SailPoint, implemented, upgraded and kept current.
We implement and upgrade SailPoint IdentityIQ and Identity Security Cloud, build the connectors and roles behind them, and plan upgrades the week SailPoint ships them.
Cohash implements and upgrades SailPoint IdentityIQ and Identity Security Cloud, including connectors, lifecycle automation, roles, certifications and separation-of-duties rules.
IdentityIQ 9.0 was announced on 6 October 2026. For that upgrade we plan the path through 8.5, run SailPoint's pre-check and fix the custom code it flags before the window.
you probably need this if
You are on IdentityIQ 8.3 or 8.4 and nobody has mapped the route to 9.0 yet.
Custom rules and plugins mean every upgrade turns into a months-long project.
Certification campaigns close because the deadline passed, not because anyone decided.
terms on this pageConnectordefinitionThe integration between an identity platform and an app. It's how the platform reads and changes accounts and access in that app.explained in a field note →
04 Aug 2026Agentic Fabric Generally available as a standalone product, paired with Human Fabric. source ↗
06 Oct 2026IdentityIQ 9.0 announced Moves to Jakarta EE, with an upgrade pre-check tool and time-based access. GA date not yet published. source ↗
today · Oct 22, 2026
no date yetIdentityIQ 8.5Prerequisite for 9.0. Reach it through each GA release (patches can be skipped).source ↗
the story · sailpoint estate
From the first call to a setup your own team can run.
Here's what usually prompts a call about your SailPoint estate, what we do about it and in which order, and where you end up.
01 · where it hurts02 · what we change03 · how it runs04 · where you end up
incident board · sailpoint estate3 open
openYou are on IdentityIQ 8.3 or 8.4 and nobody has mapped the route to 9.0 yet.
recurringCustom rules and plugins mean every upgrade turns into a months-long project.
blockedCertification campaigns close because the deadline passed, not because anyone decided.
exposure
IdentityIQ upgrades, including 9.0Identity Security Cloud…IdentityIQ to ISC migrationConnector developmentCertification and role programsHealth checks and support
startrehearsehandover
Health check
Upgrade path
Rehearsal
Cut-over and handover
we are here
ready to hand over
The audit runs on a supported release with certifications intact, and the team knows…
Applications reach governance on a repeatable pattern.
Custom rule and plugin inventory with javax dependencies flagged
Release-by-release upgrade plan to 8.5, with the 9.0 pre-check output
chapter 01 · where it hurts
Why teams reach out
You are on IdentityIQ 8.3 or 8.4 and nobody has mapped the route to 9.0 yet.
Custom rules and plugins mean every upgrade turns into a months-long project.
Certification campaigns close because the deadline passed, not because anyone decided.
chapter 02 · what we change
How we solve it
IdentityIQ upgrades, including 9.0
Identity Security Cloud implementation
IdentityIQ to ISC migration
Connector development
Certification and role programs
Health checks and support
chapter 03 · how it runs
Our approach
Health check
Upgrade path
Rehearsal
Cut-over and handover
chapter 04 · where you end up
What changes
The audit runs on a supported release with certifications intact, and the team knows exactly which custom code stands between it and 9.0.
Applications reach governance on a repeatable pattern.
Custom rule and plugin inventory with javax dependencies flagged
Release-by-release upgrade plan to 8.5, with the 9.0 pre-check output
what we do
Our SailPoint work
6 kinds of SailPoint work, each run by engineers who have done it on live tenants.
Upgrades through each GA release, with custom rules, workflows and plugins reviewed for the Jakarta EE move in 9.0. Rehearsed on a copy of production data first.
Sources, transforms, access profiles and roles configured in ISC, with the workflows and forms your processes need.
An inventory of customizations, a decision on what to rebuild, retire or replace, and a cut-over plan that keeps certifications running.
Delimited-file, JDBC, web-service and custom connectors for the applications SailPoint doesn't cover out of the box.
Campaign design, role mining and entitlement clean-up so reviewers can make real decisions.
A review of configuration, performance, task schedules and logs, with a ranked list of fixes.
capability 01 / 06in production
IdentityIQ upgrades, including 9.0
Upgrades through each GA release, with custom rules, workflows and plugins reviewed for the Jakarta EE move in 9.0. Rehearsed on a copy of production data first.
We pieced these together from SailPoint situations that come up a lot. They're patterns. You won't find a specific client in them.
case file 01
IdentityIQ 8.3, 400 custom rules and a SOX audit in the spring
composite · not a client story
Beforethe situation
IdentityIQ 8.3 runs about 400 custom rules and a dozen plugins, several written against javax APIs. A SOX audit starts in the spring, and certifications can't go dark during an upgrade.
What we dothe work
We upgrade a copy of production through 8.4 to 8.5, run SailPoint's 9.0 pre-check on it and list every rule and plugin it flags. Production moves to 8.5 between certification cycles. The Jakarta rewrites become a separate workstream scheduled before any 9.0 window.
Afterwhere you end up
The audit runs on a supported release with certifications intact, and the team knows exactly which custom code stands between it and 9.0.
case file 02
Sixty applications waiting for governance while the ISC debate drags on
composite · not a client story
Beforethe situation
Sixty applications sit in the onboarding queue, most on JDBC or REST. A leadership debate about moving from IdentityIQ to Identity Security Cloud has frozen new work for months.
What we dothe work
We build and document the onboarding pattern for the three most common connector types, then onboard in waves by audit scope. In parallel, every IdentityIQ customization is scored for rebuild, retire or replace in ISC, so the platform decision rests on the actual estate.
Afterwhere you end up
Applications reach governance on a repeatable pattern. Leadership decides on ISC with a costed view of each customization instead of a vendor slide.
We don't start a step until the last one has produced something you can check.
step 01
Health check
We read your configuration, custom rules, task schedules and logs, then rank what to fix before any upgrade or migration starts.
step 02
Upgrade path
For IdentityIQ, we write a release-by-release plan to 8.5, run the pre-check for 9.0 and list the custom code that needs Jakarta changes.
step 03
Rehearsal
The full upgrade runs on a copy of production data first, with timings, so the real window holds no surprises.
step 04
Cut-over and handover
We run the production upgrade with your team, check aggregation and provisioning afterwards, and leave runbooks behind.
ai on sailpoint
Where AI fits on SailPoint, and where it needs guardrails.
Agentic Fabric, generally available from SailPoint since August 2026, governs AI agents alongside people. A SailPoint MCP server lets outside agents file access requests in Identity Security Cloud. What engineering teams have to sort out is ownership and approvals. Give every agent an owner and a place in certification campaigns, and run its access requests through the approvals a person would get.
AI agentasks for data or an action
Scoped identityonly the access it needs
MCP serverthe one door into the platform
Logged, approveda person signs off on writes
SailPointdoes the work
SailPoint has an official MCP Server for Identity Security Cloud that covers access requests and SecOps identity lookups. We register each agent as an agentic app, scope it to the users it serves and keep approvals on every request. Then we review the audit events it writes.
Agentic Fabric for agent governance
Agentic Fabric went GA on 4 August 2026. It's a standalone product, paired with Human Fabric. We inventory the agents you run and give each of them an owner. Then their access goes into the certification campaigns your auditors already review.
Access requests through the SailPoint MCP Server
SailPoint's MCP Server lets a third-party agent list requestable items, raise and cancel access requests, and check status. Requests carry a comment saying AI raised them on behalf of a named identity. We register the agentic app, decide which approval rules apply, and test that a request still goes to the right approver.
AI help with IdentityIQ 9.0 code
The 9.0 pre-check flags custom rules and plugins that still use javax packages. For each flagged rule, an AI coding assistant can draft the Jakarta rewrite and the unit tests. An engineer reviews every change. Then we rehearse the full upgrade on a copy of production.
Identity intelligence for SecOps
A security analyst's agent can also pull an identity's profile, access, risk and access history from the MCP Server. That's sensitive access data. We scope which analysts and agents are allowed to call it.
HR is the source of truth for people. IdentityIQ reads accounts from directories and applications, decides who should have what, provisions changes to target systems and runs the access reviews your auditors check.
These are working documents, written against your configuration, so your team can run them without us.
inventory01
Custom rule and plugin inventory with javax dependencies flagged
yours to keep
plan02
Release-by-release upgrade plan to 8.5, with the 9.0 pre-check output
yours to keep
runbook03
Upgrade runbook with timed rehearsal results on a copy of production
yours to keep
inventory04
Connector inventory with owner and auth method per application
yours to keep
design05
Certification campaign design with reviewer guidance
yours to keep
report06
IdentityIQ or ISC decision paper scored customization by customization
yours to keep
talent and delivery · sailpoint
Certified engineers, wherever you need them.
Some clients want a project team, some want a couple of engineers on theirs. Either works. Onsite, nearshore or offshore, with handovers across time zones that keep things moving.
Put these to anyone bidding on your SailPoint work. The ones who've done it answer differently from the ones who've read about it.
Q1
When SailPoint's 9.0 pre-check runs, which of our rules and plugins will it flag, and who's going to rewrite them?
The pre-check finds javax dependencies tied to the Jakarta migration but doesn't fix them. Someone still has to rewrite and retest each rule and plugin, and that work sets the 9.0 timeline.
Q2
What is our route to 8.5, and which steps can be skipped?
You go through each GA release, but you can skip patches. If the plan assumes a direct jump, a rehearsal cycle gets wasted finding that out.
Q3
How will certifications keep running while we upgrade?
Auditors expect campaigns to complete on schedule. Windows timed between cycles, with in-flight campaigns tested on the rehearsal copy, avoid gaps in the evidence.
Q4
Which IdentityIQ customizations have no equivalent in Identity Security Cloud?
Custom rules, workflows and plugins decide the cost of a move to ISC. A per-item view of rebuild, retire or replace is the honest basis for the decision.
Q5
How would you bring AI agents into governance now that Agentic Fabric is GA?
Agentic Fabric went generally available in August 2026. Agents still need an owner, access reviews and a lifecycle. The product helps only when the program design already covers those.
01What do we need to do before upgrading to IdentityIQ 9.0?
Get to IdentityIQ 8.5 first, through each GA release. Then run SailPoint's pre-check utility, which flags custom code that still uses javax packages, and fix what it finds. Confirm your application server is supported for 9.0 and rehearse the upgrade on a copy of production data.
02When is IdentityIQ 9.0 generally available?
SailPoint announced IdentityIQ 9.0 on 6 October 2026 at Navigate. At the time we last checked, a general-availability date had not been published. We update this page when it is.
03Can you take over an implementation another partner started?
Yes. We start with a health check of the existing configuration and custom code, then agree what to keep, fix and rebuild.
04How long does an IdentityIQ upgrade take?
It depends on how many releases you cross, how much custom code you run and how long a full rehearsal takes on your data. We time the rehearsal on a copy of production and set the production window from that measurement.
05Do you also connect SailPoint to privileged access tools?
Yes. We connect IdentityIQ or Identity Security Cloud to CyberArk, BeyondTrust or Delinea, so safe and role membership is requested, approved and certified like other access.
services
Related services
Projects on SailPoint usually end up touching one of these, so they're worth a look.
