SailPoint IdentityIQ Interview Preparation Guide | Wiseman CyberSec
Knowing what Identity Governance and Administration (IGA) means is one thing.
Troubleshooting a failed provisioning request, investigating an orphan account, or explaining why revoked access still exists in Active Directory is another.
For professionals pursuing SailPoint IdentityIQ administration roles, interviews often extend beyond definitions into how the platform behaves in enterprise environments.
This guide covers 15 practical SailPoint IdentityIQ interview questions, including troubleshooting scenarios, sample answers, and the reasoning behind them.
The scenarios below are illustrative examples, not actual client incidents. Exact configurations and available features depend on the organization’s IdentityIQ deployment.
1. What is SailPoint IdentityIQ, and how does it differ from Active Directory?
Interview scenario: An organization uses Active Directory to manage employee accounts. Why would it need SailPoint IdentityIQ?
Suggested answer:
Active Directory primarily provides directory services, authentication-related capabilities, and centralized management of directory identities and resources.
SailPoint IdentityIQ is an identity governance platform that provides visibility and governance across multiple connected systems.
It can help organizations manage identity lifecycles, access requests, certifications, provisioning, and policy violations.
Practical example: An employee may have accounts in Active Directory, SAP, a database, and several business applications. IdentityIQ can correlate those accounts to a central identity and support governance across the connected applications.
Interview takeaway: Explain the difference between managing directory accounts and governing enterprise-wide access.
2. What is Account Aggregation in IdentityIQ?
Interview scenario: A new application has been connected, but its users and entitlements are not appearing in IdentityIQ.
Suggested answer:
Account Aggregation collects account information from a connected application and brings that information into IdentityIQ.
The administrator should investigate the application configuration, connector connectivity, aggregation task results, account schema, and any relevant filtering or errors.
Practical approach:
- Verify the application connection.
- Check the configured account schema.
- Run or review the Account Aggregation task.
- Examine task results and relevant logs.
- Confirm whether the accounts and entitlements were imported correctly.
Interview takeaway: A successful connection test doesn’t necessarily mean account aggregation has completed successfully.
3. What is Identity Correlation?
Interview scenario: One employee has an Active Directory account and an SAP account, but IdentityIQ shows them as separate identities.
Suggested answer:
Identity Correlation associates accounts from connected applications with the correct identity in IdentityIQ.
A correlation problem may occur because of missing attributes, mismatched employee identifiers, or incorrectly configured correlation logic.
Practical approach: Check the identity and account attributes used for correlation, such as employee ID or another reliable enterprise identifier. Review the correlation configuration and inspect the affected account records.
Interview takeaway: Poor correlation can produce fragmented identity records, misleading access visibility, and governance gaps.
4. What is an Identity Cube?
Interview scenario: An administrator successfully changes access in a target application, but the updated entitlement does not appear in the user’s IdentityIQ profile.
Suggested answer:
An Identity Cube represents an identity and its associated information within IdentityIQ, including relevant account, entitlement, role, and identity data.
Provisioning and identity data refresh are related but distinct processes.
Depending on the connector and provisioning method, the administrator may need to reaggregate account data and perform an Identity Refresh before the Identity Cube reflects the latest access.
Interview takeaway: A completed provisioning action doesn’t always mean every governance view has been updated.
5. What is the difference between Account Aggregation and Identity Refresh?
This is an important question for an IdentityIQ administration interview.
| Account Aggregation | Identity Refresh |
| Retrieves account information from connected systems | Recalculates and updates identity information within IdentityIQ |
| Helps discover accounts and access information | Updates relevant identity attributes, role information, and governance calculations |
| Focuses on data collected from source applications | Focuses on processing identity data already available within IdentityIQ |
Real-world scenario: An administrator removes an entitlement directly in a target application, but IdentityIQ still displays the older access.
The administrator should check whether updated account data has been aggregated and whether an Identity Refresh is needed.
Interview takeaway: Aggregation collects source data; Identity Refresh processes identity information. They are not interchangeable.
6. How would you troubleshoot a failed provisioning request?
Interview scenario: An employee requests access to an application. The manager approves the request, but the account is not created.
Suggested answer:
Approval confirms an authorization decision. It doesn’t prove that provisioning was executed successfully.
Troubleshooting approach:
- Review the access request status and workflow history.
- Confirm approvals have completed.
- Inspect the provisioning plan and project status.
- Check connector configuration and application connectivity.
- Review relevant errors, task results, and logs.
- Verify whether the target system processed the change.
- Reaggregate and refresh identity data when required.
Interview takeaway: Always identify where the request failed rather than assuming that approval and provisioning are the same operation.
7. What is the Joiner-Mover-Leaver (JML) process?
Interview scenario: An employee transfers from Finance to Human Resources but retains access to finance applications.
Suggested answer:
JML refers to identity lifecycle processes:
- Joiner: Provide appropriate access when a person joins.
- Mover: Update access when their position or responsibilities change.
- Leaver: Remove or disable access when they leave.
In IdentityIQ, lifecycle events and workflows can support these processes when properly configured.
Practical approach: Review the changed identity attributes, configured lifecycle-event triggers, role assignments, provisioning requests, and target-system access.
Interview takeaway: A role change should not simply add new access. It should also trigger appropriate review and removal of access no longer needed.
8. What are Access Certifications in SailPoint IdentityIQ?
Interview scenario: During an access review, a manager discovers that a former team member still has access to a sensitive financial application.
Suggested answer:
Access Certifications allow designated reviewers to evaluate whether users should retain particular access.
A reviewer can make access decisions according to the configured certification process, including identifying access that should be revoked.
Important distinction: A revocation decision is not the same as confirmed removal from the target application.
Administrators may need to track the remediation action, validate provisioning, and confirm the access was removed.
Interview takeaway: Effective access governance requires evidence that remediation was completed, not only that a review was signed off.
9. What is a Segregation of Duties (SoD) violation?
Interview scenario: A finance employee can both create a vendor and approve payments to that vendor.
Suggested answer:
Segregation of Duties aims to prevent inappropriate combinations of privileges that could enable fraud, errors, or unauthorized activity.
IdentityIQ policies can identify access combinations that violate an organization’s defined requirements.
Practical approach: Review the policy definition, relevant entitlements or roles, impacted identities, and the organization’s exception or remediation procedure.
Interview takeaway: A policy violation requires evaluation and a documented response; not every flagged combination automatically proves fraud or misuse.
10. What is the difference between Roles and Entitlements?
Interview scenario: A newly hired employee requires access to several applications associated with their department.
Suggested answer:
An entitlement typically represents a specific permission, group membership, or access right in a connected system.
A role groups access according to a defined business or technical purpose.
For example, a Finance Analyst role may be designed to include access associated with several business applications.
Interview takeaway: Roles help organize and govern access at scale, while entitlements represent more granular permissions.
11. An employee has left, but access still exists. What would you investigate?
Suggested answer:
First, confirm that the employee’s departure was recorded correctly in the authoritative identity source.
Then investigate whether the relevant identity attributes were updated, whether the leaver lifecycle event was triggered, and whether the expected deprovisioning workflow executed.
Check the provisioning status, connector behavior, and actual account state in each target application.
Also investigate standalone or uncorrelated accounts that might not be covered by the expected lifecycle process.
Interview takeaway: A disabled account in one directory does not guarantee enterprise-wide access removal.
12. Why might an IdentityIQ workflow fail?
Suggested answer:
Possible causes include:
- Incorrect or missing input attributes.
- Errors in workflow configuration.
- Missing approvals or unresolved work items.
- Connector or target-system failures.
- Problems in custom rules or scripts.
- Unexpected identity or application data.
The administrator should review the workflow case, relevant execution history, available logs, and the failing step before deciding on remediation.
Interview takeaway: Explain how you isolate the failing component rather than immediately restarting the workflow.
13. What is the difference between an IdentityIQ Rule and a Workflow?
Suggested answer:
A rule is a configurable unit of logic used for particular processing or customization activities.
A workflow, also called a business process, organizes a sequence of actions, decisions, approvals, and other processing steps.
Practical example: A provisioning workflow may call a rule to calculate or validate an attribute value before continuing.
Interview takeaway: Rules execute specific logic; workflows coordinate a broader process.
14. How would you investigate duplicate identities or incorrectly correlated accounts?
Suggested answer:
Start by identifying the affected identities and their source accounts.
Review the authoritative identity data, matching attributes, correlation rules, and relevant aggregation results.
Determine whether the problem is caused by duplicate source records, inconsistent identifiers, or correlation logic.
Before correcting the issue, assess the effect on account ownership, access history, certifications, and downstream provisioning.
Interview takeaway: Never merge or reassign identities without understanding the impact on governance records and access.
15. An access request shows Completed, but the user still cannot access the application. What next?
Suggested answer:
A completed IdentityIQ request doesn’t necessarily prove successful end-user access.
I would verify:
- Whether the requested account or entitlement exists in the target application.
- Whether provisioning completed successfully or requires additional manual action.
- Whether updated target-system data has been aggregated.
- Whether the Identity Cube reflects the intended access.
- Whether the application’s authentication, authorization, or local configuration is preventing access.
Interview takeaway: Identity governance, provisioning, authentication, and application authorization are related—but separate—layers.
How to Answer Scenario-Based SailPoint Interview Questions
Interviewers are often assessing your troubleshooting method, not simply your ability to recall product terminology.
Use this five-step approach:
1. Identify the failure. What should have happened, and what actually happened?
2. Locate the stage. Is the problem in aggregation, correlation, identity processing, workflow, provisioning, or the target application?
3. Gather evidence. Review task results, workflow history, logs, identity records, and target-system state.
4. Recommend a controlled fix. Explain the likely corrective action and its potential impact.
5. Verify the outcome. Confirm the intended access state in the connected application and relevant IdentityIQ governance records.
This approach helps demonstrate practical understanding instead of memorized answers.
Final Thoughts
SailPoint IdentityIQ administration is not simply about granting and removing access.
It involves understanding how identity information moves between systems, how governance decisions are applied, and how to investigate failures across an enterprise identity lifecycle.
For interview preparation, focus on explaining not only what a feature does, but also how you would verify that it works.That distinction can make your answers more useful, credible, and technically convincing.
