Source: https://joinfinn.com/integrations/sailpoint-identitynow

# SailPoint IdentityNow

## SailPoint IdentityNow + Finn.

SailPoint IdentityNow integration with Finn. SailPoint IdentityNow provides cloud identity governance for employee access and lifecycle processes.

Business function: IT and identity.

## What you can do with SailPoint IdentityNow.

SailPoint IdentityNow provides cloud identity governance for employee access and lifecycle processes.

### Complete a governed application-access request

Finn takes an employee's access request through the organization's governance process and follows the resulting provisioning work until the connected application reports its outcome.

**Typically handled by:** Identity access fulfillment team

**Starts when:** An employee requests a business application or additional permissions.

#### What Finn handles

1. Find the requested access profile and role in SailPoint IdentityNow and collect the employee's business purpose and required duration.
2. Submit the access request through SailPoint IdentityNow's approval process, preserving the designated owner's decision.
3. Follow the approved provisioning operation through the application's connected source rather than equating request submission with access.
4. Notify the employee of the result and complete the associated ServiceNow work with the request and provisioning references.

**The result:** The access journey ends with the application's provisioning result and the governance decision recorded together.

### Provision the access for an approved new hire

Finn carries the approved hiring event through identity governance, completes the role's authorized application provisioning, and reports exactly which systems are ready for the employee.

**Typically handled by:** Identity lifecycle onboarding team

**Starts when:** Workday confirms an employee's role, manager, location, and start date.

#### What Finn handles

1. Match the HR identity to SailPoint IdentityNow and determine the role's established access profile and role assignments.
2. Run the configured lifecycle or access-request process, obtaining decisions for permissions outside the established role.
3. Follow each connected application's provisioning result and record failures as specific fulfillment work.
4. Send the employee their access-ready information and update the ServiceNow onboarding request with the completed systems.

**The result:** The employee's governed access is provisioned and the onboarding team can distinguish completed applications from genuine connector exceptions.

### Update access for a change of responsibility

Finn handles the access consequences of an approved role change, keeping the new business responsibilities, required decisions, and application-side changes connected in one lifecycle journey.

**Typically handled by:** Identity mover operations team

**Starts when:** Workday records an approved transfer or change in employee responsibilities.

#### What Finn handles

1. Compare the employee's current access in SailPoint IdentityNow with the assignments associated with the settled new role.
2. Present overlap or exceptional access to the responsible owners for an explicit keep-or-remove decision.
3. Run the approved additions and removals through SailPoint IdentityNow's provisioning process.
4. Check connected-source results and record the completed changes and unresolved application tasks in ServiceNow.

**The result:** The employee's access reflects the approved responsibility change with evidence of the resulting application updates.

### Complete governed access removal for a departure

Finn turns an approved employee departure into executed access-removal work and source-system evidence, keeping account retention requirements separate from the decision to remove access.

**Typically handled by:** Identity governance offboarding team

**Starts when:** HR records a confirmed departure with an authorized effective time.

#### What Finn handles

1. Identify the employee's governed identities, accounts, and assigned access profile and role in SailPoint IdentityNow.
2. Start the approved lifecycle removal process at the agreed time, keeping retention decisions with their data owners.
3. Follow provisioning and manual fulfillment tasks through each connected application's reported completion.
4. Record completed removals and specifically unresolved source-system work in the ServiceNow departure record.

**The result:** The departure produces evidenced access removals rather than a submitted governance request incorrectly labeled as finished.

### Carry an access certification through remediation

Finn coordinates the evidence and follow-through for a scheduled access review, while the designated reviewer retains the decision about who should keep or lose each permission.

**Typically handled by:** Access certification coordinator

**Starts when:** An application or identity certification campaign opens for a defined employee population.

#### What Finn handles

1. Collect the access items, business context, and ownership information from SailPoint IdentityNow.
2. Present the review items to the designated certifier and record their explicit decisions through the review process.
3. Follow revocation and correction work generated from the certifier's decisions to the connected sources.
4. Record completed remediation and escalate only the source actions that remain unfinished after their assigned deadline.

**The result:** The certification includes implemented reviewer decisions and source-system evidence, not only a completed review checklist.

### Resolve an access-policy conflict

Finn carries a detected access-policy problem through an owner's decision and the resulting access correction, keeping the business exception or removal visible in the governance record.

**Typically handled by:** Identity policy and application control team

**Starts when:** SailPoint IdentityNow identifies access that conflicts with an established policy or review decision.

#### What Finn handles

1. Gather the conflicting assignments, affected identity, business role, and policy context for the responsible owner.
2. Obtain the owner's explicit remediation or permitted exception decision through the organization's governance process.
3. Execute the approved access correction through SailPoint IdentityNow's connected provisioning path.
4. Check the source result and record the correction or exception details in the linked ServiceNow work.

**The result:** The policy issue has a recorded decision and completed remediation where authorized, without Finn granting its own exception.

### Finish a failed access-provisioning request

Finn works the operational exception behind a failed access request, addressing a documented fix and completing the original fulfillment rather than asking the employee to start over.

**Typically handled by:** Identity provisioning support team

**Starts when:** An approved SailPoint IdentityNow request fails or remains incomplete in a connected application.

#### What Finn handles

1. Retrieve the request, approval, provisioning result, and the source-specific reason access was not completed.
2. Correct the documented operational issue within the existing authorization, obtaining a new decision only if the requested access changes.
3. Resume or resubmit the supported fulfillment operation and follow the connected source's outcome.
4. Notify the employee and update the ServiceNow case with the completed assignment or the exact remaining dependency.

**The result:** The original request reaches a documented fulfillment result, with its initial approval and exception history preserved.

### Close out expired temporary access

Finn follows temporary access through its authorized end date, obtains a concrete renewal decision when needed, and completes the resulting removal or extension in the governed applications.

**Typically handled by:** Temporary-access governance coordinator

**Starts when:** A time-bound access assignment or business exception reaches its review or expiration date.

#### What Finn handles

1. Identify the affected access profile and role, employee, sponsor, end date, and existing authorization in SailPoint IdentityNow.
2. Ask the responsible owner to decide any requested extension using the established approval path.
3. Apply the approved extension or execute the scheduled access removal through the connected provisioning process.
4. Check the application result and record the decision and completed change in the service request.

**The result:** Temporary access follows its documented authorization period, with a completed extension or removal and corresponding evidence.

## Connection setup

Contact Finn to discuss the records your workflow needs and the actions you want it to perform.

Your team chooses what Finn can access, what agents can change, and when a person must approve the work. The connection needs the appropriate account access and permissions from SailPoint IdentityNow.

## Explore Finn

- [Agents](https://joinfinn.com/agents): Help customers. Work with your team. Finish the job.
- [Systems](https://joinfinn.com/systems): Business apps for the work behind the conversation.
- [AI Gateway](https://joinfinn.com/ai-gateway): Control connected AI apps, models, access, and spending.

[All integrations](https://joinfinn.com/integrations)

[Discuss this integration](https://joinfinn.com/contact)

[Discuss your workflow](https://joinfinn.com/contact) · [How it works](https://joinfinn.com/demo/app/#/w/borough/overview) · [Get started](https://joinfinn.com/app/#/signup)