Top 40 SailPoint ISC Interview Questions and Answers (2026, Scenario-Based)

ISC hiring in India has crossed a tipping point — Naukri listed 904 ISC-related openings versus 685 IIQ-specific openings on July 9, 2026 — yet most interview guides still recycle generic IdentityIQ questions. The questions below are compiled from SailPoint Developer Community discussions, official SailPoint documentation, public interview-preparation resources, and skills listed in Indian ISC job descriptions in July 2026. Exact questions vary by company; use these to build the understanding interviewers actually probe. If your target role is IIQ-focused instead, start with our SailPoint IIQ interview questions guide.

How Are SailPoint ISC Interviews Structured in 2026?

SailPoint ISC interviews in India commonly run two to four rounds: a recruiter screening, one or two technical rounds on platform concepts and hands-on scenarios, and a managerial or client-facing round. Employers hiring ISC talent in July 2026 include Big 4 consulting firms, BFSI global capability centres, and IAM service providers.

What has changed in 2026 is the weight given to scenario questions. Because ISC is configuration-driven rather than code-driven, interviewers cannot rely on Java puzzles the way IIQ (IdentityIQ) interviews do — so they probe judgement: "walk me through onboarding a source", "an aggregation failed, what do you check first". Freshers get more fundamentals; experienced candidates get more troubleshooting and design. The interview structure described here reflects common patterns, not a guarantee of any specific company's process.

ISC Basics: Interview Questions for Freshers (Q1–Q10)

Fresher-level SailPoint ISC interviews test definitions and concept relationships: what Identity Security Cloud is, how it differs from IdentityNow and IIQ, and what sources, Identity Profiles, entitlements, access profiles, roles, provisioning, and certification campaigns do. Clear, structured answers to these ten questions cover most fresher technical rounds.

Q1 What is SailPoint Identity Security Cloud (ISC)?

SailPoint Identity Security Cloud (ISC) is SailPoint's cloud-native, multi-tenant SaaS identity governance platform that manages who has access to what across an enterprise. It automates identity lifecycle (joiner-mover-leaver), access requests, certifications, and policy enforcement, and layers AI-driven insights on top — without requiring the on-premises infrastructure SailPoint IdentityIQ needs.

Q2 What is the difference between ISC and IdentityNow?

There is no functional split — ISC is the rebranded and expanded IdentityNow. SailPoint renamed the platform and continues adding capabilities such as AI access recommendations and unified cloud governance. Job descriptions use both names interchangeably, so treat "IdentityNow experience" and "ISC experience" as the same skill in interviews.

Q3 How is ISC different from SailPoint IdentityIQ (IIQ)?

IIQ is installed on-premises and customised with Java/BeanShell code; ISC is SaaS and customised through configuration — transforms, workflows, and REST APIs. IIQ offers deeper code-level customisation; ISC offers faster deployment and vendor-managed upgrades. Many Indian enterprises run IIQ today while starting new projects on ISC, which is why dual-skill candidates are in demand.

Q4 What is identity governance and administration (IGA)?

IGA is the policy-based management of digital identities and their access — ensuring the right people have the right access at the right time, and proving it to auditors. It combines identity lifecycle management (provisioning, deprovisioning) with governance controls (certifications, separation-of-duties policies, and reporting) demanded by regulations such as SOX, RBI guidelines, and GDPR.

Q5 What is a source in ISC?

A source is any connected system ISC reads accounts and entitlements from or provisions to — Active Directory, Workday, SAP, Salesforce, a database, or a flat file. Sources are classified as authoritative (they create identities, e.g. HR systems) or non-authoritative (they hold accounts correlated to existing identities).

Q6 What is an Identity Profile?

An Identity Profile defines how identities are created from an authoritative source — which attribute mappings apply, how attributes are transformed, and which lifecycle states drive access. Each identity belongs to one Identity Profile, and lifecycle state changes in that profile (for example active to inactive) trigger provisioning or deprovisioning automatically.

Q7 What is correlation in ISC?

Correlation matches accounts on non-authoritative sources to existing identities using matching rules on attributes such as employee ID or email. Accounts that match no identity become uncorrelated accounts — a governance risk interviewers love to ask about, because uncorrelated accounts often signal orphaned or service accounts that escape certification reviews.

Q8 Explain entitlement vs access profile vs role.

An entitlement is a single access item on one source (an AD group, an SAP role). An access profile bundles one or more entitlements from a single source. A role bundles access profiles and entitlements — potentially across many sources — and can be assigned automatically by membership criteria (for example department = Finance). This three-layer model is ISC's version of RBAC and appears in almost every interview.

Q9 What is provisioning in ISC?

Provisioning is ISC creating, updating, enabling, disabling, or deleting accounts and access on connected sources automatically — triggered by lifecycle state changes, role assignments, access request approvals, or certification revocations. Where a source has no direct write connector, ISC can route the work to manual task or service-desk integration instead.

Q10 What is a certification campaign?

A certification campaign is a structured review where designated reviewers approve or revoke users' access. ISC supports manager campaigns (each manager reviews their team), source owner campaigns (owners review access on their system), and search-based campaigns (targeted reviews built from search queries). Revoked items flow into automated deprovisioning — a compliance loop auditors depend on.

Sources, Identity Profiles and Virtual Appliances (Q11–Q18)

Mid-level SailPoint ISC interviews focus on how the platform actually connects to enterprise systems: Virtual Appliance architecture, connector types, authoritative source design, uncorrelated account handling, and attribute sync. The Virtual Appliance (VA) is the most frequent troubleshooting topic on the SailPoint Developer Community, and interviewers mirror that.

Q11 What is the Virtual Appliance (VA) and why is it needed?

The VA is a SailPoint-supplied Linux-based virtual machine deployed in your network that securely connects the ISC cloud tenant to on-premises sources such as Active Directory or databases. It executes aggregation and provisioning operations locally and communicates with the tenant over encrypted, outbound-only connections — so no inbound firewall ports need to be opened.

Q12 What does "outbound-only" mean for VA networking?

The VA always initiates connections outward to SailPoint's cloud; the cloud never connects inward to your network. In practice this means firewall rules only need to allow the VA to reach SailPoint endpoints over HTTPS (port 443), which is why security teams accept the model. Candidates who can explain this clearly stand out in infrastructure-heavy interviews.

Q13 Why are VAs deployed in clusters?

VA clusters provide high availability and load distribution: if one VA fails, others in the cluster continue processing aggregations and provisioning. Production guidance is to run at least two VAs per cluster. Sources are assigned to a VA cluster, not to an individual appliance — a detail interviewers use to separate hands-on candidates from readers.

Q14 A VA shows disconnected after a reboot. What do you check?

Check that the VA's services restarted properly, verify outbound connectivity to SailPoint endpoints, and review the VA logs — a service failing to auto-start after reboot is one of the most reported issues on the SailPoint Developer Community. If services cannot be recovered, redeploying the VA and rejoining it to the cluster is a documented, accepted fix. Mentioning log collection for SailPoint support earns credibility.

Q15 What connector and source types does ISC support?

ISC supports direct connectors for common enterprise systems (Active Directory, Entra ID, Workday, SAP, Salesforce, JDBC databases), flat-file/delimited sources for systems without connectors, and web-services connectors for REST-based applications. Choosing between a direct connector and a flat-file source — and defending the trade-offs — is a classic interview scenario.

Q16 Authoritative vs non-authoritative source — why does the distinction matter?

Authoritative sources (typically HR systems like Workday or SAP SuccessFactors) create and drive identities; non-authoritative sources only contribute accounts correlated to existing identities. The distinction matters because lifecycle automation keys off authoritative data: if HR marks someone terminated, ISC's leaver process disables their downstream accounts. Getting this wrong in design causes ghost identities and audit findings.

Q17 How do you handle uncorrelated accounts?

Investigate why correlation failed (attribute mismatches, missing employee IDs), fix correlation logic or source data, and classify genuine exceptions — service accounts, shared mailboxes — so they are owned and governed rather than ignored. A strong answer adds that uncorrelated accounts should be reviewed regularly because they are a common audit finding.

Q18 What is attribute sync?

Attribute sync pushes identity attribute changes (like a new display name or department) from ISC to accounts on connected sources, keeping downstream systems consistent with the authoritative record. It differs from full provisioning: attribute sync updates existing account attributes, while provisioning creates or removes accounts and access.

Transforms, Provisioning and Lifecycle Automation (Q19–Q26)

Transforms and joiner-mover-leaver (JML) automation are the highest-frequency technical topics in SailPoint ISC interviews for experienced candidates. Transforms are ISC's configuration-based answer to IIQ's BeanShell rules, and lifecycle states are how ISC turns HR events into automated access changes across the enterprise.

Q19 What are transforms in ISC?

Transforms are JSON-defined, configurable objects that modify attribute values as they flow between sources and identities — without writing deployed code. Examples: building a display name from first and last name, normalising dates, or deriving a lifecycle state from an HR status field. They can be nested inside each other to build complex logic from simple pieces.

Q20 Name common transform operations you have used.

Frequently used operations include static (fixed value), concatenation (join values), lookup (map input keys to output values), dateFormat (reparse dates between formats, including named formats like ISO8601 and LDAP), substring, replace, and firstValid (return the first non-null value). These are documented in the SailPoint Developer Community transform reference — quoting two or three with a real use case each is the strongest answer format.

Q21 Transform vs rule in ISC — when do you need a cloud rule?

Use transforms for most attribute logic; cloud rules (JavaScript/BeanShell-style logic reviewed and deployed with SailPoint's involvement) are reserved for cases transforms cannot express. Because rules add review overhead and upgrade risk, "transform-first, rule-only-when-necessary" is the design philosophy interviewers expect. Contrast this with IIQ, where custom rules are routine.

Q22 What are lifecycle states?

Lifecycle states are stages defined on an Identity Profile — such as active, inactive, or terminated — that drive automated access changes when an identity moves between them. Each state can enable or disable accounts and grant or remove access. They are derived from authoritative source attributes, usually via a transform on HR status and dates.

Q23 Walk me through how joiner-mover-leaver works in ISC.

Joiner: HR creates a record, aggregation builds the identity, the active lifecycle state triggers birthright provisioning (AD account, email, role-based access). Mover: HR attribute changes (department, manager) re-evaluate role criteria and adjust access. Leaver: termination flips the lifecycle state, disabling accounts and removing access on schedule. Strong candidates mention timing controls and the audit trail each step leaves.

Q24 What is a provisioning policy (create profile)?

A provisioning policy defines how ISC builds new accounts on a source — which attributes to populate and how to generate them, for example constructing a sAMAccountName from first initial plus surname with a uniqueness check. It is the configuration interviewers reference when they ask "how would ISC create the AD account for a new joiner?"

Q25 How does an access request flow work?

A user (or their manager) requests an access profile or role from the Request Center; ISC routes the request through the configured approval chain (typically manager and/or access owner); on approval, provisioning executes automatically and the grant is recorded for audit. Mention that AI recommendations can flag unusual requests for closer review — that is a 2026-current detail most candidates miss.

Q26 A mover changed departments but kept old access. What went wrong?

Likely causes: role membership criteria did not re-evaluate (the old role was requested manually, not criteria-based), the mover trigger did not fire because the attribute change was not aggregated, or old access was granted directly and is invisible to role logic. The governance fix is a mover certification or targeted search-based campaign to catch accumulated access — the classic "privilege creep" answer.

Certifications, SoD Policies and AI Features (Q27–Q33)

Governance questions separate administrators from consultants in SailPoint ISC interviews: certification campaign design, separation-of-duties (SoD) policy logic, and ISC's AI capabilities — Access Recommendations, Identity Outliers, and Activity Insights — are what BFSI and Big 4 interviewers probe hardest.

Q27 What certification campaign types does ISC support?

The common campaign types are manager campaigns (managers review their direct reports' access), source owner campaigns (system owners review access on their source), and search-based campaigns (targeted reviews built from ISC search queries, such as "everyone with access to the payments system"). Search-based campaigns are the flexible tool for audit-driven, risk-focused reviews.

Q28 What happens when a certifier revokes access?

Revocation triggers automated deprovisioning: ISC generates the change on the source via its connector, or routes a manual task where no write connector exists, and records the outcome for audit. Interviewers often follow up with "what if revocation fails?" — the answer involves monitoring provisioning activity, retries, and escalation to the source owner.

Q29 What are SoD policies in ISC?

Separation-of-duties policies define conflicting access sets that no single identity should hold together — for example "create vendor" and "approve payments." ISC detects violations when access combinations breach a policy, and violations can block requests or route for remediation and documented exception approval. SoD is the control that prevents toxic access combinations behind enterprise fraud.

Q30 How do approval workflows differ from ISC Workflows?

Approval chains on access requests are configuration on access profiles and roles; ISC Workflows is a separate low-code automation engine that reacts to events — an identity attribute change, a certification completing — and executes multi-step logic such as notifications, API calls, or ticket creation. Knowing both exist, and when to use which, signals current platform knowledge.

Q31 What are AI Access Recommendations?

Access Recommendations use peer-group analysis of identity attributes and access patterns to suggest whether access should be granted, approved, or removed — surfaced as thumbs-up/thumbs-down indicators during certifications and approvals. They reduce rubber-stamping in large campaigns by letting reviewers focus attention on unusual access instead of approving everything blindly.

Q32 What are Identity Outliers?

Identity Outliers are identities whose access deviates from their peers, flagged by machine learning with an outlier score from 0 to 100 indicating potential risk. Administrators investigate outliers to catch privilege creep and misassigned access before auditors do. This is one of the newest features interviewers ask about, sourced directly from SailPoint's AI documentation.

Q33 What do Activity Insights add to governance?

Activity Insights track access-related activity and changes over time, helping teams spot unused entitlements and dormant accounts — prime candidates for removal during certifications. Tying usage data to certification decisions ("revoke what is never used") is the practical governance pattern worth describing in an interview.

REST APIs and Advanced Topics (Q34–Q37)

Senior SailPoint ISC roles require REST API fluency because ISC is API-first: the v3 and beta API families, OAuth 2.0 authentication with personal access tokens, and the search query language appear in most experienced-level interviews and in Indian job descriptions observed in July 2026.

Q34 How are ISC's REST APIs organised?

ISC exposes stable v3 APIs for core objects — identities, sources, accounts, access profiles, certification campaigns — plus beta APIs for newer capabilities. Everything the UI does is available via API, which is why implementation teams automate source onboarding, campaign creation, and reporting. Referencing the developer.sailpoint.com documentation shows you work with the real platform.

Q35 How does authentication to ISC APIs work?

APIs use OAuth 2.0 bearer tokens (JWT), generated from a personal access token (PAT) using the client-credentials flow, or via the authorization-code flow for web applications acting on behalf of a user. Tokens carry scopes — read scopes retrieve data, manage scopes modify it — and least-privilege scoping is the expected best practice answer.

Q36 What is ISC Search and why does it matter?

ISC Search is a query interface over indexed identity, access, and event data — used to answer governance questions ("who has entitlement X?"), build search-based certification campaigns, and drive reports. Fluency with search queries is a hands-on skill interviewers test because it powers day-to-day administration and audit responses.

Q37 How would you bulk-load or migrate configuration between tenants?

Use the REST APIs (and SailPoint's CLI/SDK tooling) to export and import objects — transforms, sources, access profiles — between sandbox and production tenants, keeping configuration in version control where possible. Describing a sandbox-first change process with API-driven promotion demonstrates enterprise discipline that senior interviews reward.

Scenario-Based Questions for Experienced Candidates (Q38–Q42)

Scenario questions decide senior SailPoint ISC offers: interviewers present a broken aggregation, a new application, a messy audit finding, or a platform migration and score how you structure the response. Practise answering these five aloud, stating assumptions, sequence, and verification steps — structure matters more than any single fact.

Q38 Scenario: AD aggregation that ran fine yesterday fails today. Walk through your triage.

Check the VA cluster health first (disconnected VA, service failures), then the source connectivity test, then the service account (password expiry or lockout is the most common culprit), then recent changes (firewall, AD schema, certificate expiry), and finally the aggregation logs for the specific error. Close by verifying with a targeted single-account aggregation before rerunning the full job.

Q39 Scenario: onboard a new SaaS application with 5,000 users into ISC end to end.

Sequence: confirm the connector type (direct vs web services vs flat file), define the account schema and correlation rules, aggregate accounts and resolve uncorrelated ones, model access as entitlements and access profiles, assign an owner, wire provisioning policies and approval flows, test joiner and leaver paths in sandbox, then schedule ongoing aggregation and include the source in certifications.

Q40 Scenario: a contractor converts to a full-time employee. What breaks if this is designed badly?

Bad designs create a duplicate identity when the employee record arrives from HR, leaving orphaned contractor access outside governance. The correct design correlates both records to one identity (stable unique identifier), treats conversion as a mover — re-evaluating roles, adjusting access, keeping the audit trail — and only ends in a leaver flow for the contractor source account, not the person.

Q41 Scenario: an audit finds users holding conflicting finance access. Design the fix in ISC.

Immediate: run a search-based certification campaign on the conflicting entitlements to force review and revocation. Structural: define SoD policies for the conflicting sets so future violations are detected or blocked at request time, with a documented exception process. Preventive: review role design so conflicting access never ships inside one role, and monitor Identity Outliers for recurrence.

Q42 Scenario: your company is migrating from IIQ to ISC. What transfers and what must be redesigned?

Governance design transfers: role models, certification strategy, SoD logic, lifecycle definitions. Implementation must be redesigned: BeanShell rules become transforms, ISC Workflows, or API integrations; applications become sources with VA connectivity; custom UI work maps to standard ISC experiences. Interviewers reward candidates who frame migration as re-implementation of governance intent, not lift-and-shift — the skill set behind the growing IIQ+ISC dual-role demand in India.

How Do You Prepare for a SailPoint ISC Interview?

Preparation has three parts: master the concept map (sources feed Identity Profiles, transforms shape attributes, lifecycle states drive JML, campaigns and SoD enforce compliance), get hands-on tenant practice, and rehearse scenario walk-throughs aloud. SailPoint Academy is launching a live online SailPoint ISC (Identity Security Cloud) course — waitlist open at +91 93909 81953.

The hands-on part is the hard one: SailPoint offers no free ISC trial tenant or sandbox, so self-learners struggle to practise exactly the skills interviews test. Realistic options are an employer's tenant, a development tenant earned through the SailPoint Developer Community ambassador programme, or instructor-led training with live tenant access. That access gap is why guided preparation converts to offers more reliably than video-only study — the same conclusion we reached in our certification cost-benefit analysis. IAM fundamentals from the 14-module IIQ curriculum — application onboarding, certifications, lifecycle events, role management — transfer directly to ISC interviews.

1. Join the ISC waitlist on WhatsApp. Send "ISC" to +91 93909 81953 — the founding-batch fee is Rs. 32,000, announced to waitlist members first, with hands-on tenant practice built in.
2. Attend the free 60-minute demo. See the live training style on Zoom and get an honest readiness assessment for your experience level — before any payment.
3. Rehearse the five scenarios above aloud. Structure, assumptions, sequence, verification — that is what senior interviewers score.

If your immediate target is an IIQ role — still 685 openings strong on Naukri as of July 9, 2026 — the running SailPoint IIQ training program at SailPoint Academy (Rs. 25,000, 2 months, batch capped at 25) covers the platform depth those interviews demand, and salary expectations for both platforms are documented in our SailPoint ISC salary in India 2026 guide.