SailPoint IdentityIQ
IdentityIQ is SailPoint’s on-premises identity governance platform — running in your own data centre, which answers residency and processing by construction. And the correction worth making: there is no announced end-of-life, whatever you have been told.
Data residency & processing
IdentityIQ runs on infrastructure you own, which answers residency and processing together by construction — there is no region to confirm and no sub-processor list to negotiate, because the software never leaves your building. That is the cleanest possible answer where a regulator specifies where the SYSTEM runs rather than only where data rests, and it is a genuine advantage over any SaaS deployment including SailPoint’s own. The trade is that you own the infrastructure, upgrades, tuning and disaster recovery— real cost that belongs in the comparison.
On CERT-In: the 180-day ICT log duty applies to you as the regulated entity, not to SailPoint. CERT-In’s own FAQ permits storage outside India provided logs are producible to the authorities in reasonable time — but if you are IRDAI-regulated, the 2023 audit annexure asks as a plain yes/no whether ICT logs are stored in India, and that is where an offshore region actually costs you.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Quick answer
The SailPoint platform family
This page covers IdentityIQ — the on-premises line. The rest of the portfolio:
Quick facts
30-second orientation- Product
- IdentityIQ — SailPoint's ON-PREMISES IGA
- Vendor
- SailPoint (Nasdaq: SAIL)
- ✅ End of life
- NONE ANNOUNCED — still sold and supported
- Migration reality
- 2–3 YEARS, both platforms in parallel
- Where it runs
- Your data centre, your infrastructure
- Residency
- Satisfies storage AND processing by construction
- The other reason to stay
- Rules engine MORE flexible than the cloud's
- The trade
- You own upgrades, tuning, availability
- New capability
- Tends to land in Identity Security Cloud first
- Pricing
- QUOTE-ONLY — and services are 2–3× licence
- Upgrade path
- Free assessment; connectors and rules carry across
- In India via
- TechBag — honest migration scoping, INR, GST
Understand identity governance before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is IdentityIQ?
SailPoint’s on-premises identity governance platform — certification, provisioning, role mining, SoD and the evidence trail, running in your own data centre. No end-of-life has been announced.
A forced migration vs a decision you time — the honest table
What consolidation actually replaces, dimension by dimension.
| Dimension | A migration you did not need yet | IdentityIQ (SailPoint) |
|---|---|---|
| Where it runs | (cloud: a region you confirm) | Your data centre |
| Residency | A vendor commitment about storage | By construction — no region to ask about |
| Processing location | Often unanswered separately | Same building as storage |
| Rules & workflow | (cloud: configuration-driven) | You can write the logic |
| Infrastructure | (cloud: absorbed by the vendor) | ⚠️ Yours — upgrades, tuning, DR |
| New capability | (cloud: lands here first) | Follows later |
| End of life | (the claim you keep hearing) | NONE announced |
| Migration | (framed as urgent) | 2–3 years, when YOU choose |
On-premises identity governance that answers residency AND processing by construction — and a rules engine more flexible than the cloud platform’s. The correction that matters: no end-of-life has been announced, and migrations take 2–3 years in parallel, so anyone using a date to create urgency is selling a project. Honest trade: you own infrastructure, upgrades, tuning and DR, and new capability lands in the cloud first.
The five pieces of the platform
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
It Runs In Your Data Centre
IdentityIQ runs on infrastructure you own, so storage and processing stay in your building. No region to confirm, no sub-processors to negotiate.
The Rules Engine
Its rules and workflow engine is more flexible than Identity Security Cloud’s. If your governance logic must be written, not selected, you’d lose that.
Full Governance Capability
Certification, joiner-mover-leaver provisioning, role mining, segregation of duties and the evidence trail — the same discipline, delivered on-prem.
The Operational Burden
You own the infrastructure, upgrades, database tuning, availability and DR. Cheaper on paper, rarely in total unless residency requires it.
The Path To Cloud, When You Want It
SailPoint’s upgrade programme includes a free four-week assessment, and connectors and rules can carry across. There’s no deadline to take it.
One governance engine running in your own data centre — flexible rules and full certification, at the cost of operating it.
Twelve capabilities. Deploy, govern, own.
IdentityIQ runs identity governance inside your own data centre — no region to confirm, no processing question left open — the on-premises line of the SailPoint portfolio.
Runs On Your Infrastructure
Installed in your data centre, on servers you control — residency answered without a SaaS region to ask about.
Entitlement Discovery & Correlation
Finds granular permissions in each application and correlates them to people — often revealing access nobody could account for.
Governance Reporting
Reports on entitlements, campaign progress and policy violations, from a database you own and can query directly.
Access Certification Campaigns
Scheduled reviews where managers and owners confirm access, with the evidence trail auditors ask for, on your own infrastructure.
Lifecycle Provisioning
Accounts created on joining, updated on role change and revoked on departure, driven by HR or directory events.
Rules & Workflow — The Flexible One
More flexible than Identity Security Cloud’s engine. If your governance logic must be written, not configured, migrating loses it.
Role Modelling & Mining
Derives roles from actual entitlement data and maintains them — a real analytical project, and much of the implementation cost.
Segregation-Of-Duties Rules
Detects and prevents toxic access combinations, such as raising and approving a purchase order — what Indian auditors ask most.
Self-Service Access Requests
Requests through a catalogue, approvals routed by policy, provisioning on approval, and a record of why each grant was made.
Connectors To Your Applications
Connectors, including the legacy and in-house systems that often keep an estate on-prem. Scope this list first; it predicts the timeline.
Migration To Identity Security Cloud
A free assessment of around four weeks; connectors, objects and rules can carry across. There’s no date by which you must migrate.
Infrastructure, Upgrades, Availability
The database, servers, upgrades, tuning and DR plan are all yours. Cheaper on paper, rarely in total unless residency requires it.
Watch the SailPoint platform in action
The platform this sits alongside.
SailPoint Identity Security Cloud Overview
The cloud platform IdentityIQ sits alongside.
A guide to SailPoint Identity Security Cloud
What the migration target actually looks like.
SailPoint Non-Employee Risk Management Overview
The contractor and partner add-on.
Want a live, India-context walkthrough for your environment?
Book a guided demo →Migrate on their timetable. Or on yours.
Here’s what genuinely justifies staying on-premises — and when it does not.
There is no end-of-life, and you are probably being told there is
SailPoint has announced no end-of-life for IdentityIQ; it still sells and supports it. Migration to Identity Security Cloud typically takes two to three years in parallel, and the urgency often comes from integrators selling services. Time it to your own drivers — a hardware refresh, a data-centre exit, a needed feature.
On-premises answers the residency question completely
On-premises answers residency by construction: the software runs on your servers, so storage and processing are wherever you put the machine. That is a requirement for some public-sector, defence-adjacent and banking buyers. The cost is owning upgrades, tuning, availability and DR — rarely cheaper in total.
The rules engine is more flexible — and that is a real reason to stay
IdentityIQ lets you write governance logic; Identity Security Cloud has you configure policies. Configuration wins for most, but unusual approval chains or provisioning logic may not translate. Before migrating, ask exactly how your three most complex rules would be built in the cloud platform.
The same category economics still apply
On-prem doesn’t change the programme cost: implementation still runs two to three times licence, and below roughly a thousand identities it rarely pays. You add infrastructure, upgrades, database administration and DR, but avoid a growing subscription. Model both over five years including staff time; the cloud usually wins.
The honest scope
IdentityIQ remains supported with no end-of-life, and is right when residency or rules flexibility truly need on-prem. Otherwise the cloud platform, running in AWS Mumbai, costs less in total. Saviynt suits SAP-heavy estates; lighter tools suit provisioning; below roughly a thousand identities, IGA is hard to justify.
The numbers behind the platform
What your IdentityIQ evaluation looks like
Establish whether you actually need on-premises
Does your regulator specify where the system runs, or only where data rests? If only data, AWS Mumbai likely suffices for less.
Run the three-rules test
Weighing migration? Ask exactly how your three most complex governance rules would be built in Identity Security Cloud.
Model five years, with staff time in it
Compare licence plus infrastructure, DBA time, upgrades, availability and DR against SaaS — not three years of licence alone.
Migrate when a driver appears, not on a rumour
A hardware refresh, a data-centre exit or a cloud-only capability are drivers; ‘end-of-life’ is not, because it isn’t true.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“Our regulator asks where the system runs, not where the data rests. On-premises answers that; no cloud region does.”
“We were told three times IdentityIQ was end-of-life. It isn’t, SailPoint confirmed, and we migrated on our own timetable.”
“The three-rules test was the useful part. Two complex approval rules became configuration; the third didn’t, which changed the plan.”
“The licence looked cheaper than SaaS but the total wasn’t. Once we costed DBA time, upgrades and DR, the gap almost closed.”
“New capability arrives in the cloud platform first. We accepted that for residency reasons, but it is a real trade.”
“TechBag modelled both over five years with our staff costs. It didn’t favour on-premises for us and they said so.”
“The rules engine is why we stayed. Our certification scoping logic took real engineering, and nobody can express it as configuration.”
“Connector work dominated the project, exactly as we were warned. Two legacy in-house applications took longer than everything else combined.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and review-site grids score satisfaction, not fit for your estate. So here’s TechBag’s synthesis of the identity governance market — tap any vendor to see why it sits where it does.
TechBag Identity Governance Grid
Execution strength vs product vision — the classic market map, minus the paywall.
On-premises governance. This page's product.
Flexibility × Burden Absorbed
The grid nobody publishes — how far the rules engine bends vs how much you must run yourself.
Deep and flexible; you own the operations.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
IdentityIQ vs the field — starting with its own cloud sibling
Identity Security Cloud, One Identity Manager, Saviynt, ManageEngine and Omada — honest lanes. The first comparison is against SailPoint’s OWN cloud platform: if you have no hard on-premises requirement, it costs less in total and we will say so.
| Dimension | IdentityIQ | Identity Security Cloud | One Identity Manager | Saviynt | ManageEngine AD360 | Omada |
|---|---|---|---|---|---|---|
| Position | SailPoint on-premises | SailPoint's cloud platform | Established, on-prem heritage | Converged IGA+PAM+AAG | AD-centric governance modules | Pure IGA, European |
| Runs on-premises | Yes — the whole point | No — SaaS only | Yes | SaaS | Yes | Cloud Private in your Azure tenant |
| Residency answered | By construction — both storage and processing | AWS Mumbai, documented for STORAGE | By construction if on-prem | India tenants, regions unnamed | By construction if on-prem | No India region |
| Rules flexibility | Write the logic — more flexible | Configuration-driven | Highly customisable | Configuration-driven | Limited | Config over code by design |
| Who runs the infrastructure | ⚠️ You do — real cost | SailPoint | You do | Saviynt | You do (on-prem) | Omada (standard cloud) |
| New capability first | Follows the cloud platform | Lands here first | Steady | Cloud-paced | Steady | Cloud-paced |
| Best fit | Regulators that name system LOCATION; unusual rules logic | Most organisations — less to run, Mumbai region | On-prem heritage estates | SAP-heavy estates needing ERP SoD | AD-centric estates wanting lighter governance | Pure IGA where India presence is not a constraint |
Which approach fits you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose IdentityIQ if…
- ✓Your regulator specifies where the SYSTEM runs, not just where data rests — on-prem answers storage and processing together
- ✓You are air-gapped or network-isolated, and SaaS is not on the table at all
- ✓Your governance logic genuinely needs writing rather than configuring — the rules engine bends further than the cloud's
- ✓You already run it: there is NO announced end-of-life, and migration is a decision you time
Identity Security Cloud if…
- ✓You do not have a hard on-prem requirement — it absorbs the infrastructure, upgrades and availability burden, gets new capability first, and the AWS Mumbai region satisfies most Indian residency obligations
Saviynt if…
- ✓Your estate is SAP-heavy and ERP segregation-of-duties analysis is the driver — its Application Access Governance module goes further
Something lighter if…
- ✓Your real problem is provisioning speed rather than audit evidence, or you are under ~1,000 identities
Do NOT migrate just because…
- ✓Somebody told you IdentityIQ is end-of-life. It is not. Migrate when a real driver appears — a hardware refresh, a data-centre exit, a capability you actually need
SailPoint IdentityIQ is one of 22 identity governance products TechBag carries. The Identity Governance guide narrows them to a shortlist and shows the reasoning. →
What does a premature migration cost you?
Drag the sliders (identity count; IT hourly cost as a loaded rate). Estimates contrast manual access reviews against automated certification. NB: this models the REVIEW effort saved, and for on-premises there are two costs it does NOT model — implementation at 2–3× licence, and the infrastructure, upgrade, DBA and DR burden you take on. Model five years with staff time included before comparing against a SaaS subscription. Illustrative.
Loaded cost = salary + overheads per productive hour. Illustrative only — your TechBag quote models your actual environment and modules.
Three ways to consume it
Quote-only, with no published rate card. Two cost layers for on-premises. The same category economics apply — implementation typically runs 2–3× licence, because connectors, role modelling and certification design are the real work in either deployment model. AND you own infrastructure, upgrades, database administration, availability and DR — ongoing costs with salaries attached that never appear on a licence quote. Model FIVE years with staff time included; three years licence-only favours on-premises misleadingly. TechBag builds that model and will tell you when it does not favour us.
IdentityIQ
Best when system location is mandated
- QUOTE-ONLY — no published rate card
- Runs in YOUR data centre — storage and processing answered together
- NO announced end-of-life; migration is a decision you time
+ Platform add-ons
Best for a broader rollout
- Scoped to your estate
- Add-on modules as needed
- Phased, right-sized deployment
+ what you own
Best costed before you compare
- Infrastructure, upgrades, DBA time, availability, DR — all yours
- Implementation still 2–3× licence, same as the cloud platform
- TechBag models five years with staff time in it
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 8 questions to ask every vendor
Take this into your next vendor call — including ours.
Does your regulator name where the SYSTEM runs, or only where data rests? Only the first genuinely requires on-premises.
Have you been told IdentityIQ is end-of-life? It is not — no EOL has been announced. Ask whoever told you where they got the date.
Can your three most complex governance rules be expressed as configuration in the cloud platform? Ask HOW, not WHETHER.
Does your comparison include DBA time, upgrade cycles, availability and DR? Licence-only comparisons favour on-prem misleadingly.
Have you scoped and priced every application needing a connector? This drives implementation cost in either deployment model.
Are you comfortable that new features land in Identity Security Cloud first? That trade is real and permanent.
More than roughly a thousand identities? Below that an enterprise IGA programme is hard to justify however it is deployed.
Do you have the DBA and infrastructure capability in-house, or would you be buying it? That cost belongs in the business case.
Questions buyers ask
Ready to test whether you actually need on-premises?
Start with the requirement: does your regulator specify where the SYSTEM runs, or only where data rests? If the latter, the AWS Mumbai region probably satisfies it and the cloud platform costs less. If you are weighing a migration, run the three-rules test first. Or let a TechBag advisor model both options over five years with your staff costs included.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.