SailPoint Identity Security Cloud Architecture — SaaS Tenant, VA Cluster & the Identity Cube

① What SailPoint Identity Security Cloud is — a four-layer SaaS IGA platform

SailPoint Identity Security Cloud (ISC), formerly IdentityNow, is a multi-tenant SaaS Identity Governance and Administration platform. You do not install a server; you activate a cloud tenant. SailPoint manages the infrastructure, upgrades and availability; you manage policies, sources, roles and certifications inside the tenant.

The architecture has four logical layers. The ISC cloud tenant is the brain — it holds the governance engine, identity cube store, policy, certifications, provisioning workflows and REST/Transforms APIs. The Virtual Appliance (VA) cluster is the connectivity bridge between your private network and the cloud. Sources are the authoritative and managed systems you connect (Active Directory, Workday, SAP, ServiceNow, etc.). The identity cube is the per-person unified identity object assembled from all source aggregations and used to drive every governance decision.

All four layers work together: sources feed data through the VA cluster into the ISC cloud, where the governance engine processes it and builds the identity cube. That cube then powers access reviews, role analysis, provisioning and AI-driven recommendations.

② The Virtual Appliance cluster — outbound-only connectivity, no inbound ports

The Virtual Appliance (VA) is a lightweight Linux VM you deploy on-premises (or in your private cloud). You typically run a VA cluster — two or more VAs grouped together — for high availability. All VAs in a cluster read from the same VA cluster queue in the ISC cloud.

The key security insight

The VA polls the cloud queue over outbound HTTPS. There are no inbound firewall rules to open to SailPoint. The VA decrypts the queued message using a local private key, calls the appropriate connector to reach the target source (e.g. LDAP to Active Directory on your internal network), gets the response, and sends the result back to ISC over the same outbound channel. This design means your on-premises systems stay behind your firewall and are never directly reachable from the internet.

For HA, add a second VA to the same cluster. ISC load-balances work items across the cluster queue, so if one VA goes down, the other picks up requests with no manual intervention.

③ Sources & connectors — what ISC manages and how it talks to each one

A source in ISC represents a system that holds accounts, entitlements or authoritative identity data. Common examples: Active Directory (accounts & groups), Workday (authoritative HR data), SAP (ERP roles), ServiceNow (tickets & CMDB), Azure AD, and dozens of SaaS apps. Each source is assigned to a VA cluster (for on-premises systems) or configured as a SaaS connector (for cloud-to-cloud integrations that don't need a VA).

ISC ships two categories of connectors. VA-based connectors run on the VA and are used for on-premises or network-restricted systems — the VA relays calls between the cloud queue and the target. SaaS connectors run entirely in the SailPoint cloud and call the target system directly over its public API, with no VA required — ideal for cloud SaaS apps like Salesforce, Google Workspace or ServiceNow. There are also custom connectors built with the SailPoint Connector SDK for systems without a bundled connector.

Each source defines account schema (which attributes to pull), entitlement schema (groups, roles, permissions), and provisioning policies. ISC runs scheduled or on-demand aggregations to pull account data and entitlement aggregations to pull permission catalogues.

④ The identity cube and core ISC cloud services

The identity cube is the central data object in ISC. After each aggregation, ISC merges account data from all sources into a single per-identity record — name, employee type, manager, all accounts, all entitlements, correlated across every source. The cube is the single source of truth for every downstream service.

Core ISC cloud services that consume the cube

The governance engine evaluates access policies, triggers certifications and enforces separation-of-duty rules. The certifications service creates periodic access reviews for managers and application owners to approve or revoke entitlements. The provisioning engine executes joiner-mover-leaver lifecycle events — creating, updating or disabling accounts via source connectors when identity attributes change. AI-driven identity security layers on top: peer-group analysis flags outlier access, role mining suggests roles from existing entitlement patterns, and recommendations guide reviewers during certifications. The REST API and Transforms layer lets you extend ISC, build custom workflows and integrate with ITSM tools like ServiceNow.