SailPoint ISC Transforms: A Practical Introduction

IAM Careers — Thu, 22 Oct 2026 13:27:18 +0000

In SailPoint Identity Security Cloud (ISC), transforms are how you shape raw source data into clean identity attributes. If you are moving from IdentityIQ (IIQ), think of them as the configuration-first replacement for many small attribute rules.

What a transform is

A transform is a JSON object that takes an input value, applies an operation and returns a new value. You attach transforms to identity profile mappings, so every identity gets attributes calculated the same way.

Common transform types

accountAttribute: reads an attribute from a specific source account.
lower / upper: changes letter case, for example for email addresses.
concat: joins values, such as first and last name.
substring / replace: trims or cleans part of a value.
lookup: maps one value to another using a table, for example department codes to names.
firstValid: returns the first non-empty value from a list, useful when data comes from several sources.
conditional: returns different values depending on a comparison.
dateFormat: converts dates between formats.
static: returns a fixed value or a simple template.

Transforms can be nested, so the output of one becomes the input of another.

A simple way to think about it

Start from the attribute you want on the identity, then work backwards: which source holds it, what cleaning it needs, and what to do when it is missing. That usually tells you which transforms to chain.

Tips

Keep transforms small and reusable, and name them clearly.
Use firstValid to handle missing data instead of complex conditions.
Test with real sample identities before applying a change to everyone.

Full guide: SailPoint ISC transforms explained. For live, hands-on ISC training, see the SailPoint ISC course at IAM Careers.

This training is provided by IAM Careers and is not affiliated with, authorized by, sponsored by, or endorsed by SailPoint Technologies, Inc.

SailPoint IdentityIQ Rules Explained: Where BeanShell Fits

IAM Careers — Thu, 22 Oct 2026 13:26:23 +0000

If you are learning SailPoint IdentityIQ (IIQ), rules are where configuration ends and code begins. IIQ rules are small pieces of BeanShell (Java-like scripting) that run at specific points in IIQ's processing, so you can handle the cases that out-of-the-box configuration cannot.

What a rule is

A rule is a script stored as a Rule object in IIQ. IIQ calls it at a defined hook, such as while reading data from an application or before sending a change to a target system. The rule receives input variables from IIQ (for example the application, the account data or the identity) and returns a value or modifies an object.

Rule types you will meet early

Correlation rule: decides which identity an account belongs to when simple attribute matching is not enough.
Customization rule: adjusts account data as it is read during aggregation, for example cleaning up values.
Build Map rule: shapes raw rows from delimited-file or JDBC sources into account attributes.
Identity attribute rule: calculates an identity attribute from one or more sources.
Before and After Provisioning rules: change a provisioning plan before it is sent, or act after it completes.

Why BeanShell matters for jobs

Most real IIQ projects onboard applications that do not fit the defaults. Interviewers often ask you to explain a correlation rule or debug a failed aggregation, which means reading and writing BeanShell. You do not need to be a senior Java developer, but you do need to be comfortable with variables, conditions, loops and IIQ's objects.

Tips when you start writing rules

Keep each rule small and focused on one job.
Log what the rule receives and returns while testing.
Test against a small set of accounts before running a full aggregation.
Reuse logic through rule libraries instead of copying code.

Full guide with examples: SailPoint IIQ rules and BeanShell explained. If you want structured, hands-on practice, see the SailPoint IIQ course at IAM Careers.