IdentityNow
Onboarding Readiness Checklist

SailPoint Community Resources

Use the Compass Community to search SailPoint functionality, ask questions, and read about best practices that can help you deploy your product. In addition to joining the community, we also strongly encourage you to bookmark the Documentation Site, Developer Portal and Support Portal, as well as explore all of the other resources that SailPoint offers.

SailPoint and IdentityNow Training

SailPoint Identity University provides you with the technical training needed to optimize your productivity and successfully implement your identity security solution. It is important for members of the implementation and management teams to take these courses. You will become more familiar with the concepts and activities covered during onboarding and gain the basic knowledge needed to maintain your identity program.

Virtual Appliances

Important Note: The Virtual Appliance discussion below is geared towards customers who are interested in deploying their appliances on their own with minimal SailPoint involvement. However, we encourage customers to reach out to their SailPoint Customer Onboarding Manager if they have any questions, concerns, or issues following any of the steps outlined below.

In order to securely communicate with your organization's systems, SailPoint leverages a Virtual Appliance (VA) as the connectivity gateway between the IdentityNow cloud platform and your on-premise applications. Please note that even your cloud applications would be considered "on-premise" because they are private clouds reserved for use only by your organization.

Because the VA is a Linux-based virtual machine that is provided as a virtual disk image, your organization is responsible for procuring the hardware or hypervisor necessary to host that image. Your organization also needs to ensure proper connectivity to the cloud for the VA to operate. SailPoint will manage the rest of the responsibilities: monitoring, maintenance, patching and upgrading of the virtual machine's software itself.

For full documentation on the VA, including links to troubleshooting documentation, please consult the Virtual Appliance Reference Guide in Compass.

IQService for Active Directory

Note: IQService does not apply to CSD Portfolio customers. This step may be skipped.

If provisioning/writing to Active Directory or Azure Active Directory is in scope for your project, you will need to install IQService on a server that is connected to the same domain as the AD domain you are interested in managing. IQService is a small, lightweight utility provided by SailPoint that leverages a combination of Active Directory Service Interfaces and PowerShell to execute write operations against your Active Directory domain controllers.

Please reference the installation guide for complete details. At a minimum, you will need to procure a server running Windows Server 2012 with .NET framework 4.5.2 installed, 250 MB free disk space, and 500 MB of RAM. Additionally, if you would like to leverage TLS for enhanced security (recommended), you will need to ensure that you have certificates from your trusted certificate authority which meet the below requirements:

• Subject and Subject Alternative Name of the certificate must match the fully qualified domain name of the host
• Certificate should have private key
• Certificate should have Enhanced Key Usage (EKU) as Server authentication with client authentication
• Certificate must be present in the Personal folder of the server from which it is being generated

For high availability/disaster recovery purposes, our customers often choose to install both a primary IQService host and a secondary IQService via a load balancer. If you would like to do this as well, it is important to note that the only supported "fallback" configuration is active-passive. In other words, one IQService instance must be considered the primary active host, and the second service should be configured on the load balancer as a passive service which is only invoked if the primary instance is unreachable.

Service Accounts for Sources in Scope

For each of the direct-connected target applications that are in scope for your project, you will need to request service accounts with the appropriate levels of permission to integrate with IdentityNow. You can use the form below to dynamically add sources to the table of reference articles which can be shared with your application owners.

The full list of supported connectors for IdentityNow can be found in Compass. If you're unsure which IdentityNow connector is appropriate for a given application, please reach out to your Customer Onboarding Manager.

Congratulations! You've completed all of the steps and are now ready to start onboarding.

Before you contact us, click the "Download" button below to generate a text file with your selections and save it locally. You can then share those answers with your implementation team. Once downloaded, you will see an form for sending your selections to SailPoint. This is entirely optional but, if you are working with SailPoint, clicking the "Submit" button on the form will share your answers with us directly.

Optionally, you can fill out the Setup Services Intake Form and include the IdentityNow Onboarding Readiness Checklist responses which you just downloaded. If you have any questions, please don't hesitate to reach out to your Customer Onboarding Manager or Customer Success Manager. We are so excited to start the next phase of the implementation journey with you!