SailPoint has announced IdentityIQ 9.0, the next major release of its on-premises identity governance product. It adds time-bound access on roles and entitlements, rebuilds the platform foundation, and includes tooling meant to make the upgrade itself less painful. For teams running customized IdentityIQ deployments, the upgrade path matters more than any single feature.
What happened
SailPoint announced the release on October 6, 2026 at its Navigate conference, in a press release and a product blog post by Jerry Aubel. The press release describes IdentityIQ 9.0 as a parallel modernization path for hybrid and on-premises deployments, alongside updates to its cloud platform, SailPoint Human Fabric. SailPoint's materials describe these changes:
- Time-based access. Access can be granted and approved with specific start and end times, with time zone support, and SailPoint says this is enforced across roles and entitlements.
- Entitlement ownership review. An automated, self-service process asks business owners to periodically review ownership records and entitlement descriptions.
- Rebuilt foundation. The blog says the platform was rebuilt on current enterprise standards, replacing components that date back to the product's earliest versions. The press release says it now runs on modern application servers.
- Standardized configuration. According to SailPoint, custom forms, business logic and interface scripts now follow a standardized configuration approach that is easier to maintain and carry forward.
- User experience. SailPoint lists a redesigned access review interface that keeps preferences between sessions, more accurate search, and a reworked application configuration flow for business administrators.
- Upgrade tooling. SailPoint says the release includes a utility that scans an environment, identifies what needs updating and handles most of the changes automatically.
Neither page gives a general availability date, system requirements (application server, Java or database versions), supported upgrade paths from earlier releases, deprecations, or what the upgrade tool can't handle. Neither names the application servers or the tool.
Why it matters
Time-bound access matters most for governance programs. Many IdentityIQ environments handle temporary access with workarounds: removal tickets, certifications that catch leftover access months later, or custom sunset-date rules. If start and end times are enforced natively on roles and entitlements, a contractor's project role or an emergency entitlement expires on schedule. That reduces the standing access attackers use once they hold valid credentials.
The rebuild has a cost. IdentityIQ deployments usually carry years of custom rules, forms and workflows, which is what makes upgrades slow and risky. SailPoint says the upgrade tool addresses this but hasn't said how much of a heavily customized deployment it can handle. A new application server stack also affects infrastructure, monitoring and hardening baselines the IGA team may not own.
What to check in your environment
- Inventory your customizations. List custom rules, forms, workflows and UI scripts, along with who maintains each. That list is the scope of your upgrade work, whatever the tool automates.
- Find your current temporary-access workarounds. Identify where removal dates are set today (custom rules, request forms, tickets) so you can test whether native time-based access can replace them and how existing assignments would migrate.
- Ask your SailPoint account team for the missing details. Get the GA date, supported source versions, the target application server and Java versions, and the end-of-support dates for your current release before you plan anything.
- Bring in infrastructure and platform owners early. A new application server stack can mean new hosts, patching cycles, hardening standards and monitoring. Get those teams involved before the upgrade starts.
- Run the upgrade tool in non-production first. Once it's available, run it against a copy of production configuration and compare its findings with your customization inventory. Track what it flags as needing manual work.
- Prepare entitlement owners. The self-service ownership review depends on accurate owner assignments. Check for entitlements with no owner, or with owners who have left the company, before you turn it on.