SailPoint is the name everyone in IAM lands on eventually. It is also the platform that quietly humbles a lot of mid-level engineers, because the real skill is not "knowing SailPoint" — it is knowing where SailPoint ends and the customer's mess begins.
1. IIQ vs IDN — pick consciously, not by trend
IdentityIQ is the on-prem, deeply customizable Java workhorse. IdentityNow (now ISC) is the SaaS sibling — opinionated, faster to stand up, but you trade some of the flexibility you used to take for granted. The right choice depends on three things, in order: your existing infrastructure, your appetite for managing servers, and how custom your access model really is. Anyone who picks based on which one is "newer" is making the wrong choice.
2. Connectors are 80% of the work
Every SailPoint program I have seen underestimated connector effort. Out-of-the-box connectors look great in demos and then meet reality:
- That bespoke HR system whose REST API is a single XML blob.
- The on-prem app whose "API" is a Windows service that someone wrote in 2011.
- The SaaS tool that supports SCIM but only for the part of the schema you do not need.
Plan capacity for custom connectors and reconciliation logic from day one. The teams that do this ship governance programs in 6 months. The ones that do not are still demoing in 12.
3. Certifications are political theatre — until they aren't
Annual certifications generate enormous amounts of activity and very little actual cleanup. The trick is to make them focused: certify high-risk roles quarterly, low-risk roles annually, and let the system auto-revoke anything inactive for 90 days. That changes certifications from rubber-stamping into actual signal.
4. Lifecycle Manager is where the value is
Joiner / Mover / Leaver automation is what executives actually care about. Cutting onboarding time from days to hours, and revoking leaver access in minutes instead of "by Friday", is the kind of metric that gets renewed budget. Build LCM properly and the rest of the program is downhill.
Nobody at the leadership level cares which IGA tool you use. They care that the right person had access on day one and the wrong person had it revoked the second they left. That is the deliverable.
5. The boring engineering wins
- Source of truth first. If HR data is messy, every governance decision downstream is corrupted.
- Roles last. Build entitlement-level governance first, then aggregate into roles when patterns emerge.
- Workflows are code — version them. If you can't diff a workflow, you can't review it.
- Treat exceptions as data. Every "just this once" exception is a future audit finding. Track them.
If you're new to SailPoint
Skip the marketing decks. Stand up a lab IIQ, point it at an AD instance, and try to onboard a single application end to end — including a custom rule, a workflow, a certification campaign, and a deprovisioning chain. You will learn more in a week of doing that than in a month of training. And you will quickly see why senior IAM engineers are paid the way they are: this stuff is not hard once you've done it, but the gap between "can configure" and "can architect" is where the value sits.
Five years in, I am genuinely fond of the platform. It rewards engineers who treat governance as a system design problem, not a checkbox.