SailPoint IdentityIQ is SailPoint’s on-premises identity governance product. SailPoint’s FAQ on its Framework Customer Agreement states that SailPoint offers SaaS Services, on-premises Software and training, and that on-premises Software is provided on a term-license basis with Premium Support included in the subscription and licence fees.[1] On SailPoint’s navigation, IdentityIQ is described as enterprise identity governance to secure access at scale.[2] This article collects the rules that decide how an IdentityIQ licence is counted, supported and verified.
Editions
SailPoint does not publish IdentityIQ editions or a suite table for it. The cloud suite tables cover Identity Security Cloud and Atlas, and IdentityIQ is licensed as Software under an Order.[3][4] The agreement defines Software as the object code version of the specific SailPoint computer software purchased and licensed to the customer under an Order, or provided in connection with operating the SaaS Services, including updates, modifications, new versions and releases.[4] During the Order Term the customer receives a limited, non-exclusive, non-transferrable, non-sublicensable right to access, install, execute or use the SailPoint Offerings for its internal business operations.[4]
Metrics
IdentityIQ shares its licence unit with the cloud products. The current definitions state that Identity Security products are licensed by Identity according to Identity profiles, and the Inactive definition names IdentityIQ alongside Identity Security Cloud.[5]
| Metric | Definition |
|---|---|
| Identity [-IU] | A Person, Non-human Account or AI Agent with access within the governed environment or managed by the services.[5] |
| Lite Identity [-LU] | A Person or Machine whose access is limited to five Sources.[5] |
| Inactive Identity | An Identity or Lite Identity whose Identity State is set to inactive in Identity Security Cloud or IdentityIQ.[5] |
| IdentityIQ production instance | The unit of Software Support: a single production instance is supported, with further production instances available for purchase.[6] |
The deprecated definitions, last updated on 2023-10-26, defined the earlier IdentityIQ vocabulary. An Identity Cube was a unique collection of identity data for an active individual human, non-human or other user governed by SaaS Services or Software, with Business Partner, Lite User, Non-Human and Internal Identity types.[7] The Non-Human type was marked as applicable only to IdentityIQ Software and excluded service accounts used to run and manage applications in databases or operating systems.[7] The current definition of Non-human Account lists service accounts among the non-human mechanisms.[5] A customer that signed under the deprecated definitions and renews under the current ones should reconcile how service accounts were counted.
Counting and floors
Identities and Sources
The Identity and Lite Identity boundary is five Sources: a Lite Identity is a Person or Machine whose access within the governed environment is limited to five Sources, where a Source is a customer-managed or subscribed target system governed by the offerings.[5] The deprecated definitions drew the same line by describing Lite User and Business Partner Identity Cubes as limited to five governed Sources and Internal Identity as access to more than five.[7]
Inactive Identities
Customers may store Inactive Identities in addition to Active Identities, up to 30 percent of the combined total of licensed Identities and Lite Identities. An identity is Inactive in IdentityIQ when its Identity State is set to inactive.[5]
Production instances
Under the Support Policy SailPoint provides Software Support for a single production instance of the Software. A customer may buy support for additional production instances, meaning Software installed at a different location or used concurrently in production with a different configuration, if it deploys additional production instances for an Affiliate, business unit, division or other group as allowed under the agreement. A redundant or mirror site for backup, load share or archive purposes does not count as a separate instance.[6]
Scope of support coverage
A customer must buy Software Support for all Software licensed at an installation site to receive maintenance updates, and may not remove components or reduce the quantity of components from coverage under Software Support.[6] For term-licence Software, Software Support is provided at no additional cost during the License Term identified in the Order.[6] Read literally, quantity cannot be reduced selectively inside an installation site while keeping maintenance updates for the rest.
Virtualization and partitioning
The documents retrieved state no processor, core or virtual machine metric for IdentityIQ. The partitioning concept that appears is the production instance, with the mirror-site exception described above.[6] Non-production environments are handled by the support exclusions: the Framework Customer Agreement excludes pre-production and sandbox environments from the definition of SailPoint Offerings and provides no support, warranties or indemnification for trials, pre-production or sandbox instances.[4]
Cloud and self-hosted
IdentityIQ is installed and operated by the customer. Premium Support for customers using Software includes replacement of the Software at no charge if the media becomes destroyed or damaged so that it is unusable, in addition to support during local business hours, bug fixes and updates and enhancements.[6] SailPoint supports each version of the Software for a fixed period following its release. Software at End of Support is no longer eligible for Software Support, and software or documentation that is not compatible with currently supported Software is no longer made available.[6] On expiry or termination of the agreement the customer must cease using the Software and remove all Software and Documentation from its systems.[4]
Programs
- Term license. On-premises Software is provided on a term-licence basis with Premium Support included.[1]
- Premium Support. Provided for no additional fee during the Order Term, with Supplemental Support available for an additional fee. Access to Support is limited to a maximum of 10 named contacts per customer.[6]
- Usage verification. For Software, SailPoint may verify use, and the customer cooperates with requests that are made no more than once per calendar year.[4]
- Evaluation. The Evaluation Agreement grants rights to access, install and execute evaluation offerings for 30 days in a sandbox, non-production environment, without support.[8]
Audits and compliance
The Framework Customer Agreement lets SailPoint verify the customer’s use of the SailPoint Offerings against its current use rights and licences under all active Orders. For Software verification the customer cooperates with SailPoint’s requests to verify usage and adherence to the agreement, no more than once per calendar year.[4] The agreement does not specify the form of the evidence. For IdentityIQ a self-assessment would record the identity counts by profile, the number of Sources per identity near the five-Source boundary, the Inactive count against the 30 percent allowance, the number and location of production instances and the support coverage of each installation site.
Out of scope
The Identity Security Cloud suites are in SailPoint Identity Security Cloud licensing. The version-specific end-of-support dates are hosted outside the documents retrieved and are not reproduced. Prices are not published.