@lsaipriya26 - Yes, IdentityIQ can trigger PowerShell from a workflow, but not by executing powershell.exe on the IdentityIQ application server. The appropriate pattern is for the workflow to invoke a Rule, which sends a controlled request to IQService on a dedicated Windows server. IQService executes the PowerShell rule and returns a success or failure result to IdentityIQ. The ScriptExecutor facility is disabled by default and must be explicitly enabled with TLS; this is an important security boundary.
For your case, I would make the certificate action occur only after the VDI/Active Directory account creation has succeeded, not merely when the contractor identity is created in IIQ. That prevents certificates from being created for failed, incomplete, or cancelled account requests.
Regards,
Kannan