Required Permissions

Feedback Documentation Feedback Connectivity Documentation Feedback
1

The IQService supports configuration of the minimum permissions. The sources supporting IQService minimum permissions are:

This is the companion discussion topic for the documentation at https://documentation.sailpoint.com/connectors/iqservice/help/integrating_iqservice_admin/min_permission_config.html
2

Hi,

I’d appreciate some clarification on a couple points on this page:

  1. Under “Steps to assign full permissions to the user that is required to manage the IQService instance”
  • The instructions under this passage are a bit clunky and hard to understand. I’m especially having difficulty understanding what and where to look for line 4 - “Use the same user for “log on as service” from Services tab for the IQService instance”. I don’t see anything in registry editor, nor the IQService command line that could be the right analog.

Right underneath, there’s a passage on enabling TLS for IQService where I think adding a few details would greatly increase the readability and understanding for first time readers:

  1. " On IQService host, navigate to Personal Folder (on Local System) where the certificate exists." - this should instruct the user to go to the “Manage computer certificates” application and perform the subsequent steps. However, it doesn’t explain or show what the IQService cert is named for the user to even try to understand if it exists on the host machine. Most hosts are going to have multiple certificates with various names and naming schemes but, to me at least, the given instructions don’t provide enough details.
4

Hi Ilyas! Thank you for your input. We’re looking into your feedback, and we’ll update this thread when we’ve completed that review.

Thanks!

5

If the Log On User for IQService does not have administrator privileges to the server it’s running on, it is likely that account will not be able to start or stop the IQService instances. It appears IQService’s upgrade check considers this a requirement before it will check for an upgrade.

I found entries in my IQService trace log like 02/18/2026 14:53:13 : RpcServer [ Thread-7 ] INFO : "Log on user does not have start permission on : <IQService-name> . Skipping the check for upgrade."

I was able to grant the Log On User (a gMSA) access to start & stop the service with help of this article. I followed the steps outlined in “Manage Service Permission with Windows CMD” to add the permission tokens RP and WP to the SU (Service logon user) trustee for the primary and secondary IQService services.

IQService Commands