Upgrading to SailPoint IdentityIQ 9.0: what breaks and what to fix first

SailPoint has announced IdentityIQ 9.0, the next major version of the identity software big companies run on their own servers. If you're on 8.x, don't start with the new features. Check which server it runs on and how much custom code your team has written, because that's where the upgrade work sits.

IdentityIQ grants and removes access across the whole company, so when an upgrade breaks it, people notice within a day. New starters wait for accounts, leavers keep theirs, and access reviews stall halfway through an audit cycle. With 9.0 we'd expect most of the effort to go on the server and the custom code. The new features are the easy part.

Waiting has a cost as well. Tomcat 9.0.x support ends on March 31, 2027, and IdentityIQ 8.5 can't move to Tomcat 10 or 11. If yours runs on Tomcat, you can rely on a 9.1.x branch SailPoint hasn't said it will support for 8.x, or move 8.5 to another app server it supports, such as JBoss EAP or WebSphere Liberty. Otherwise you'll need to be on 9.0 by then.

SailPoint's press release talks about "the release of IdentityIQ 9.0", but there's no confirmed general-availability date. A March 2026 SailPoint community post gave a tentative target of Q4 2026, and as of October 22, 2026 there were no public release notes or 9.0 supported-platforms list. On October 7 an Expert Ambassador on SailPoint's developer forum wrote that no confirmed release date had been published, and on October 13 a forum member running IdentityIQ 8.5 called 9.0 "still not yet released". Most of what follows comes from SailPoint's own public pages. Where we lean on community forum posts, we say so. We'll update this post when the release notes go public.

SailPoint aims 9.0 at customers with extensive data residency requirements, strict regulatory constraints or deeply customized programs. If that's you, you kept identity governance on premises on purpose, and the gains land differently depending on your job.

• Security leaders: exact start and end times on roles and entitlements. Privileged access ends at the time you set.
• Platform teams: current app servers, before Tomcat 9.0.x support ends in 2027, so you can plan to get off Tomcat 9 in time.
• Reviewers: their review settings stick between sessions, and search finds everything the first time. Campaigns go faster when nobody rebuilds their view.
• Business administrators: SailPoint redesigned application setup for the people who now actually do that work.
• Owners and auditors: the people who know the data review ownership and descriptions themselves. Auditors get records someone actually checked.
• Developers: one standard way to configure custom forms and scripts. Carrying that code into the next upgrade gets easier.

Who has the most work to do: teams on WebLogic or Solaris, which face a platform move as well as an upgrade, and teams with years of custom plugins and rules, where the javax-to-jakarta change concentrates. For them, the scan and a rehearsal matter more than the feature list.

We've only put in what SailPoint has said publicly about 9.0. Read the Jakarta EEdefinitionJava EE's successor. Since Jakarta EE 9, packages are jakarta.*, not javax.*. 10 card first, since that's the one that decides how much custom code you rewrite.

From javax to jakarta. IdentityIQ 8.x is built on Java EE, the standard Java plumbing for servlets and web services. Java EE moved to the Eclipse Foundation and became Jakarta EE. In December 2020 Jakarta EE 9 renamed its specification packages from javax.* to jakarta.*, which is why so much old code breaks on new servers. Tomcat split the same way: Tomcat 9 is the last one for Java EE, 10.1 is built for Jakarta EE 10 and 11 for Jakarta EE 11.

Back in 2025 SailPoint said Tomcat 10.1 and 11 had to wait until IdentityIQ became a Jakarta EE application. That couldn't happen in 8.5, so it went on the list for the next big version. Then SailPoint named it: 9.0 is built on Jakarta EE 10, and your app servers have to support Jakarta EE 10 too.

So look at your own code first. Plugins, custom JARs and rules that import Jakarta EE classes under javax.*, such as javax.servlet, need changing. Packages that belong to core Java itself keep their javax names. It's the same dependency that keeps IdentityIQ 8.5 off Tomcat 10 and 11, which a community Ambassador spelled out on SailPoint's developer forum in August 2026.

Time-based access, down to the time of day. You've had temporary access for a while. 8.4 calls them sunrise and sunset dates, 8.5 calls them start and end dates, and you put them on a role or on one person's access to a role or entitlement. Out-of-the-box workflows act on them, and a separate setting sends a notice before access expires. What SailPoint says 9.0 adds is exact start and end times, with time zone support, across roles and entitlements. It's pitched at privileged access on critical systems, where access should exist only while it's needed.

Less friction for reviewers and admins. Reviewers keep their preferences between sessions, and SailPoint says search returns complete results the first time. Application setup was redesigned for business administrators. Upkeep of governance data moves too. Business owners now review ownership records and entitlement descriptions on a schedule, so central administrators aren't left maintaining them. Worth showing each group in your rehearsal environment before go-live.

An upgrade tool, because upgrades are where on-premises programs stall. SailPoint's press release calls the manual work the main risk that stalls on-premises upgrades, and 9.0 comes with tooling that scans the environment, finds what has to change and handles most of it automatically. SailPoint has also described a pre-check utility for the Jakarta EE 10 move. It finds custom Java classes that conflict with Jakarta 10, rules, forms and workflows whose BeanShell scripts conflict, and custom applications whose formPaths point to XHTML files. Public sources don't say whether the pre-check and the upgrade tooling are the same tool, so ask SailPoint.

We kept the table to what's publicly documented for 8.4, 8.5 and 9.0. If a cell says a detail isn't public, SailPoint hasn't published it outside the customer login. That doesn't mean the feature is missing.

Two notes on the table. The WebLogic and Solaris rows for 8.5 come from SailPoint's own notices, which say support ends with 9.0 and send you to the 8.5 supported-platforms list for today's support. The 8.4 temporary access cell comes from the 8.4 docs. They call start and end dates sunrise and sunset dates.

Support timeline. SailPoint's support policy says each software version is supported for a fixed period after release, and that a version at End of Support is no longer eligible for software support. The per-version table lives on SailPoint's Compass community. The link in the public policy no longer resolves, and the supported-platforms matrix asks for a customer sign-in, so we can't state end dates for 8.3, 8.4 or 8.5 here. For scale, SailPoint's upgrade notes record that IdentityIQ 8.1 reached limited support on February 21, 2023 and dropped support on February 21, 2024. Ask your SailPoint Customer Success Manager for the dates that apply to your version.

From the outside, an IdentityIQ 9.0 deployment looks like an 8.5 one: people use the web interface, the application talks to its database and to your applications through connectors, and IQServicedefinitionIdentityIQ's Windows service, for anything only Win32 APIs can reach., the Windows service IdentityIQ uses for Win32 APIs, still has a job to do. The change is in the middle tier: the application serverdefinitionThe server a Java web app runs in, like Tomcat, JBoss EAP or Liberty. WebLogic shops have to pick a new one for 9.0., the Java packages the code uses, and every piece of your custom code that touches them. The diagrams are simplified. The 9.0 side shows the changes SailPoint has announced; we've drawn the database and IQService as they are in 8.5 because SailPoint hasn't published 9.0 requirements for them.

SailPoint hasn't published an upgrade path to 9.0. Its public upgrade considerations page says versions can be skipped, but community members report different guidance from SailPoint directly. In a September 2026 forum thread, one member of SailPoint's Expert Ambassador program (a community member, not SailPoint staff) wrote that SailPoint Customer Success Engineering advises installing every intermediate GA release. Another said SailPoint confirmed to them that an upgrade from 8.3 should go through 8.4 and then 8.5. Get your path confirmed in writing for your exact version before you schedule anything. The steps below are the order we'd work in, based on what's public.

# run on your exported rules and plugin source
# example only: add the other Jakarta EE javax packages you use
$ grep -rlE 'javax\.(servlet|faces|ws|mail|persistence)' export/ plugins/
export/Rule-LeaverCleanup.xml
plugins/requestPortal/src/web/AuthFilter.java
# each file here needs a jakarta rewrite

9.0 is a big jump because years of custom code and an aging platform pile up between upgrades. These are the habits that make the next one smaller, whatever SailPoint changes next.

Cohash's identity practice plans and runs IdentityIQ upgrades. For 9.0, we review custom rules, workflows and plugins for the Jakarta EE move and rehearse on a copy of production data first. See the SailPoint platform page, hire SailPoint engineers for your own team, or book a free assessment of your IdentityIQ estate.