SailPoint add-ons and advanced capabilities licensing covers the modules that SailPoint sells next to the core Identity Security Cloud and Agentic suites. The suites page lists them under the heading advanced capabilities: Non-Employee Risk Management, Access Risk Management, Cloud Infrastructure Entitlement Management and Password Management.[1] Other capabilities, such as Data Access Security and Accelerated Application Management, appear as included or available items for particular suites.[1]
Editions
Add-ons by suite
The SailPoint suites page states which capabilities are included in a suite and which are available as add-ons.[1]
| Suite | Included | Available add-ons |
|---|---|---|
| Standard | none listed | Accelerated Application Management, Cloud Infrastructure Entitlement Management, Password Management |
| Agentic Business | Data Access Security | Accelerated Application Management, Cloud Infrastructure Entitlement Management, Password Management, Non-Employee Risk Management, Access Risk Management |
| Agentic Business Plus | Cloud Infrastructure Entitlement Management, Atlas Enterprise, Data Access Security | Accelerated Application Management, Password Management, Non-Employee Risk Management, Access Risk Management |
The Identity Security Cloud Suites documentation, dated 2026-05-14, lists the same Foundations to Business Plus suite contents without an add-on table, so add-on availability for those suites is a question for the Order.[2]
Non-Employee Risk Management
Non-Employee Risk Management governs non-employees, such as contractors, vendors and business partners. On the suites page it is an add-on to the Agentic suites.[1] Its licensing relevance in the definitions is the Inactive Identity rule: an identity is Inactive if its profile is set to archived in Non-Employee Risk Management, and Inactive Identities are limited to 30 percent of the combined total of licensed Identities and Lite Identities.[3] The deprecated definitions had a Business Partner Identity Cube type for non-employees or affiliates, limited to five governed Sources each.[4]
Access Risk Management and Identity Security for SAP
The Identity Security for SAP section, last updated 2024-10-17, defines three integration packages.[5]
| Package | Contents |
|---|---|
| SAP Basic | The customer chooses four of eight listed cloud integrations (SAP Concur, SAP Ariba, SAP Fieldglass, SAP Analytics Cloud, SAP SuccessFactors Employee Central, SuccessFactors LMS, SAP Commerce Cloud, SAP Integrated Business Planning) |
| SAP Core | Everything in SAP Basic plus on-premises integrations (SAP Web Portal, SAP Sybase, SAP HR/HCM, SAP HANA Database, SAP Business Suite, SAP GRC) and cloud and hybrid integrations (S/4HANA Public Cloud, SAP BTP Cockpit, SAP Identity Directory, SAP Direct for S/4HANA Private Cloud) |
| SAP Advanced | Everything in SAP Core plus SailPoint Access Risk Management |
SailPoint reserves the right to add or remove integrations from each package at any time and is not responsible for the availability of SAP products or services. If an integration becomes unavailable because of changes to the connected SAP product, the customer is not entitled to a refund of fees paid or a discount on future fees.[5]
Cloud Infrastructure Entitlement Management, Password Management and Data Access Security
Cloud Infrastructure Entitlement Management is an add-on to Standard and Agentic Business and is included in Agentic Business Plus. Password Management is an add-on to Standard, Agentic Business and Agentic Business Plus. Data Access Security is included in both Agentic suites.[1] The documents retrieved state no separate licence metric for these modules. The deprecated definitions, last updated 2023-10-26, listed a Business Plus suite that included Cloud Infrastructure Entitlement Management, SaaS Management and Access Modeling, which shows the packaging has moved between suites over time.[4]
Accelerated Application Management
SKUs beginning with SAAM are covered by the SailPoint SAAM Product Specific Terms, whether the offering is licensed as a standalone product or included in a suite or other bundle. The terms deem technical components of SAAM to be SaaS services and services components to be professional services under the applicable agreement.[6] The terms record that SailPoint engages Google Cloud Platform as the hosting provider for SAAM, with the instance located in the European Union.[6]
Shadow AI Remediation
SKUs including DIF and DIFA are covered by the SAIR Offerings Product Specific Terms. Shadow AI Remediation is a component of both the DIF and DIFA SKUs and is hosted by SailPoint on Google Cloud Platform in the European Union or, if available, the processing location that best matches the customer’s Identity Security Cloud instance.[6]
Machine Identity Security and Agent Identity Security
The Identity Security Cloud documentation separates machine identity and AI agent governance from the human documentation: machine identities are referred to only in the documentation specific to Machine Identity Security and Agent Identity Security.[7] The licence consequence is in the identity types. Non-human Accounts and AI Agents are separate identity types, AI Agents are a separate identity type for pricing, and machine accounts are not eligible to be governed as AI Agents under Agent Identity Security or other AI Agent-focused offerings.[3]
Metrics
| Metric | Relevance to add-ons |
|---|---|
| Inactive Identity | Archived Non-Employee Risk Management profiles count as Inactive Identities.[3] |
| Non-human Account | The non-human identity type used for machine governance.[3] |
| AI Agent | The AI Agent type used for agent governance and priced separately.[3] |
| Identity [-IU] | The base licence unit to which add-ons attach.[3] |
Counting and floors
No floors are published for the add-ons. The Agentic Business and Agentic Business Plus packages include an initial one-time allotment of five non-human identities for each human identity, and SailPoint states that the ratio will not fall below 5:1 on General Availability or afterwards.[1] Because an AI Agent is a separate identity type for pricing, the allotment and the AI Agent count should be recorded separately from the Non-human Account count.[3]
Virtualization and partitioning
The retrieved documents contain no virtualization rules for the add-ons.
Cloud and self-hosted
The add-ons covered here are SaaS or SaaS-delivered. The Product Specific Terms specify hosting location for SAAM and SAIR, and the AI Terms govern the AI Features inside the SaaS Services: the customer may use them solely for internal business purposes, and Customer Data is not used to train shared models deployed outside the tenant unless the customer opts in.[6]
Programs
- Non-human allotment. The initial 5:1 allotment described above.[1]
- Inactive Identity allowance. Applies to archived Non-Employee Risk Management profiles.[3]
- Updates to Product Specific Terms. For SAAM, SAIR and Agentic Fabric Entro terms, updates apply immediately to offerings bought after the update; for earlier purchases updates will not materially degrade performance or security posture and, subject to legal obligations, do not apply until renewal.[6]
Audits and compliance
Usage verification under the Framework Customer Agreement applies to all SailPoint Offerings, including add-ons: SailPoint verifies use against current use rights under all active Orders and monitors SaaS usage against entitlement.[8] Because the metric for several add-ons is not public, the Order is the document to read before treating an add-on as unlimited within a suite.
Out of scope
The core suites are in SailPoint Identity Security Cloud licensing. Agentic Fabric Entro terms are named in the Product Specific Terms but their contents are not summarised here. Prices are not published.