ISC deployement steps : best pratice

[baoussounda (Ousmane N'DIAYE)]

Hi,

I resume a typically steps for ISC deployment :

• Creation of administrative accounts in Identitynow Admins Source

• Install Virtual appliance

• Install IQ Service ==> ? (or wait AD connector integration) ?

• UI Customization

• Testing all SSL and opening ports for main targets

• Integrate authorative source: source configuration, aggregation and test, identity profile creation, lifecyclestate definition, mapping definition

• Integrate others connectors by priority : source configuration, entitlement and account aggregation, Create account profile definition + test

• Define birth rights access

• JML process definition

• Attribute synchronization

• Email customization

• Access Modeling

• Tests

• Migrate progresively configuration to production

Is any important technical steps that are forgetted ?

[baoussounda (Ousmane N'DIAYE)]

@KRM7 please let me know if you have another idea about this steps.

[KRM7 (Krishna Mummadi)]

Hi @baoussounda

This is a very good discussion, you almost covered. I am just re-arranging based on my experience in

• Sandbox to PROD replication
• Cross tenant migration (our company name changed, couldn’t change the url simply)
• IIQ to IDN migration
• IDN setup from scratch

1. Creation of administrative accounts in IdentityNow Admins Source
   → Create all your teammates as admins, once your HR source is onboarded, remove all your teammates except one or two or a break glass account.

2. UI Customization
   → Change the logo and colors, won’t take much time
   → You need to add no-reply email address from SailPoint to your org email
   → Add the domain, verify it using DNS

3. Install Virtual appliance
   → Make sure you have 2 in PROD, 1 is enough in Sandbox
   → Make sure the ports are opened

4. Install IQ Service
   → I believe your org uses AD, so go for it.
   → 1 for PROD and 1 for Sandbox is enough unless you have a lot of users and more AD based applications
   → However in Sandbox 1 is enough

5. Integrate Authoritative source
   → Source configuration
   → Account Schema
   → Correlation
   → Test connection
   → Account Aggregation
   → Schedule Aggregation

6. Identity Profile creation for Authoritative source
   → Create IDP with priority lesser than (number higher than) Identity Now admins IDP which is default
   → Identity Profile settings
   → Mappings
   → LCS Provisioning
   → You need to decide how many LCS you need, I suggest Prehire, Active, Inactive, and Deleted.

7. Searchable attributes
   → We can make attribute searchable a max of 15, so we need to carefully choose attributes

8. AD connector Integration

9. Other connectors based on priority
   → Source configuration
   → Entitlement and account aggregation
   → Create Account Provisioning Policy form
   → Handle attribute sync for all sources, for HR source you might need to sync email address
   → Set if you need to send email notification when a user account is provisioned

10. Password Policies

11. Access Model
    → Create Access Profiles
    → Create Roles (Request and condition based)

12. Email Template Customization
    → You need to edit OOTB email templates

13. Governance Groups

14. Segments

15. Applications

16. Reports
    → Subscribe to reports for various purpose

17. Certifications

18. SoD Policies

19. Workflows

20. Replication in PROD
    Use Configuration Hub and VS code extensions to replicate configs in PROD

There will be some more like Transforms and Rules development which you will come to know as the work progress.

Hope this helps you

Thanks
Krish

[baoussounda (Ousmane N'DIAYE)]

It’s very clear, Thanks @KRM7