Identity flow
Quick answer
Identity aggregation creates cubes; identity refresh recomputes attributes, roles and policy; lifecycle events react to attribute changes.
Key takeaways
- Purpose: keep each identity cube accurate as source data changes
- Trigger: Identity aggregation or refresh, or attribute changes
- Outcome: Up-to-date cubes with correct attributes, roles and policy state
- Where it fits in the SailPoint architecture
The identity flow is how an identity cube is created, kept current, and updated as source data changes. Where aggregation and provisioning move account data, the identity flow is about maintaining the accurate, consolidated picture of each person that all governance decisions depend on.
What triggers the flow
The identity flow runs on identity aggregation (which creates and updates cubes from the authoritative source) and identity refresh (which recomputes derived data on existing cubes). Attribute changes in the authoritative source are the usual real-world trigger, a hire, a transfer, a title change.
Step by step
- 1. Read the authoritative source. Identity aggregation pulls worker records and their attributes from HR.
- 2. Create or update cubes. A cube is created for each new worker and updated for existing ones.
- 3. Apply attribute mappings. Identity refresh populates identity attributes from mapped source attributes, applying any transformation rules.
- 4. Re-evaluate roles and policy. Role assignment criteria are re-checked, and policies (such as SoD) are evaluated against the current state.
- 5. Fire lifecycle events. Detected attribute changes trigger configured lifecycle events (joiner/mover/leaver), which in turn drive provisioning.
Why the refresh is the heart of it
Aggregation brings raw data in, but it is the identity refresh that turns that data into governance outcomes, correct attributes, correct role assignments, evaluated policy, fired events. This is why "aggregate then refresh" is the standard rhythm, and why skipping the refresh leaves cubes that look updated but whose roles and policy are stale.
Keeping cubes accurate
Cube accuracy depends on three things: a reliable authoritative feed, clean attribute mappings, and a sensible refresh cadence. Weakness in any one produces wrong governance decisions, someone provisioned for the wrong department, a leaver whose access lingers because the termination did not flow through. Monitoring the freshness and completeness of the identity flow is therefore a core operational duty.
Common pitfalls
- Aggregating without refreshing, the single most common cause of stale governance.
- Attribute mappings from non-authoritative sources, producing conflicting data.
- Refresh cadence too slow for the business, so lifecycle events fire late.
Want to learn this properly?
Our live, instructor-led SailPoint Training covers this hands-on, with real projects and a certification path.
Check your understanding
What triggers the identity flow?
- A. Identity aggregation or refresh, or attribute changes
- B. Inside the IdentityIQ engine, coordinated by tasks, connectors and the provisioning subsystem.
- C. Up-to-date cubes with correct attributes, roles and policy state
Show answer
A. Identity aggregation or refresh, or attribute changes
Identity aggregation or refresh, or attribute changes
What is the outcome of the identity flow?
- A. Up-to-date cubes with correct attributes, roles and policy state
- B. Inside the IdentityIQ engine, coordinated by tasks, connectors and the provisioning subsystem.
- C. Identity aggregation or refresh, or attribute changes
Show answer
A. Up-to-date cubes with correct attributes, roles and policy state
Up-to-date cubes with correct attributes, roles and policy state
Where does this flow run?
- A. Identity aggregation or refresh, or attribute changes
- B. Up-to-date cubes with correct attributes, roles and policy state
- C. Inside the IdentityIQ engine, coordinated by tasks, connectors and the provisioning subsystem.
Show answer
C. Inside the IdentityIQ engine, coordinated by tasks, connectors and the provisioning subsystem.
Inside the IdentityIQ engine, coordinated by tasks, connectors and the provisioning subsystem.