Description
Next Generation Certifications is moving to General Availability, beginning September 10, 2026 and finishing December 2026. This rollout will happen in regional batches.
This post covers the rollout schedule, known limitations, and what you need to do to prepare to ensure you have the best experience on the new platform. For the full description of what is in this release, please see the original announcement: New Capability: SailPoint next generation certification.
Please follow this topic. Any schedule changes or newly identified issues will be posted in the comments below, and this post will be updated to reflect the current plan. Following the topic is the fastest way to be notified.
Rollout schedule
Rollout is organized into three regional batches. Each batch is enabled in sandbox first, then promoted to production after some time in sandbox.
| Batch | Regions |
|---|---|
| Batch 1 | me-central-1, ap-south-1, ap-northeast-2, us-east-2, sa-east-1, ap-northeast-1, and any new tenants provisioned in any region after the GA date |
| Batch 2 | ap-southeast-1, ca-central-1, ap-southeast-2, eu-west-2 |
| Batch 3 | eu-central-1, us-west-2, us-east-1 |
| Milestone | Date |
|---|---|
| New Tenants Provisioned After | September 10, 2026 |
| Batch 1: Sandbox | September 24, 2026 |
| Batch 1: Production | October 15, 2026 |
| Batch 2: Sandbox | October 29, 2026 |
| Batch 2: Production | November 12, 2026 |
| Batch 3: Sandbox | November 30, 2026 |
| Batch 3: Production | December 14, 2026 |
A few notes on the schedule:
- Each rollout is the planned start date, and due to migration work on our end may take up to 24 hours to complete.
- New tenants created on or after September 10, 2026 have been provisioned on the new certification engine regardless of region.
- Dates are planned and may shift as we monitor this release. Changes will be announced in edits and comments on this post. (Follow this post!)
- FedRAMP environments will be excluded from this release. More information to come in the future.
Known limitations
We are tracking the following issues going into GA. If your tenant is affected by one of these, we will hold it back from the rollout until the underlying issue is addressed; you do not need to request this. Customer Success Managers have the list of affected tenants and can confirm your status.
1. Campaigns using both a search query and campaign filters
Certifications configured to select access using both a search query and campaign filters on the same campaign will not operate on the new engine.
This combination was never supported and is documented as unsupported, but a workaround existed that allowed it to be configured. Combining the two can lead to scale problems and unintended data loss (as well as being a confusing experience for both administrators and auditors), which is why the new engine does not carry it forward.
We are actively expanding campaign filtering in a feature called Enriched Campaign Filters, which is designed to cover the use cases customers are currently solving with this combination. Affected tenants will be held from the rollout until Enriched Campaign Filters is available, so that these campaigns can be migrated to use campaign filters only.
2. Timeouts on very high-volume paginated API calls
There is a known issue where very high-volume calls to /campaign/ and /certification/ endpoints that rely on offset pagination may time out.
This is narrow in scope. It affects roughly 50 tenants: those with large volumes of certification and campaign data (approximately 4,000 records or more) that also make direct API calls against these endpoints. Affected tenants will be held from the rollout until a fix ships.
What we migrate for you
You do not need to recreate your certification configuration. As part of enabling the new engine in your tenant, we migrate:
- Campaign templates
- Campaign notification templates, onto the new template set*
- Scheduled campaigns
You will also continue to have your in-flight certifications work as normal, and prior reports for campaigns generated before the cutover will continue to be available as they are today.
Note: A very small number of customers have email templates over 133kb. These are too large for the new v2 templating engine. To make the migration smooth, we will be trimming images. This is a very rare scenario.
What you need to do to prepare
- If you extract
.csvand.pdfreport data via API, the endpoint will be changing. The flow for retrieving certification report data is changing. Details and migration guidance will be published here: Certification Reports Endpoint Moving. No other API refactoring is expected. Endpoints outside the reporting flow have not changed, and existing campaign create and management calls should continue to work as they do today. - Review your migrated notification templates. A small number of attributes are no longer supported in the new email templates. If your existing templates use them, you will want to adjust the copy after migration. The full list is here: Deprecated Variables in Certs Email Templates
Webinar
We recorded a session walking through this release in more detail, including the new admin and reviewer experience and what to expect during rollout: Certifications reimagined: Scaling up without slowing down
Migration FAQ
Why is generation for small campaigns slower than it was before?
This is a deliberate tradeoff for scale and performance. The new engine is built to generate campaigns with multi-millions of items, and large campaigns are substantially faster than before (days to minutes). The cost is a higher fixed startup cost per campaign, so a small campaign that used to generate quickly may now take a few additional minutes.
If a small certification does not need a composition review step before it starts, use the new Generate and Start option so the campaign kicks-off as soon as generation finishes rather than waiting for a manual start. The same applies to campaigns launched from workflows, where generate-and-start is now available and is generally the better pattern for small, targeted certifications.
Why are there two sets of certification email templates?
The new engine uses a new certification email template set. Your existing templates remain available and are labeled (Legacy) in the UI, with otherwise identical names, so you can compare them side by side.
As part of the GA rollout we migrate your customized notification content onto the new template set. After your tenant is migrated, we recommend reviewing the new templates to confirm the copy came across as expected and to replace any attributes that are no longer supported. See the link in the preparation section above for the list of attributes.
Do I need to do anything to run campaigns on the new platform? What about my saved and scheduled campaigns?
After your tenant is cut over, all newly generated campaigns run on the new platform with nothing required from you, with one exception: Role Composition campaigns continue to run on the legacy engine and will migrate at a later date.
Your templates and schedules are migrated, so the next time a campaign runs from a saved or scheduled template it will run on the new platform automatically. Campaigns that were already generated or in flight before cutover continue to run and remain reportable exactly as they do today; administrators can find them under Legacy Campaigns in the left navigation.
Reviewers should not need to know or care which engine a campaign is on. In-flight campaigns pick up the improved reviewer UI, but reviewers are not otherwise affected.
