Performing Entitlement Review with SailPoint IdentityIQ
When to Use
Quarterly or annual access certification campaigns are required for compliance (SOX, HIPAA, PCI-DSS)
Organization needs automated manager-based access reviews for all direct reports
Targeted entitlement reviews are needed for sensitive applications or high-privilege roles
Separation of Duties (SOD) violations must be identified and remediated
Orphaned accounts and excessive entitlements need to be discovered and cleaned up
Audit findings require evidence of periodic access review and remediation tracking
Do not use for real-time access control decisions; IdentityIQ certifications are periodic review processes designed for governance and compliance validation.
Coverage Gaps & Validation
Rubber-stamping under default-revoke: certifiers bulk-approve to avoid auto-revocation at campaign close. Query IdentityIQ CertificationItem decision times and flag reviewers averaging a few seconds per item or certifying 100% with zero revokes.
Accounts outside aggregated cubes: IIQ only certifies what its connectors aggregated. Apps with no connector, accounts that failed correlation, and local server accounts never appear — run the Uncorrelated Accounts and Orphan reports before trusting coverage.
Service / non-human accounts excluded: the Filter.ne("type","service") exclusion that keeps service accounts out of manager certs means they need a dedicated application-owner campaign; confirm one exists.
Indirect entitlements via roles/nested groups: entitlements inherited through business/IT roles or nested AD groups stay hidden unless setIncludeAdditionalEntitlements(true) and role-detail expansion are enabled.
Shadow admin: privilege held via API keys, app-local admin, or SPNs may not map to any IIQ managed entitlement.
Validate completeness: reconcile certification line-item counts against authoritative sources (HR for population, native AD/app exports for entitlements). Confirm revocations actually provisioned — verify the remediation workflow committed and did not silently create unworked manual work items.
Prerequisites
SailPoint IdentityIQ 8.2+ deployed with database backend (Oracle, MySQL, or SQL Server)
Application connectors configured for all in-scope systems (Active Directory, LDAP, databases, SaaS applications)
Identity cubes aggregated with current entitlement data from all connected sources
Email server configured for certification notifications
Manager hierarchy defined in the identity model
Business roles and entitlement glossary populated for reviewer context
Workflow
Step 1: Define Certification Campaign Strategy
Plan the certification scope and reviewer assignments:
// SailPoint IdentityIQ BeanShell - Campaign Configurationimport sailpoint.object.*;
import sailpoint.api.*;
import java.util.*;
// Define campaign schedule for quarterly manager certificationsCertificationScheduleschedule=newCertificationSchedule();
schedule.setName("Q1-2026-Manager-Access-Review");
schedule.setDescription("Quarterly manager certification for all active employees");
schedule.setType(Certification.Type.Manager);
// Configure campaign scopeCertificationDefinitioncertDef=newCertificationDefinition();
certDef.setName("Q1 Manager Certification");
certDef.setOwner(context.getObjectByName(Identity.class, "cert-admin"));
// Set certification options
certDef.setCertifierSelectionType(CertificationDefinition.CertifierSelectionType.Manager);
certDef.setIncludeEntitlements(true);
certDef.setIncludeRoles(true);
certDef.setIncludeAccounts(true);
certDef.setIncludeAdditionalEntitlements(true);
// Exclude service accounts from manager reviewsFilterexclusionFilter= Filter.ne("type", "service");
certDef.setExclusionFilter(exclusionFilter);
// Configure notification settings
certDef.setNotificationEnabled(true);
certDef.setReminderFrequency(7); // days
certDef.setEscalationEnabled(true);
certDef.setEscalationDays(14);
certDef.setEscalationRecipient("security-governance-team");
// Set active period
certDef.setActivePeriodDays(30);
certDef.setAutoCloseEnabled(true);
certDef.setDefaultRevoke(true); // Revoke if not reviewed
context.saveObject(certDef);
context.commitTransaction();
An organized review process where designated certifiers validate whether users should retain their current access entitlements across one or more applications
Access Review
Individual review unit within a campaign where a certifier examines and makes approve/revoke decisions on specific user entitlements
Entitlement
A specific permission, group membership, role, or access right granted to an identity on a target application
Certifier
The reviewer responsible for making access decisions, typically a manager, application owner, or data owner
Revocation
Decision to remove an entitlement from a user, triggering a provisioning request to the target application for access removal
SOD Violation
Separation of Duties conflict where a user holds entitlements from two or more conflicting access groups that create a segregation risk
Remediation
Automated or manual process of removing revoked access from target systems following certification decisions
IdentityIQ Compliance Manager: Module for running certification campaigns, tracking reviewer progress, and generating compliance evidence
SailPoint REST API: Programmatic interface for automating certification campaigns, querying status, and extracting audit data
IdentityIQ Report Builder: Built-in reporting engine for generating access review statistics, SOD violation summaries, and trend analysis
Common Scenarios
Scenario: SOX Compliance Quarterly Access Review
Context: A publicly traded company must demonstrate quarterly access reviews for all financial applications per SOX Section 404. The previous manual review process took 6 weeks and produced inconsistent results.
Approach:
Define application scope: SAP ERP, Oracle Financials, banking platforms, and treasury systems
Configure manager certifications with 30-day active period for general access review
Create targeted entitlement certifications for privileged financial roles with application owner as certifier
Enable SOD policy checks to flag AP/AR, GL posting/approval, and user admin/transaction conflicts
Configure automatic reminders at 7, 14, and 21 days with escalation to compliance team at day 25
Set default-revoke for items not reviewed by campaign end to enforce completion accountability
Generate signed certification reports with decision audit trail for external auditors
Track revocation completion to ensure all denied access is actually removed from target systems
Pitfalls:
Not pre-populating entitlement descriptions causes certifiers to approve everything they do not understand
Setting campaigns too short (under 21 days) results in rubber-stamping and low-quality reviews
Not validating that revocations are actually provisioned to target systems (approve on paper, still active in system)
Missing service accounts from review scope when they have access to financial systems
