- C. Deployment (export/import). Promote through environments; never hand-edit production.
Show answer
A. Configuration over code. Configuration first keeps deployments clean and upgradable.
Configuration over code. Configuration first keeps deployments clean and upgradable.
Changes should reach production via?
- A. Deployment (export/import). Promote through environments; never hand-edit production.
- B. Configuration over code. Configuration first keeps deployments clean and upgradable.
- C. Small, reusable, null-safe. Lean, reusable, null-safe rules avoid performance and bug issues.
Show answer
A. Deployment (export/import). Promote through environments; never hand-edit production.
Deployment (export/import). Promote through environments; never hand-edit production.
Rules should be?
- A. Configuration over code. Configuration first keeps deployments clean and upgradable.
- B. Deployment (export/import). Promote through environments; never hand-edit production.
- C. Small, reusable, null-safe. Lean, reusable, null-safe rules avoid performance and bug issues.
Show answer
C. Small, reusable, null-safe. Lean, reusable, null-safe rules avoid performance and bug issues.
Small, reusable, null-safe. Lean, reusable, null-safe rules avoid performance and bug issues.