We are planning to prune the Identity Snapshot, Task Result, and Certification-related objects.
Before updating the system configuration to enable data pruning, we would like to understand the following:
What would be the recommended option for taking a backup before pruning the data—database backup or object export?
We have not used Identity Snapshot for troubleshooting so far, so we would like to understand its purpose and advantages in IIQ.
Once the Identity Snapshot data is pruned, what information will be lost, and what impact could this have on the system or troubleshooting capabilities?
Please share your recommendations and any best practices we should follow before proceeding with the pruning.
We generally do not take backup but if u want to take backup then use external source like databricks or something there you can take backup.
i think we can use for troubleshoot and role back, the change for that identity
no impact on system, no data will be lost its same concept like take your vm snapshot with current stage. So due to performance we are not using snapshot at all. But yes there will be zero impact
Hello Prashansa Rai. Before pruning, I would take a full database backup and validate the restore in non-prod. Once objects are pruned through Perform Maintenance, they cannot be recovered unless a backup exists. I would not rely on IIQ export as the rollback mechanism, since it is documented for exporting/moving IIQ objects rather than system recovery. (System Maintenance, Commonly Used Commands)
Retention is controlled under Global Settings > IdentityIQ Configuration > Miscellaneous, including snapshot, task result, and certification retention periods. (Miscellaneous settings)
Identity Snapshots are historical point-in-time copies used for identity history. They can show attributes, assigned IT roles, extra entitlements, and application accounts. Pruning them does not remove the current Identity, but it removes history older than your configured retention period. (View Identity)
For certifications, SailPoint recommends using certification reports for long-term preservation rather than relying on certification archives. I would also use separate Perform Maintenance tasks/cycles for the different object types, which SailPoint documents as a good practice.
@Prash You don’t need to take any backup before enabling auto pruning. Those are transaction objects like provisioning transaction and task result. that you can keep for sufficient duration as per your organization policy and then let it prune. For any troubleshooting you’ll have the access requests or audit config entries. Moreover, you can also build a pipeline to external tools like Kibana, Grafana, Splunk to store provisioning transactions, etc.
Regarding identity snapshots, they are basically the snapshots of your identities generated across multiple tasks and multiple timestamps. They are database heavy objects. I would say instead of relying on it you can try for Access History.
I also believe, you must have database backup policy is in place. So, at any point of time, if you are in a situation that you really need a previous state of IIQ, you can restore that database to a temporary storage, do your analysis and destroy it again.