Skip to content
finn.
Integrations SailPoint IdentityIQ

Integration · IT and identity

SailPoint IdentityIQ + Finn.

SailPoint IdentityIQ integration with Finn. SailPoint IdentityIQ manages employee access to applications and the reviews required to approve it.

Discuss this integration Explore the workflows

The work behind the connection

What you can do with SailPoint IdentityIQ.

SailPoint IdentityIQ manages employee access to applications and the reviews required to approve it.

Complete a governed application-access request

Finn takes an employee's access request through the organization's governance process and follows the resulting provisioning work until the connected application reports its outcome.

Typically handled byIdentity access fulfillment team

Starts when

An employee requests a business application or additional permissions.

What Finn handles

  1. Find the requested role and entitlement in SailPoint IdentityIQ and collect the employee's business purpose and required duration.
  2. Submit the access request through SailPoint IdentityIQ's approval process, preserving the designated owner's decision.
  3. Follow the approved provisioning operation through the application's connected source rather than equating request submission with access.
  4. Notify the employee of the result and complete the associated ServiceNow work with the request and provisioning references.

The result

The access journey ends with the application's provisioning result and the governance decision recorded together.

Provision the access for an approved new hire

Finn carries the approved hiring event through identity governance, completes the role's authorized application provisioning, and reports exactly which systems are ready for the employee.

Typically handled byIdentity lifecycle onboarding team

Starts when

Workday confirms an employee's role, manager, location, and start date.

What Finn handles

  1. Match the HR identity to SailPoint IdentityIQ and determine the role's established role and entitlement assignments.
  2. Run the configured lifecycle or access-request process, obtaining decisions for permissions outside the established role.
  3. Follow each connected application's provisioning result and record failures as specific fulfillment work.
  4. Send the employee their access-ready information and update the ServiceNow onboarding request with the completed systems.

The result

The employee's governed access is provisioned and the onboarding team can distinguish completed applications from genuine connector exceptions.

Update access for a change of responsibility

Finn handles the access consequences of an approved role change, keeping the new business responsibilities, required decisions, and application-side changes connected in one lifecycle journey.

Typically handled byIdentity mover operations team

Starts when

Workday records an approved transfer or change in employee responsibilities.

What Finn handles

  1. Compare the employee's current access in SailPoint IdentityIQ with the assignments associated with the settled new role.
  2. Present overlap or exceptional access to the responsible owners for an explicit keep-or-remove decision.
  3. Run the approved additions and removals through SailPoint IdentityIQ's provisioning process.
  4. Check connected-source results and record the completed changes and unresolved application tasks in ServiceNow.

The result

The employee's access reflects the approved responsibility change with evidence of the resulting application updates.

Complete governed access removal for a departure

Finn turns an approved employee departure into executed access-removal work and source-system evidence, keeping account retention requirements separate from the decision to remove access.

Typically handled byIdentity governance offboarding team

Starts when

HR records a confirmed departure with an authorized effective time.

What Finn handles

  1. Identify the employee's governed identities, accounts, and assigned role and entitlement in SailPoint IdentityIQ.
  2. Start the approved lifecycle removal process at the agreed time, keeping retention decisions with their data owners.
  3. Follow provisioning and manual fulfillment tasks through each connected application's reported completion.
  4. Record completed removals and specifically unresolved source-system work in the ServiceNow departure record.

The result

The departure produces evidenced access removals rather than a submitted governance request incorrectly labeled as finished.

Carry an access certification through remediation

Finn coordinates the evidence and follow-through for a scheduled access review, while the designated reviewer retains the decision about who should keep or lose each permission.

Typically handled byAccess certification coordinator

Starts when

An application or identity certification campaign opens for a defined employee population.

What Finn handles

  1. Collect the access items, business context, and ownership information from SailPoint IdentityIQ.
  2. Present the review items to the designated certifier and record their explicit decisions through the review process.
  3. Follow revocation and correction work generated from the certifier's decisions to the connected sources.
  4. Record completed remediation and escalate only the source actions that remain unfinished after their assigned deadline.

The result

The certification includes implemented reviewer decisions and source-system evidence, not only a completed review checklist.

Resolve an access-policy conflict

Finn carries a detected access-policy problem through an owner's decision and the resulting access correction, keeping the business exception or removal visible in the governance record.

Typically handled byIdentity policy and application control team

Starts when

SailPoint IdentityIQ identifies access that conflicts with an established policy or review decision.

What Finn handles

  1. Gather the conflicting assignments, affected identity, business role, and policy context for the responsible owner.
  2. Obtain the owner's explicit remediation or permitted exception decision through the organization's governance process.
  3. Execute the approved access correction through SailPoint IdentityIQ's connected provisioning path.
  4. Check the source result and record the correction or exception details in the linked ServiceNow work.

The result

The policy issue has a recorded decision and completed remediation where authorized, without Finn granting its own exception.

Finish a failed access-provisioning request

Finn works the operational exception behind a failed access request, addressing a documented fix and completing the original fulfillment rather than asking the employee to start over.

Typically handled byIdentity provisioning support team

Starts when

An approved SailPoint IdentityIQ request fails or remains incomplete in a connected application.

What Finn handles

  1. Retrieve the request, approval, provisioning result, and the source-specific reason access was not completed.
  2. Correct the documented operational issue within the existing authorization, obtaining a new decision only if the requested access changes.
  3. Resume or resubmit the supported fulfillment operation and follow the connected source's outcome.
  4. Notify the employee and update the ServiceNow case with the completed assignment or the exact remaining dependency.

The result

The original request reaches a documented fulfillment result, with its initial approval and exception history preserved.

Close out expired temporary access

Finn follows temporary access through its authorized end date, obtains a concrete renewal decision when needed, and completes the resulting removal or extension in the governed applications.

Typically handled byTemporary-access governance coordinator

Starts when

A time-bound access assignment or business exception reaches its review or expiration date.

What Finn handles

  1. Identify the affected role and entitlement, employee, sponsor, end date, and existing authorization in SailPoint IdentityIQ.
  2. Ask the responsible owner to decide any requested extension using the established approval path.
  3. Apply the approved extension or execute the scheduled access removal through the connected provisioning process.
  4. Check the application result and record the decision and completed change in the service request.

The result

Temporary access follows its documented authorization period, with a completed extension or removal and corresponding evidence.

Connection setup

Set up the connection around your work.

Contact Finn to discuss the records your workflow needs and the actions you want it to perform.

Your team chooses what Finn can access, what agents can change, and when a person must approve the work. The connection needs the appropriate account access and permissions from SailPoint IdentityIQ.

The Finn platform

Finn Agents

Help customers. Work with your team. Finish the job.

Explore Agents

Finn Systems

Business apps for the work behind the conversation.

Explore Systems

Finn AI Gateway

Control connected AI apps, models, access, and spending.

Explore AI Gateway

Meet Finn

Put your SailPoint IdentityIQ integration to work.

Tell us which records, actions, and teams the connection needs to support.

Discuss your workflow Get started