SailPoint IdentityNow Enterprise Implementation Guide

Overview

SailPoint IdentityNow, now commonly positioned within SailPoint Identity Security Cloud, is a cloud-native identity governance and administration platform built to manage joiner-mover-leaver processes, access requests, certifications, and compliance reporting at enterprise scale. Organizations use it to reduce manual provisioning, improve auditability, and enforce least privilege across HR systems, directories, SaaS platforms, and critical business applications.

IdentityNow is especially effective in hybrid environments where identities originate in systems such as Workday or SAP SuccessFactors and must be correlated to Active Directory, Azure AD, ServiceNow, Salesforce, and other enterprise applications. Its value comes from policy-driven automation, connector-based integration, and governance workflows that support compliance frameworks such as SOX, ISO 27001, and GDPR.

Architecture

IdentityNow uses a SaaS control plane hosted by SailPoint and optional on-premises components for private network connectivity. Core components include:

• Identity Security Cloud tenant for governance, workflows, policies, access reviews, and reporting
• Virtual Appliance (VA) deployed in customer data centers or IaaS to broker connectivity to on-premises sources
• Sources and connectors for HR, directories, databases, and SaaS targets
• Identity profiles to correlate accounts into a single enterprise identity
• Provisioning engine for account creation, modification, and deprovisioning
• Access modeling for roles, entitlements, and birthright access

Typical data flow:

1. HR source imports authoritative identity records.
2. IdentityNow correlates accounts from AD, Azure AD, and business apps.
3. Identity profiles apply transforms and lifecycle states.
4. Policies trigger provisioning, certification, or revocation actions.
5. VA securely relays traffic to internal systems over outbound connections.

Deployment is primarily SaaS, with the VA used for hybrid integration. This reduces infrastructure overhead while preserving access to internal directories and applications.

Implementation Guide

A practical rollout usually starts with one authoritative source, one directory, and two to three business applications.

1. Install SailPoint CLI for tenant administration.

curl -L https://github.com/sailpoint-oss/sailpoint-cli/releases/latest/download/sailpoint-cli_$(uname -s)_$(uname -m).tar.gz -o sailpoint-cli.tar.gz
tar -xzf sailpoint-cli.tar.gz
sudo mv sail /usr/local/bin/sail
sail version

1. Authenticate to the tenant.

export SAIL_CLIENT_ID="<client-id>"
export SAIL_CLIENT_SECRET="<client-secret>"
export SAIL_TENANT="acme-demo"
sail auth login --tenant $SAIL_TENANT --client-id $SAIL_CLIENT_ID --client-secret $SAIL_CLIENT_SECRET

1. Export and manage configuration as code.

mkdir idn-config && cd idn-config
sail config export --output ./tenant-export

1. Deploy a Virtual Appliance in a segmented management network with outbound HTTPS only. Validate DNS resolution, NTP sync, and firewall rules to SailPoint endpoints.
2. Create sources for Workday, Active Directory, and Azure AD. Configure aggregation schedules and correlation rules.
3. Define identity profiles and transforms for username generation, department normalization, and lifecycle state mapping.
4. Enable provisioning policies for joiner, mover, and leaver events.
5. Run initial aggregations and review unmatched accounts before enabling automated provisioning.

Example source deployment file:

sources:
  - name: Workday-HR
    type: Workday
    authoritative: true
    aggregation:
      schedule: "0 */4 * * *"
  - name: Corp-AD
    type: Active Directory
    provisioningEnabled: true
    useVA: true
identityProfile:
  name: Workforce
  authoritativeSource: Workday-HR
  transforms:
    - name: email
      type: concat
      attributes: ["firstName", ".", "lastName", "@example.com"]

Code Examples

Example 1: Export tenant objects

sail beta sp-config export --include sources,identity-profiles,transforms --output ./export

Example 2: Identity profile snippet

{
  "name": "Workforce",
  "authoritativeSource": {"name": "Workday-HR"},
  "identityAttributeConfig": {
    "enabled": true,
    "attributeTransforms": [
      {"identityAttributeName": "email", "transformDefinition": {"type": "static", "attributes": {"value": "user@example.com"}}}
    ]
  }
}

Example 3: API query with Python

import requests
base = "https://acme-demo.api.identitynow.com"
token = "<oauth-token>"
resp = requests.get(f"{base}/v3/accounts?limit=10", headers={"Authorization": f"Bearer {token}"}, timeout=30)
resp.raise_for_status()
for acct in resp.json():
    print(acct.get("name"), acct.get("sourceId"))

Security Hardening

• Place the Virtual Appliance in a dedicated subnet with restricted outbound access and no inbound internet exposure.
• Enforce OAuth client secret rotation and store secrets in a vault such as HashiCorp Vault or Azure Key Vault.
• Use least-privilege service accounts for AD and application connectors; avoid domain admin permissions.
• Enable MFA and SSO for administrative access to the SailPoint tenant.
• Review source account schemas and mask or suppress sensitive attributes not required for governance.
• Validate encryption in transit with TLS 1.2+ and ensure disk encryption on VA hosts or underlying hypervisors.
• Limit administrative roles using SailPoint delegated administration instead of broad tenant-wide access.

Comparison

Troubleshooting

1. Virtual Appliance connectivity failure

Log sample:

2025-02-14T09:12:44,882Z ERROR [connector-gateway] c.s.va.transport.HttpClient : Connection failed to https://tenant.api.identitynow.com:443
javax.net.ssl.SSLHandshakeException: PKIX path building failed

Fix: Update trusted CA chain on the VA, verify outbound SSL inspection is disabled for SailPoint endpoints, and confirm system time is correct.

2. Aggregation authentication error for Active Directory

Log sample:

2025-02-14T10:03:11,207Z WARN  [ad-connector] c.s.connector.ad.BindOperation : LDAP bind failed for CN=idn-svc,OU=Svc,DC=corp,DC=example,DC=com
LDAPException(resultCode=49 (invalid credentials), diagnosticMessage='80090308: LdapErr: DSID-0C09044E, comment: AcceptSecurityContext error, data 52e')

Fix: Reset the bind account password, update the source configuration, and verify the account is not locked or restricted by logon policy.

3. Provisioning policy transform error

Log sample:

2025-02-14T11:27:55,991Z ERROR [provisioning] c.s.engine.TransformExecutor : Failed to evaluate transform usernameGenerator
java.lang.IllegalArgumentException: Attribute lastName is null

Fix: Add null handling in the transform, enforce required HR attributes upstream, and test identity profile mappings before production enablement.

Best Practices

Do

• Start with authoritative source quality before connector expansion.
• Use configuration export in version control for repeatable deployments.
• Pilot birthright access with one department before enterprise-wide rollout.
• Define access review owners at application and entitlement level.

Don't

• Do not enable automatic provisioning before resolving uncorrelated or duplicate accounts.
• Do not grant connector accounts excessive rights such as Domain Admin.
• Do not overload identity profiles with inconsistent transforms; standardize naming and attribute logic.
• Do not skip quarterly certification tuning; remove noisy entitlements and stale review scopes.