Yes, this example accurately describes an IdentityNow data flow for password changes in an Active Directory environment. When a user changes their password in IdentityNow, the request is sent to the virtual appliance , which then communicates with the IQService host. The IQService is responsible for making changes to Active Directory . This flow reflects the standard procedure for password management using IdentityNow with Active Directory, where the virtual appliance and IQService coordinate to complete the password change.

References:

SailPoint IdentityNow Password Management Documentation.

SailPoint IdentityNow IQService and Virtual Appliance Data Flow Guide.

The Web Services connector in SailPoint IdentityNow does not support SAML authentication . SAML is primarily used for Single Sign-On (SSO) authentication for web applications, whereas the Web Services connector in IdentityNow typically supports Basic Authentication, OAuth , or custom header-based authentication for API-based integrations. SAML authentication is generally used for federated identity management rather than for API-based interactions.

References:

SailPoint IdentityNow Web Services Connector Configuration Guide.

SailPoint IdentityNow Authentication Methods for Connectors.

Yes, the search syntax @accounts( source.name: " AD " AND state: " disabled " ) is correct, as it matches the necessary criteria for finding disabled AD accounts. This query searches for accounts in the AD source where the account state is set to " disabled, " which effectively filters for the desired result.

Key Reference from SailPoint Documentation:

Correct Syntax for Disabled Accounts: The search correctly identifies accounts with a disabled state using this syntax.

No, when deploying the Virtual Appliance (VA) using the AWS deployment option, the IdentityNow engineer does not need to convert the VA image. SailPoint provides an AWS-compatible Amazon Machine Image (AMI) that can be directly used to deploy the VA in AWS without any additional conversion steps. The AMI is shared with the customer’s AWS account, allowing for a streamlined deployment process.

Key Reference from SailPoint Documentation:

VA Deployment in AWS: SailPoint provides a ready-to-use AMI for AWS deployments, and no image conversion is necessary for this deployment method.

Live access reviews, which involve reviewing and certifying user access to various resources, should be performed in a production environment. This is because access reviews are directly related to active identities and entitlements in a live system, ensuring compliance and security in real-time operations.

Key Reference from SailPoint Documentation:

Access Reviews in Production: SailPoint recommends conducting live access reviews in production environments to ensure that the access being reviewed reflects the actual, current access of users in the system.

SailPoint IdentityNow API documentation is indeed located at https://docs.sailpoint.com . This official documentation site contains all the information developers need to interact with IdentityNow through APIs. It includes guidelines on how to authenticate, make requests, and use the API endpoints to automate and integrate with other systems.

Key Reference from SailPoint Documentation:

SailPoint API Documentation: The site docs.sailpoint.com hosts the official API documentation for SailPoint IdentityNow, covering all aspects of using IdentityNow ' s APIs.

Yes, downloading the accounts data CSV from the Accounts tab on the authoritative source is a reasonable action for troubleshooting incomplete identities. This CSV file contains detailed account information pulled from the authoritative source, allowing the engineer to manually inspect the raw data and identify any discrepancies or missing attributes that could lead to incomplete identities. This is a useful step in verifying the accuracy and completeness of the data being aggregated from the authoritative source.

References:

SailPoint IdentityNow Source Account Data Inspection and CSV Export Documentation.

SailPoint IdentityNow Identity Data Troubleshooting Guide.

A non-production tenant is commonly used for demonstrating functionality, as well as for testing and development purposes. In a SailPoint IdentityNow environment, non-production tenants provide a sandbox environment where customers and engineers can safely explore the system, simulate use cases, and demonstrate functionality without impacting the live production environment.

Key Reference from SailPoint Documentation:

Non-Production Tenant Usage: SailPoint recommends non-production tenants for testing, demonstrating functionality, and conducting proofs of concept, ensuring that the production environment remains unaffected.

No, this example does not accurately describe an IdentityNow data flow. The incorrect part of this flow is that identity profiles are not created within the Virtual Appliance (VA). Identity profiles are created and managed directly within the IdentityNow tenant , not the VA. Additionally, the provisioning process is handled by the IdentityNow tenant through provisioning tasks and API calls to the VA for execution, but the VA does not initiate identity profile creation or manage the full synchronization of those profiles.

References:

SailPoint IdentityNow Identity Profile Configuration Guide.

SailPoint IdentityNow Virtual Appliance and Tenant Data Flow Documentation.

Passthrough authentication in SailPoint IdentityNow refers to a method where the authentication process happens through a trusted identity provider (IdP), rather than using credentials stored directly in SailPoint IdentityNow. The key feature of passthrough authentication is that the user ' s login attempt is authenticated via external authentication mechanisms such as Active Directory, SAML-based Identity Providers (IdPs), or other federated identity providers.

In the given use case, the user is logging into IdentityNow using a password set directly in IdentityNow during registration. This process describes local authentication (where IdentityNow manages the credentials), not passthrough authentication. Since passthrough authentication relies on external IdPs or federated systems, this case does not accurately describe passthrough authentication.

References:

SailPoint IdentityNow Documentation on Authentication Methods.

SailPoint IdentityNow Federation and SSO Configuration Guides.