IdentityIQ 8.x to 9.0 upgrade
Cohash upgrades IdentityIQ 8.x estates to 9.0. You go to 8.5 first, through each GA release, and SailPoint's iiq-precheck runs on an 8.5 copy. We fix the javax references it finds in rules, plugins, connectors and forms, then move you to a Jakarta EE 10 application server. Upgrade and rollback are both rehearsed on production data before the real window.
- 01Reach 8.5
- 02Inventory and pre-check
- 03Fix custom code
- 04Build the new application server
- 05Rehearse upgrade and rollback
- 06Production upgrade
The story
Told without the client's name or anything that could identify them.
A bank's identity team ran IdentityIQ 8.3 on WebLogic, with years of BeanShell rules and several plugins written before anyone on the team joined. SailPoint's announcement of IdentityIQ 9.0 on Jakarta EE 10, and its decision to drop WebLogic, turned a routine upgrade into an application server change as well. We took a copy through each GA release to 8.5, ran iiq-precheck on it and sorted every javax finding into renames, developer fixes and code nobody used. The fixed code now runs on a Jakarta EE 10 application server in rehearsal, the upgrade and rollback are timed on a production clone, and the production date waits only on SailPoint's GA.
why it was urgentSailPoint announced IdentityIQ 9.0 on 6 October 2026 and still hasn't given a GA date. The release moves from Java EE 8 to Jakarta EE 10 and runs on Tomcat 10.1 and 11, JBoss EAP 8 and WebSphere Liberty. WebLogic is dropped. Staying on Tomcat 9 doesn't help, because Apache ends support for 9.0.x on 31 March 2027.
- openIdentityIQ runs on Tomcat 9 or WebLogic, and one of those has to change.
- recurringThe estate is on 8.3 or 8.4, two GA releases short of where the pre-check runs.
- blockedThere are hundreds of BeanShell rules and several plugins, and all of them predate everyone on the current team.
- openLeadership wants a firm upgrade date, but SailPoint hasn't announced GA yet.
The estate, before and after
Before: IdentityIQ 8.x on WebLogic with javax custom code
IdentityIQ governed joiners, movers and leavers on an 8.x release hosted on WebLogic. Custom rules and plugins used javax imports that only fail when a rule fires.
After: IdentityIQ 9.0 on a Jakarta EE 10 application server
Nothing changed for sources and targets. They connect to IdentityIQ 9.0, which now runs on a Jakarta EE 10 application server, with custom code fixed, executed and rebuilt and a rehearsed rollback for the database upgrade.
How we run it, phase by phase.
6 phases take you from SailPoint IdentityIQ 8.x to SailPoint IdentityIQ 9.0. Each one ends with something you can check before the next starts. As you scroll, the blocks show the estate moving across.
- phase 01
Reach 8.5
Record the version, patch level and e-fixes, then upgrade a copy through each GA release to 8.5 at its latest patch, with IQService upgraded at each hop and regression tests run after every step.
- phase 02
Inventory and pre-check
Rules, workflows, task definitions and applications are exported with export -clean, plugins and custom JARs are listed, and iiq-precheck runs on the 8.5 rehearsal copy to find every javax reference.
- phase 03
Fix custom code
Some findings are mechanical renames. Some need a developer, and some sit in code nobody uses, which can simply go. Rebuild plugins and connectors against Jakarta EE 10, and execute every changed BeanShell rule as well as scanning it.
- phase 04
Build the new application server
Pick Tomcat 10.1 or 11, JBoss EAP 8 or WebSphere Liberty and build the rehearsal environment on it. WebLogic shops have extra work, moving JNDI data sources, session settings and load balancer health checks.
- phase 05
Rehearse upgrade and rollback
Run the full upgrade at least twice on a production clone. Time the schema upgrade, and run go or no-go tests for aggregation, provisioning, requests and certifications. Rehearse the rollback restore as well.
- phase 06
Production upgrade
When SailPoint publishes GA and the platform matrix, book the production window and follow the rehearsed runbook, with a fixed no-go time and scheduled tasks paused.
What the client got
What changed for the client once the work was done. Described, not scored: we don't publish client figures.
- result 01
A tested route through every GA release to 8.5
We went hop by hop to 8.5 on its latest patch, upgrading IQService each time and recording the regression tests. So the pre-check and 9.0 start from a base we know.
- result 02
Every javax reference has a decision
We turned the iiq-precheck output into a single work list, split into renames, developer fixes and deletions. Every changed BeanShell rule was executed as well as scanned, and plugins were rebuilt against Jakarta EE 10.
- result 03
WebLogic is replaced
There's a working Jakarta EE 10 application server build, with the JNDI data sources, session settings and load balancer health checks moved over from WebLogic.
- result 04
Upgrade and rollback are rehearsed
The full upgrade ran at least twice on a production clone, with the schema upgrade timed and go or no-go tests for aggregation, provisioning, requests and certifications. The restore was rehearsed too.
- result 05
The production window has a runbook and a no-go time
Scheduled tasks are paused during the window. If we have to roll back, provisioning is logged so an aggregation can bring the restored 8.5 database back in line.
Risks we plan for
-
BeanShell fails at runtime
Rules are interpreted when they fire, so a missed import breaks a leaver workflow at night rather than at deploy. Every touched rule gets an execution test.
-
Unknowns before GA
SailPoint hasn't published the GA date, minimum source version or full platform matrix. The plan fixes what can be fixed now and leaves the production date open.
-
WebLogic exit
Moving off WebLogic is a project of its own, with data sources, clustering and load balancing to rebuild. It's planned separately from the code fixes.
-
Provisioning during rollback
If you roll back, anything provisioned after the upgrade started won't be in the restored 8.5 database. Pause provisioning or log it, so an aggregation can reconcile afterwards.
Where AI helps, and where it needs guardrails
SailPoint's Agentic Fabric, generally available since 4 August 2026, governs AI agents alongside people. For the upgrade itself, coding assistants handle the javax to jakarta renames that iiq-precheck reports pretty well. We still treat their output as a draft, running each rule and rebuilding and testing each plugin. If assistants get IdentityIQ data after the upgrade, give them a read-only MCP tool with its own scoped account.
forward deployed engineers →What you're left with
We write these for your setup, and they're working documents. Your team should be able to keep things running from them long after we've gone.
- tests01
Upgrade route to 8.5 with test results per hop
yours to keep - document02
iiq-precheck work list sorted into renames, developer fixes and deletions
yours to keep - document03
Jakarta EE 10 application server build
yours to keep - tests04
Rehearsal timings and go or no-go test results
yours to keep - runbook05
Production runbook with tested rollback
yours to keep
Platforms and services on this move
Services involved
Learn the background
Terms from this page in plain English. If you want the why, the field note behind it is right there.
- 01Rules
- The JavaScript snippets Auth0 used to run at login. Someone would write one to add a role to the token or block a sign-in, and each one ran after the last.in context →
- 02environment
- The thing that holds a set of apps, flows and agents plus their database. Admins see one per team in the list when it's Dataverse for Teams.in context →
- 03provisioning
- Creating, updating and removing accounts in an app automatically, based on who's assigned to it in Entra ID.in context →
- 04Runbook
- A written, step-by-step procedure for an operational job like a cutover. Your on-call engineer should be able to follow it without phoning whoever wrote it.in context →
- 05Jakarta EE
- Java EE's successor. Since Jakarta EE 9, packages are jakarta.*, not javax.*.in context →
- 06Application server
- The server a Java web app runs in, like Tomcat, JBoss EAP or Liberty. WebLogic shops have to pick a new one for 9.0.in context →
Certified engineers, wherever you need them.
Some clients want a project team, some want a couple of engineers on theirs. Either works. Onsite, nearshore or offshore, with handovers across time zones that keep things moving.
Onsite
Engineers at your sites in the US
Nearshore
Overlapping hours with US teams
Offshore
Overnight progress on your backlog
All time zones
Coverage handed over across time zones
01When is IdentityIQ 9.0 generally available?
As of 20 October 2026, there's no GA date from SailPoint. That doesn't stop you doing the 8.5 upgrade, the pre-check and most of the code fixes now. The production date waits for GA.
02Do we have to go through 8.5?
iiq-precheck only runs on 8.5 and 9.0, which makes 8.5 the practical place to stage. Field guidance says to install each intermediate GA release on the way there, and we confirm that route with SailPoint Support for your environment.
03Should we move to Identity Security Cloud instead?
Depends how much custom code you own, and whether you must stay self-hosted. The pre-check report counts what has to change in both cases, which makes the estimates comparable.
04How long does the code work take?
Count the custom rules, plugins, connectors and XHTML forms and you have most of the answer. Small estates can be done in days. Several plugins and custom connectors push it to weeks, before regression testing.
Often on the same roadmap
On-premises Active Directory to cloud-first Microsoft Entra ID
We shrink on-premises Active Directory one application at a time, moving groups, users and app authentication to Microsoft Entra ID as each app is ready.
read the case studyAD FS federation to Entra ID authentication
Converting federated domains from AD FS to Entra ID cloud authentication, moving relying parties app by app and retiring the AD FS farm.
read the case studyMoving Auth0 Rules and Hooks to Actions before Auth0 switches them off
Moving Auth0 Rules and Hooks to Actions before Hooks stop on 30 April 2027 and Rules on 31 January 2028, with token claims checked before and after each change.
read the case studyad73bc5b - 01Book a 30-minute working sessionsenior engineer
- 02Talk to an engineer about your setupreply within 24 hours
- 03See how similar projects wentcase studies
Planning this move?
A 30-minute working session with a senior engineer. No slides.
- The platform and the version you're on
- Where you need to get to, and by when
- What's custom: rules, plugins, integrations
- Any audit finding or deadline driving it