Most engineers think…
Most people lump 'identity' into one bucket and assume SailPoint is just another login tool. That mental model fails you in an interview and in an audit.
SailPoint IGA does not authenticate users — that is SSO. It does not broker privileged sessions — that is PAM. IGA is the governance layer: it aggregates every account and entitlement into a central identity model, automates joiner-mover-leaver provisioning, runs access certification campaigns so owners recertify or revoke access, models roles from real usage, and enforces Separation of Duties so no one holds a toxic combination. The interview-winning line is: SSO answers can you log in, PAM answers how privileged sessions are controlled, and IGA answers should you have this access at all — and can we prove it.
① What IGA actually is — and how it differs from SSO and PAM
The single most important idea: Identity Governance & Administration (IGA) is about who should have access to what, and proving it — not about logging people in. SailPoint IGA continuously answers three questions an auditor will ask: who has access, is that access appropriate, and can you show the evidence.
IGA vs SSO vs PAM
SSO (single sign-on, e.g. Okta or Entra ID) handles authentication — it lets you log in once. PAM (privileged access management) controls and records what admins do in privileged sessions. IGA sits above both: it governs the lifecycle of access — granting, reviewing, certifying and revoking entitlements across every connected app — and is the system of record for compliance. They are complementary, not interchangeable.
How does IGA differ from SSO?
② Sources, aggregation and the identity warehouse
Before SailPoint can govern anything, it has to see everything. A source is any connected system — Active Directory, Workday, SAP, a SaaS app. SailPoint uses connectors to aggregate (read in) the accounts and entitlements from each source on a schedule.
Cube, warehouse and correlation
Those accounts are correlated to a single person and stored as one model. In IdentityIQ this is the Identity Cube — a complete picture of a user's attributes, accounts, entitlements, roles, policy violations and risk — held in the identity warehouse. An authoritative source (usually HR/Workday) defines who the person is; other sources contribute the accounts they own. SailPoint ships this two ways: Identity Security Cloud (SaaS, built on the Atlas platform) and IdentityIQ (on-prem, deepest customization). Same governance ideas, different delivery.
The central store of every Identity Cube — each user's attributes, accounts, entitlements, roles, violations and risk, correlated from all sources.
The scheduled process of reading accounts and entitlements in from each connected source, then correlating them to the right identity.
A periodic campaign where reviewers certify (keep) or revoke each person's access, producing an audit trail of sign-offs and removals.
An SoD policy defines two lists of conflicting access; holding both raises a violation, stopping fraud-enabling combinations.
In an interview, say it out loud: the authoritative source (usually HR/Workday) defines who a person is and drives joiner-mover-leaver events; other sources only contribute the accounts they own. Aggregation reads them in, correlation ties them to one Identity Cube. That sentence shows you understand the data model, not just the buttons.
In IdentityIQ, what is the single combined model of one user's accounts, entitlements, roles and risk called?
③ Access requests, provisioning and certification campaigns
Once identities are correlated, governance gets active. A user (or their manager) submits an access request; it routes through approvals; on approval SailPoint provisions the access automatically into the target system. Lifecycle states — joiner, mover, leaver — drive this without tickets: a new hire is auto-provisioned baseline access, a transfer gets access updated, and a termination triggers automatic deprovisioning so orphaned access does not linger.
Access certification
Periodically SailPoint launches an access certification campaign (a recertification): reviewers — usually managers or app owners — are shown each person's access and must certify (keep) or revoke it. Revokes can auto-provision the removal. The campaign produces a full audit trail of every decision, which is exactly what SOX, GDPR, HIPAA and similar audits demand. In an interview this is the headline: certification = periodic review of who has access, with sign-off and revocation, all evidenced.
Reviewers clicking 'approve all' is the real-world failure of certification. The point is genuine review with revocation that actually deprovisions, plus AI recommendations that flag risky or unused access for attention. Describe certification as evidence-producing review, not a formality, and mention micro-certifications triggered by changes.
▶ Watch an access request get provisioned end-to-end
How one request becomes real access in a target app. Press Play for the healthy path, then Break it to see the classic failure.
An employee leaves the company. What should SailPoint do automatically?
④ Roles, role mining and Separation of Duties (SoD)
Granting access one entitlement at a time does not scale. Roles (RBAC) bundle the entitlements a job needs so a 'Teller' role grants the right access in one move. Building roles by hand is painful, so SailPoint uses role mining — AI/ML analyzes who actually has what, finds common patterns, and suggests candidate roles, cutting role explosion dramatically.
Separation of Duties
Some access combinations are dangerous together. Separation of Duties (SoD) is the principle that no one person should control a whole sensitive process — e.g. the same user should not both create a vendor and approve its payments. A SoD policy defines two lists of conflicting access; if any identity holds access from both lists, SailPoint flags a policy violation — at request time (prevent) and during certification (detect). The interview line: SoD stops toxic combinations that enable fraud; roles and AI recommendations make the right access fast while SoD keeps it safe.
Priya at a Mumbai bank faces this
An internal auditor finds a finance clerk who can both create new vendors and approve payments to them — a classic fraud risk that slipped through.
There was no SoD policy defined for that pair, and access was granted ad hoc one entitlement at a time with no role model.
Open the identity warehouse — the clerk's Identity Cube shows both entitlements; no SoD policy ever flagged the combination at request time.
Identity Security Cloud ▸ Policies ▸ Separation of Duties + Access RequestsDefine an SoD policy with the two conflicting-access lists, run it across all identities to surface existing violations, remediate via certification, and enforce the check at request time so future requests are blocked.
Re-run the policy: the clerk's violation is remediated, and a fresh request for both entitlements is now stopped before provisioning.
Never answer an access question with 'should be fine'. The Identity Cube in the warehouse shows exactly what entitlements and roles a user holds, every policy violation, and their certification history. That single read settles most governance questions without guessing.
A SoD policy says 'create vendor' and 'approve vendor payments' must not be held together. A user requests both. What happens?
🤖 Ask the AI Tutor
Tap any question — instant, scoped to this lesson. No login, no waiting.
Pre-curated from vendor docs + community Q&A, scoped to this lesson. For a live prod issue, paste your export into chat.techclick.in.
📝 Wrap-up assessment — six more
You've answered 4 inline. Six left. 70% (7 of 10) marks the lesson complete on your profile. Tap Submit all answers at the end.
🧠 In your own words
Type one line: why is SailPoint IGA described as 'who should have access, and prove it' rather than a login tool? Then compare with the expert version.
🗣 Teach a friend
Best way to lock it in — explain it in one line to a teammate. Tap to generate a paste-ready summary.
📖 Glossary
- IGA
- Identity Governance & Administration — the discipline of deciding who should have access to what, automating its lifecycle, and proving it for audit.
- Source
- A connected system (app, directory or database) that holds its own accounts, reached through a SailPoint connector.
- Aggregation
- The scheduled process of reading accounts and entitlements in from a source so SailPoint can govern them.
- Identity Cube
- In IdentityIQ, the single model of one user — attributes, accounts, entitlements, roles, policy violations and risk — held in the warehouse.
- Correlation
- Matching aggregated accounts to the right person, using an authoritative source to define each identity.
- Provisioning / Deprovisioning
- Automatically granting access on approval or lifecycle event, and automatically removing it when no longer needed.
- Access certification
- A periodic campaign where reviewers certify (keep) or revoke each person's access, leaving an audit trail.
- Role / Role mining
- A role bundles the entitlements a job needs (RBAC); role mining uses AI/ML to discover candidate roles from real access patterns.
- Separation of Duties (SoD)
- A policy of two conflicting-access lists; holding both raises a violation to stop fraud-enabling combinations.
- Identity Security Cloud / IdentityIQ
- SailPoint's SaaS IGA on the Atlas platform vs the on-prem software with the deepest customization.
📚 Sources
- SailPoint Identity Services — Managing Sources Overview (aggregation, connectors, correlation). documentation.sailpoint.com/saas/help/sources
- SailPoint Identity Services — Provisioning Overview & Setting Up Lifecycle States (joiner/mover/leaver). documentation.sailpoint.com/saas/help/provisioning
- SailPoint Identity Services — Separation of Duties Overview & Managing Policies. documentation.sailpoint.com/saas/help/sod
- SailPoint IdentityIQ — Identity Management: Identity Cubes, the identity warehouse & correlation. documentation.sailpoint.com/identityiq
- SailPoint — Compliance management: access certifications with AI-driven insights. sailpoint.com/products/identity-security-cloud/atlas/capabilities/compliance-management
- SailPoint — Modernize Access Modeling: role discovery and mining with AI and machine learning. sailpoint.com/blog/modernize-access-modeling-ai-ml
What's next?
Got governance? Next, go deeper on connectors and provisioning — how SailPoint talks to Active Directory, Workday, SAP and SaaS apps, and how a request becomes an actual account change in the target system.