IdentityIQ’s phased certification campaigns are designed for this exact scenario. The first phase goes to the manager for all items. Based on a policy (like the presence of a high-risk entitlement), specific items can be automatically promoted to a second phase for the application owner’s review. This is efficient, automated, and maintains a clear audit trail within a single campaign.

The ‘sailpoint.connector’ logging category is specifically for connector operations. Setting it to DEBUG will output detailed information about the connector’s execution, including the SQL statements it generates, the data it fetches in chunks, and where in the process it might be stalling, which is essential for debugging JDBC connector performance issues.

The correct approach is to make the rule intelligent by inspecting the provisioning plan’s intent and the account’s current state. The rule should check if the operation is for a modify/disable and if the target account already shows as inactive. If so, it can skip the redundant operation or perform a no-op, preventing the error and allowing the lifecycle process to complete cleanly. This is a pattern for building resilient, production-ready rules.

When role definitions (not role assignments) are changed via import or directly in the database, IdentityIQ’s role policy cache needs to be updated. The ‘Refresh Role Metadata’ task is specifically designed to clear this cache and reload role definitions, ensuring that all subsequent policy evaluations (like role assignment policies or certification calculations) use the new logic. Without this step, the system continues to use the cached old definitions.

The ‘onLinksUpdated’ event fires after an identity’s links (their accounts on target systems) have been modified during a refresh or aggregation. This is the precise trigger for detecting changes to group memberships on a link. You can configure the event handler to filter for a specific application (AD) and a specific attribute (the group attribute) to launch your workflow only when membership in that privileged group is added or removed.

IdentityIQ’s advanced search for identities allows for nested filtering. The correct filter path is to find Identities where their ‘Assigned Roles’ relationship points to a Role where that Role’s ‘Permissions’ relationship includes the specific ‘AppX’ entitlement. This search directly answers the question by leveraging the built-in data model relationships between Identity, Role, and Bundle (permission).

When ‘header’ is true, the connector uses the first row as column names. The ‘nativeName’ in the schema attribute tells the connector which column in the file to read from (DepartmentCode). The ‘displayName’ is the IdentityIQ attribute name it maps to (department). Therefore, displayName=’department’ and nativeName=’DepartmentCode’ correctly maps the file column to the IIQ attribute.

This is a classic use case for a scheduled (e.g., nightly) task. The task would use IdentityIQ’s search API to find all identities where the `contractEnd` attribute is not null and where the current date is greater than `contractEnd + 30 days`. For each identity found, the task would launch a predefined deprovisioning workflow. This is a controlled, auditable, and repeatable automation method.

The ‘modified’ date on a WorkItem updates each time an action is taken on it (e.g., delegated, commented on). For a pending approval, the ‘created’ date is when it was assigned, and the ‘modified’ date will be close to the ‘created’ date initially. If it has been sitting untouched for 7 days, the difference between the current date and the ‘modified’ date will be >7 days. The ‘expiration’ date might not be set, and ‘completion’ is null for pending items.

IdentityIQ’s phased certification campaigns are designed for this exact scenario. The first phase goes to the manager for all items. Based on a policy (like the presence of a high-risk entitlement), specific items can be automatically promoted to a second phase for the application owner’s review. This is efficient, automated, and maintains a clear audit trail within a single campaign.0