SailPoint IAM: Where It Fits in an Identity Programme

"We already have Okta — why do we need SailPoint?" and "Isn't that what Active Directory is for?" are the two questions every SailPoint consultant in India hears in a kickoff meeting. Both are fair, and both come from the same gap: the word IAM covers five different jobs, and SailPoint does only one of them. This guide draws the map.

What is SailPoint IAM?

SailPoint IAM is identity governance and administration (IGA) software from SailPoint, Inc. that decides, approves, reviews and audits what access every identity in an organisation should hold. SailPoint IdentityIQ (IIQ) is the self-hosted platform and Identity Security Cloud (ISC) is the SaaS platform; neither one performs login, single sign-on or multi-factor authentication.

The confusion starts with the acronym. "IAM" (identity and access management) is the umbrella term for everything an enterprise does about digital identities. Inside that umbrella sit several distinct product categories, and SailPoint lives in exactly one of them — governance. A useful one-line test from the identity consultancy Iden: answers that change by the second (is this login valid right now?) belong to access management; answers that stay stable for days or months (should this person have this entitlement at all?) belong to governance. SailPoint answers the second kind of question.

Concretely, a SailPoint IAM deployment does six things, each of which maps to a module in IAM Careers' 15-module IIQ curriculum:

If you want the company-level picture — products, ownership, customers — read what SailPoint is and who uses it. If you want the IAM / IGA / PAM vocabulary in depth, our IAM vs IGA vs PAM explainer covers the definitions. This post does something neither of those does: it shows how SailPoint connects to the other four layers in a running enterprise.

How does an identity programme fit together, and where does SailPoint sit?

A typical enterprise identity programme has five layers: an authoritative HR source, directories, access management (SSO and MFA), identity governance, and privileged access management. SailPoint IdentityIQ occupies the governance layer and connects to all four others — reading identity data from HR, provisioning accounts into directories, and certifying the access that SSO and PAM tools enforce.

The table below is the map most new SailPoint learners wish they had on day one. Tool names are illustrative; a bank in Mumbai or Charlotte may run different brands in each row, but the layers are the same.

Layer model compiled by IAM Careers from Okta's SailPoint IdentityIQ Best Practices Integration Guide, SailPoint's product documentation and SailPoint Developer Community threads, checked 16 October 2026. Tool names are examples, not endorsements.

Follow one person through the layers and the division of labour becomes obvious. A new analyst joins HDFC Bank's Pune office. Workday (layer 1) records the hire. SailPoint IIQ (layer 4) aggregates that record, matches it to a birthright role and provisions an Active Directory account (layer 2) plus the AD groups the role needs. The next morning the analyst logs in through Microsoft Entra ID or Okta (layer 3), which checks the password, enforces MFA and shows the apps those AD groups unlock. Six months later a manager certification in SailPoint asks whether the analyst still needs each entitlement. If she becomes a database administrator, SailPoint approves the privileged role and CyberArk (layer 5) vaults the credential. Every layer did a different job; nothing was duplicated.

Does SailPoint do SSO and MFA?

No. SailPoint IdentityIQ and Identity Security Cloud do not provide single sign-on, multi-factor authentication or password-less login for business applications. Authentication belongs to access management platforms such as Okta, Microsoft Entra ID and Ping Identity; SailPoint governs the accounts, groups and entitlements those platforms enforce, and the two are normally deployed side by side.

This is the single most common misunderstanding we meet in demo sessions, so it is worth quoting the vendors themselves. Okta's published integration guide for SailPoint IdentityIQ states that "Okta will be used as the main platform for User Authentication" and that "SailPoint will be used as the main platform [for] Access Request, Access Certification." SailPoint's own comparison page says that "many enterprises run Okta for authentication and SailPoint for governance" and calls that co-existence "the industry norm at Fortune 500 scale." A Wipro employee answered the same question on Fishbowl in four words: "SailPoint IdentityIQ for IDM and Okta for IAM."

What the integration looks like in practice, as described in that Okta guide:

• HR stays authoritative. "The HRMS will typically be the primary authoritative source of identity data." Neither Okta nor SailPoint invents identities.
• SailPoint decides, Okta enforces. SailPoint approves a request and pushes the user into an Okta group; Okta's group rules then grant the application and apply the MFA policy.
• Two-way sync. The integration is bi-directional, so either platform can relay user and group changes to the other.
• Okta becomes a managed application in IIQ. In the SailPoint Developer Community guide to onboarding Okta in IdentityIQ, a practitioner aggregated 189,100 Okta accounts, provisioned and disabled accounts, and noted that leaver processing had to be adjusted because "Okta deactivation already removes applications." That is the governance tool treating the SSO tool as a target — exactly what Module 3, Application Onboarding, teaches.

SailPoint does have a login page of its own, and IIQ can be put behind the corporate SSO so administrators and certifiers sign in with their usual credentials. That is SailPoint consuming SSO, not providing it. For a career-level comparison of the two platforms — job counts, pay, which to learn — see SailPoint vs Okta 2026, and for the governance add-on Okta sells, Okta Identity Governance vs SailPoint.

Does SailPoint do privileged access management (PAM)?

No. SailPoint does not vault passwords, rotate credentials or record administrator sessions; those are privileged access management (PAM) functions delivered by CyberArk, BeyondTrust or Delinea. SailPoint IdentityIQ governs who is permitted to hold a privileged account, certifies that access periodically and treats the PAM vault as one more application it provisions into.

The relationship is complementary rather than competitive, and practitioners say so plainly. On PeerSpot, an identity management consultant answering "how does SailPoint IdentityIQ compare with CyberArk PAM" wrote that "the two products are actually complimentary" and that "SailPoint does not provide the vault and session management functions that CyberArk does." In that model SailPoint handles access and certification while CyberArk handles vaulting and session control.

Two 2026 facts make this layer matter more for careers, not less. First, Palo Alto Networks completed its acquisition of CyberArk in February 2026, so the PAM leader now sits inside the largest cybersecurity vendor — enterprises are not going to rip it out. Second, ITJobsWatch data for the six months to 15 October 2026 shows that 66% of UK permanent job ads citing SailPoint also cite CyberArk. Employers hire SailPoint engineers who understand the PAM boundary, because the SailPoint-to-CyberArk handoff (who may request a safe, who approves it, how the privileged role is certified) is a governance design question, not a vault question. Our SailPoint vs CyberArk 2026 comparison goes deeper on which to learn.

Does SailPoint replace Active Directory or Microsoft Entra ID?

No. Active Directory and Microsoft Entra ID are directories that store accounts, passwords and groups; SailPoint IdentityIQ is a governance system that reads those directories, provisions accounts into them and certifies their group memberships. SailPoint needs a directory to govern; a directory without SailPoint simply has no automated answer to "should this account exist?"

Active Directory is the first non-HR application almost every IIQ project onboards, which is why the Direct Connect and Identity Mapping topics in Module 3 (Application Onboarding) and the aggregation and refresh tasks in Module 4 (SailPoint Jobs) take up so much of the early weeks of IAM Careers' live online SailPoint IIQ course. A practitioner on the SailPoint Developer Community asked in 2026 whether the join engine of a meta-directory server could be migrated into SailPoint; the answer from an experienced architect was yes, with a warning that frames the whole relationship: "Think of SailPoint as a Governance tool with lifecycle functionality," not a data-synchronisation engine, and "it's not a simple lift-and-shift."

The directory question has a 2026 twist. Microsoft now sells Entra ID Governance, which adds lifecycle workflows and access reviews to the directory itself, and 75% of UK SailPoint job ads in the six months to 15 October 2026 also mention Entra ID (ITJobsWatch). For Microsoft-centric estates with simple needs, Entra's built-in governance can be enough; for banks and regulated enterprises with SAP, mainframes, custom applications and multi-step approval chains, SailPoint remains the governance layer and Entra remains the directory. SailPoint vs Microsoft Entra 2026 sets out that decision in detail.

What does a SailPoint IAM engineer do, and what does the role pay?

A SailPoint IAM engineer onboards applications into SailPoint IdentityIQ, builds joiner-mover-leaver logic, configures certifications and policies, and integrates SailPoint with directories, SSO and PAM tools. Naukri listed 6,164 vacancies mentioning SailPoint across India in September 2026, and UK permanent SailPoint ads carried a median salary of £85,000 in October 2026 (ITJobsWatch).

Because SailPoint sits in the middle of the programme, the job descriptions read like the layer table above. A Bengaluru IAM engineer posting at Rubrik asked for four years of IAM experience, SailPoint or a comparable IGA platform, and familiarity with "SSO, SCIM, MFA, OAuth, SAML, OpenID Connect, and LDAP", with Okta listed as a nice-to-have. In the UK, 87% of SailPoint ads also cite "Identity Access Management", 75% Entra ID, 66% CyberArk, 64% Azure and 58% Okta (ITJobsWatch, six months to 15 October 2026). Nobody is hired to know SailPoint alone; everybody is hired to know where it fits.

These are market estimates, not guarantees. Salary depends on prior experience, employer, and interview performance. International salary figures are market estimates sourced from public job listings and salary aggregators. Actual compensation varies by employer, location, experience, and individual negotiation. For India-specific bands by role see SailPoint IIQ salary in India 2026; for the US and UK in depth see SailPoint salary in USA and UK.

In India the work concentrates in three employer types: the Big 4 and IT services firms (Deloitte, Accenture, EY, Infosys, TCS, Wipro, Mphasis) that implement SailPoint for clients; the global capability centres of banks (HSBC, JP Morgan, Wells Fargo, Barclays) that run it in-house; and a smaller set of product and SaaS companies. The IAM career roadmap page shows how an analyst becomes an IIQ developer and then an architect.

Which should you learn first — SSO, Active Directory or SailPoint?

Learn directory and SSO basics to the level of understanding, then specialise in SailPoint IdentityIQ, because governance is where enterprise projects, regulated-industry budgets and the higher-paid developer and architect roles concentrate. You do not need to be an Active Directory or Okta administrator first; you need to know what each layer does so your SailPoint design respects it.

The honest version of the advice depends on where you are starting from:

IAM Careers' 45-day live online SailPoint IIQ programme is built on that order. Module 1, IAM Overview, puts SailPoint in the layer map before anyone touches the product; Modules 3 and 4 onboard Active Directory and an HR source; Modules 11 and 12 build the certifications and lifecycle events that make the governance layer real; Module 15, SailPoint Troubleshooting, reads the logs when a provisioning to AD fails. Classes are live on Zoom, every class is recorded in the LMS, batches are capped at 15 learners, and the IIQ track is led by Oishi, who has 15 years of enterprise IAM and SailPoint experience. Practical work is guided hands-on practice: trainer-led live demonstrations, step-by-step exercises and real scenarios. Fees are Rs. 25,000 for IIQ and Rs. 27,000 for the ISC track; the course fees guide explains what is included. Ask on WhatsApp (+91 93909 81953) for the next batch date.

Is SailPoint IAM still relevant in 2026?

Yes. SailPoint remains the governance layer for most large regulated enterprises in 2026, and the growth of non-human identities, AI agents and cloud entitlements is expanding what that layer must govern rather than replacing it. UK permanent SailPoint job ads rose from 33 to 53 year on year in the six months to 15 October 2026 (ITJobsWatch).

Three trends are reshaping the layer map without removing SailPoint from it. Vendors are converging — Okta sells a governance add-on, Microsoft sells Entra ID Governance, Palo Alto Networks now owns CyberArk — so "where does SailPoint fit" is a question buyers ask more often, not less, and the answer still favours a dedicated governance platform wherever SAP, mainframes and multi-step approvals exist. Identities are multiplying: service accounts, bots and AI agents now outnumber people in many estates, and SailPoint's 2026 product line explicitly governs machine and agent identities, which the SailPoint in the AI era post covers. And regulators keep asking the governance question: SOX in the US, FCA and UK GDPR in Britain, RBI and SEBI in India all require evidence of who approved access and whether it was reviewed — evidence that the SSO layer cannot produce and the governance layer exists to produce.

For a learner, the practical conclusion is simple. The login layer is becoming a commodity that cloud vendors bundle; the governance layer is where regulated enterprises still spend, still customise and still hire. Learning SailPoint IdentityIQ with IAM Careers is learning the layer the other four report to.