Rules in Sailpoint IdentityNow

SailPoint Human Fabric (SHF) SHF Discussion and Questions
,
1

Hi All,

I’m new to SailPoint IdentityNow (IDN) and previously worked with SailPoint IdentityIQ (IIQ).

In IIQ, we can view the list of available rules through the Debug pages. I’m trying to understand how this works in IdentityNow.

I understand that IdentityNow uses Transforms for certain functionalities, and there are also different types of rules available in IDN.

Could someone please help me understand:

  1. Where can we find the list of rules available in an IdentityNow tenant?
  2. Is there any equivalent to the Debug pages in IIQ for viewing rules in IDN?
  3. Where exactly can we view or manage different types of rules from the IdentityNow UI?
  4. Are Transforms used as an alternative to rules, or do they serve a different purpose?

Any guidance or documentation would be greatly appreciated. Thanks in advance!

Regards,
Shubham

2

Hi Shubham,

The model is quite different from IIQ, so here are your four questions in order.

  1. Where to find the list of rules
    ISC has no rule list in the UI. Rules are limited and are not stored as editable objects the way they are in IIQ. You can read the rules in your tenant through the API (connector rules have their own endpoint, and an SP-Config export can include rule objects). You can also open a source or provisioning policy to see which rule it references. Cloud rules are installed by SailPoint, so the rule name only appears where it is used.

  2. Is there an equivalent to the IIQ Debug pages?
    No. ISC has no debug pages or object browser. You work through the UI, the REST APIs, the SailPoint CLI, vsCode Sailpoint ISC extension and SP-Config.

  3. Where rules are viewed and managed
    ISC has two types of rules: cloud rules and connector rules. Cloud rules run in the multi-tenant cloud and connector rules run on the virtual appliance. You can’t upload a cloud rule from the UI: it goes through a support request for review before SailPoint installs it in your tenant. Connector rules can be managed through the connector rules API.

  4. Transforms vs rules
    Transforms are the preferred, supported way to change data in ISC. They are JSON definitions you create and manage yourself, used for identity profile attribute mappings, provisioning policy fields, and similar tasks. Rules are code (BeanShell/Java) for cases transforms can’t handle, and SailPoint recommends using rules as a last resort and using ISC features instead whenever you can.

Hope this helps

3

I would add how to actually read the rules in your tenant, since that is the UI part you asked about.

Easiest no-code route is Configuration Hub: create a backup that includes the rule object types (or All Objects), then Actions > View Summary > View Details to read each rule as read-only JSON (RULE for cloud rules, CONNECTOR_RULE for connector rules).

Alternatively, use the SP-Config API: POST /beta/sp-config/export with "includeTypes": ["RULE", "CONNECTOR_RULE"]. It is async, so poll GET /beta/sp-config/export/{id} (the {id} is the returned jobId) until the status is COMPLETE, then download with GET /beta/sp-config/export/{id}/download. For connector rules specifically, GET /connector-rules/v1 lists them.

Docs: Configuration Hub backups, SP-Config