We recently acquired the Identity Graph in our tenant and wanted to understand few things:
What data source does it use? Is it using the same data source as AIC and AI?
How often does the data refresh happen? I don’t see this mentioned anywhere in the documentation.
We have an Identity which was terminated a while ago and both Identities UI and Search shows that user don’t have some of these entitlements but it is showing in the Identity Graph as having one. We have tried running manual processing as well and it didn’t remove those from the Identity Graph view. So, we were wondering what is the refresh rate and what does it take to show the accurate data in the Graph UI?
Anyone from product team here respond to these queries?
Identity Graph uses data from ISC identities, accounts, entitlements, roles, and access relationships, but it may not refresh through the exact same pipeline as AIC/AI.
SailPoint does not seem to publish a fixed refresh interval for Identity Graph, so some delay is expected. In that case, I would recommend raising a SailPoint Support case and asking them.
Hello Nischal. Manish is pointing in the right direction. SailPoint does document the expected delay. The Managing Snapshots page says changes to access objects can take up to 6 hours to appear in Identity Graph. I would treat that as a propagation window, not a fixed refresh schedule.
Since you mentioned the identity was terminated a while ago, I would check when that entitlement actually disappeared from ISC. If Search and the Identity page have shown it as removed for well over six hours, but Identity Graph still shows the relationship, I would open a Support case. I would include the identity ID, entitlement ID or name, approximate removal time, and a JSON export from Identity Graph if possible.
For the data-source question, Identity Graph uses the identity and access data available in ISC and SailPoint describes it as built directly on Atlas. I could not find anything public confirming it uses the same refresh pipeline as AI or AIC, so I would not assume they refresh together.