I’m currently working on an application integration with SailPoint IdentityIQ. I’ve already completed the application onboarding and the aggregation of existing accounts, and I’m also handling service accounts separately as Service Account identities with their corresponding owners.
My question is specifically about creating new service accounts after the application has been onboarded.
For organizations where end users are not allowed to create accounts directly from the IdentityIQ Portal, how do you typically manage service account creation?
I’m interested specifically in the creation process for new service accounts, not the aggregation or management of existing service accounts.
What approach have you found to be the best practice in IdentityIQ environments?
Also, if you have any documentation, guides, or relevant resources related to service account creation and provisioning in IdentityIQ, I’d really appreciate it if you could share them.
@IslamElkhouly The most robust and auditable approach in SailPoint IIQ is to build a dedicated QuickLink backed by a custom LCM Provisioning Workflow. Even if end users cannot use standard access requests, administrators, application owners, or service desks use this controlled gateway.
If the organization enforces a strict policy where all requests must originate outside of SailPoint, the best practice is to leverage an enterprise ITSM tool (like ServiceNow) as the front-end. This will make an backend call to Sailpoint to take the necessary actions.
You might also want to have a PAM integration for credentials management. Its a good practice to manage credentials via vaults inside your PAM solution.
Hello Islam. Since you already model each service account as a separate Service Account identity, you can use the standard LCM flow.
Create the identity through Manage Identity → Create Identity, set Type = Service Account, and capture the owner details through the Create Identity provisioning policy.
For that identity, use Manage Accounts → Request Account. If the application supports account creation, IIQ uses its Create provisioning policy and provisions the account through the connector.
Restrict these QuickLinks to the appropriate users using QuickLink Populations.
If you need identity creation, approval, naming rules, and account provisioning handled as one process, then @neel193’s dedicated QuickLink/workflow approach is a good option. I would treat that as an implementation choice rather than a requirement.
If requests must originate outside IIQ, ServiceNow or another ITSM tool can act as the front end and pass the approved request to IIQ for provisioning.
you can create new forms in sailpoint and using that you can have a workflow defined with approval process Once approvals are done, you can call create account for the respective target application system. Add proper owner, manager for the service accounts so that UAR is conducted regularly.
During aggregation as well follow the same naming pattern for identity and add the corresponding owner or manager details so none of the flows are missed.