Aggregation flow
Quick answer
A scheduled task connects to an application, reads its accounts and entitlements, and loads them into the warehouse, then correlates them to identities.
Key takeaways
- Purpose: load account and entitlement data from a source into the warehouse
- Trigger: A scheduled or manual aggregation task
- Outcome: Accounts and entitlements are stored and correlated to identities
- Where it fits in the SailPoint architecture
The aggregation flow is how account and entitlement data from a source system enters IdentityIQ. It is the inbound half of the platform's data movement, and getting it right is a prerequisite for every governance capability, because you cannot govern access you have not aggregated.
What triggers aggregation
Aggregation runs as a task, either on a schedule (commonly nightly) or on demand. Two kinds matter: account aggregation reads a target application's accounts and entitlements, and identity aggregation reads the authoritative source to create identity cubes.
Step by step
- 1. Task starts. The scheduler launches the aggregation task for a configured application.
- 2. Connector reads. The application's connector authenticates to the target and reads accounts and their entitlements according to the mapped schema.
- 3. Load into the warehouse. Accounts are written as Links, and entitlement values are recorded (and promoted to Managed Attributes where configured).
- 4. Correlation. Each account is matched to the correct identity using the correlation logic, typically a key such as
employeeId, with a fallback. - 5. Optional refresh. An identity refresh then recomputes cubes, roles and policy against the freshly loaded data.
Full versus delta aggregation
A full aggregation reads the entire population every run, simple but expensive at scale. A delta (incremental) aggregation reads only what changed since last time, dramatically cutting load on large sources. Use delta wherever the connector supports it, and run periodic full aggregations to catch anything the delta mechanism misses.
Correlation: the make-or-break step
Aggregation is only useful if accounts correlate to identities. An account that fails to correlate becomes an uncorrelated or orphan account, visible to no owner and outside governance, exactly the risk you are trying to eliminate. Reliable correlation logic, and monitoring for uncorrelated accounts, is essential.
Reading failures
When an aggregation fails or returns wrong data, the task result holds the specific error. The usual causes are connector misconfiguration, a schema mismatch with the target, credential or permission problems, or delta misconfiguration. Running a full aggregation is a good way to rule out delta-specific issues.
Common pitfalls
- Aggregating accounts but never refreshing identities, so roles and policy go stale.
- Weak correlation leaving orphan accounts outside governance.
- Full aggregation on huge sources when delta would be far cheaper.
Want to learn this properly?
Our live, instructor-led SailPoint Training covers this hands-on, with real projects and a certification path.
Check your understanding
What triggers the aggregation flow?
- A. A scheduled or manual aggregation task
- B. Accounts and entitlements are stored and correlated to identities
- C. Inside the IdentityIQ engine, coordinated by tasks, connectors and the provisioning subsystem.
Show answer
A. A scheduled or manual aggregation task
A scheduled or manual aggregation task
What is the outcome of the aggregation flow?
- A. Inside the IdentityIQ engine, coordinated by tasks, connectors and the provisioning subsystem.
- B. Accounts and entitlements are stored and correlated to identities
- C. A scheduled or manual aggregation task
Show answer
B. Accounts and entitlements are stored and correlated to identities
Accounts and entitlements are stored and correlated to identities
Where does this flow run?
- A. A scheduled or manual aggregation task
- B. Accounts and entitlements are stored and correlated to identities
- C. Inside the IdentityIQ engine, coordinated by tasks, connectors and the provisioning subsystem.
Show answer
C. Inside the IdentityIQ engine, coordinated by tasks, connectors and the provisioning subsystem.
Inside the IdentityIQ engine, coordinated by tasks, connectors and the provisioning subsystem.