SailPoint implementation partner and consulting services
We implement, extend and support SailPoint IdentityIQ and Identity Security Cloud: authoritative sources, joiner-mover-leaver automation, RBAC, Segregation of Duties and certification campaigns that stand up to audit. Enterprises hire us directly; consultancies use us as their SailPoint engineering bench.
Send the role or the problem. Get 2-3 matching profiles or a short plan within one business day, or message us on WhatsApp.
MappOptimist is a SailPoint implementation partner and consulting services company for enterprises and IT consultancies in the US, UK and UAE. We implement and extend SailPoint IdentityIQ and Identity Security Cloud (HR and directory integration, joiner-mover-leaver automation, connector development, RBAC, Segregation of Duties and access certifications), and we provide SailPoint implementation support and managed services after go-live, billed monthly at our published IAM consultant rates. Our engineers are based in India and work as a project team, dedicated SailPoint engineers or white-label capacity.
SailPoint consulting services
MappOptimist's SailPoint consulting services cover the identity governance lifecycle on IdentityIQ and Identity Security Cloud: assessment and planning, implementation, application onboarding, IdentityIQ enhancement and migration planning, and support after go-live. Enterprises in the US, UK and UAE work with us directly, and IAM consultancies and system integrators use the same consultants as white-label SailPoint capacity. These are the six services we offer.
Assessment and phased plan
We review the estate you have: authoritative sources, directories and applications, identity data quality, existing rules and workflows, and the real joiner-mover-leaver process. Then we agree a phased plan with you before anything is built.
Identity Security Cloud and IdentityIQ implementation
Identity profiles, HR sources such as Workday or Oracle HRMS, Active Directory and Entra ID, provisioning workflows, RBAC, Segregation of Duties and certification campaigns. Three of our published case studies are Identity Security Cloud implementations and two are IdentityIQ 8.x.
Application onboarding and connectors
Enterprise applications onboarded through standard connectors, JDBC, SCIM 2.0, REST or the Web Services connector, including applications with no out-of-the-box connector.
IdentityIQ enhancement and migration planning
Changes to existing IdentityIQ estates (BeanShell rules, workflows, lifecycle events, new applications), and an inventory that maps your IIQ rules, workflows and roles to Identity Security Cloud equivalents if you are planning a move.
Support and managed services
Production support after go-live: aggregation and provisioning issues, new applications, certification campaign runs and role or policy changes. The support section below explains how it works.
SailPoint capacity for IAM consultancies
For consultancies and system integrators that win SailPoint work: individual consultants, a pod with a lead, or a scoped workstream delivered under your brand, billed monthly at our published IAM consultant rates.
Example: for a Fortune 500 distribution company in the US, our consultants contributed to the Identity Security Cloud implementation: onboarding enterprise applications, configuring provisioning workflows and standing up RBAC and access certifications, with Workday and Oracle HRMS feeding identity data through SCIM 2.0 and REST. Read the Fortune 500 distributor case study.
Choosing a SailPoint implementation partner
A SailPoint implementation partner connects your HR system and directories to IdentityIQ or Identity Security Cloud, cleans and correlates identity data, onboards your applications, automates joiner-mover-leaver access, builds roles, Segregation of Duties policies and certification campaigns, and supports the platform after go-live. When you compare partners, check the six points below. This is how we answer each of them.
Delivered work on your platform
Ask for case studies on the platform you run. Ours cover three Identity Security Cloud implementations (a global mining and metals leader in the UK, a Fortune 500 distributor and a cybersecurity firm in the US) and two IdentityIQ 8.x engagements (a healthcare provider and a bank in the UAE).
Identity data before automation
Provisioning is only as good as the data under it. We connect authoritative sources such as Workday or Oracle HRMS, Active Directory and Entra ID first, and make sure every account correlates to a real person before joiner-mover-leaver automation is switched on.
Connectors for the applications you actually have
Most estates include applications with no out-of-the-box connector. We onboard them through JDBC, SCIM 2.0, REST or the Web Services connector, and agree which aggregation and provisioning operations are realistic before building.
Configuration first, custom code last
SailPoint's own guidance treats rules as a last resort. We use standard connectors, transforms and workflows first and write custom rules only where they are needed, so upgrades and a later move to Identity Security Cloud stay manageable.
Support after go-live
Identity governance keeps changing with the organisation. We stay on for production support: aggregation and provisioning issues, new application onboarding, certification campaign runs and platform tuning.
Who you deal with, rates and hours
Your first conversation is with our founder, who runs delivery and client relationships directly. Our IAM consultant rates are published in the FAQ below, our engineers work US and UK business hours, and New Delhi is only 1.5 hours ahead of the UAE.
Example: for a global mining and metals leader, our consultants implemented Identity Security Cloud, onboarded enterprise applications through REST, JDBC and directory integrations, automated joiner-mover-leaver access with Active Directory and Entra ID, and stayed on for production support. Read the global miner case study.
SailPoint support and managed services after go-live
SailPoint support after go-live means keeping IdentityIQ or Identity Security Cloud accurate as the organisation changes: fixing aggregation and provisioning failures, onboarding new applications, running certification campaigns and tuning the platform. MappOptimist provides this as an ongoing engagement for enterprises and as white-label capacity for consultancies. Two of our published Identity Security Cloud case studies, for a global mining and metals leader and a US cybersecurity firm, ran as implementation followed by production support.
Production issue resolution
Aggregation failures, provisioning errors and correlation issues are investigated and fixed at the source, so accounts keep matching real people and access keeps matching policy.
New applications and connectors
As your application estate grows, we onboard new systems through standard connectors, JDBC, SCIM 2.0, REST or the Web Services connector, and agree the aggregation and provisioning scope first.
Certification campaigns and evidence
We set up and run access certification campaigns and governance reporting, so access reviews produce the evidence your audit and compliance teams ask for.
Policy, role and workflow changes
Reorganisations, new roles and new Segregation of Duties rules are changes to configuration, not one-off projects. We make them through standard configuration first and custom rules only where needed.
Support for an estate you already run
Our consultants work inside existing IdentityIQ and Identity Security Cloud estates as readily as on new builds, either embedded in your IAM team or as a scoped support workstream.
How it is set up and billed
Support runs on dedicated SailPoint engineers billed monthly on a rolling basis at our published IAM consultant rates, in your business hours: US and UK hours, and almost the whole UAE working day.
Example: for a US cybersecurity firm, our consultants hardened access request, certification and provisioning on Identity Security Cloud, then resolved production issues and supported governance and compliance reviews so access stayed least-privilege as the environment changed. Read the cybersecurity firm case study.
SailPoint implementation partner for UK organisations
For organisations in the UK, MappOptimist implements, extends and supports SailPoint Identity Security Cloud and IdentityIQ remotely from New Delhi, with engineers who work UK business hours. Our published UK SailPoint work is an Identity Security Cloud implementation and production support programme for a global mining and metals leader. UK enterprises can hire us directly, and UK IAM consultancies and system integrators can use the same consultants as extra SailPoint capacity on projects they have won.
Identity Security Cloud delivered for a UK client
For a global mining and metals leader, our consultants onboarded enterprise applications into Identity Security Cloud through REST, JDBC and directory integrations, automated joiner-mover-leaver access with Active Directory and Microsoft Entra ID, and set up role-based access and certification campaigns.
Implementation followed by production support
The same UK programme moved from phased rollout to hypercare and ongoing production support, so the people who built the configuration also kept it tuned as the application estate changed.
Working UK hours
New Delhi is 4.5 hours ahead of the UK during British Summer Time and 5.5 hours in winter. Our SailPoint engineers work your business hours, so design sessions, change windows and support calls happen in your day.
Capacity for UK IAM consultancies
If you are a UK consultancy or system integrator with a SailPoint project and too few engineers, our consultants work under your delivery lead and client relationship: individual roles on your team or a scoped workstream such as connectors, certifications or production support.
IdentityIQ estates and a move to the cloud
Our consultants work on both platforms. If you run IdentityIQ and are weighing Identity Security Cloud, we can map your IIQ rules, workflows and roles to ISC equivalents before you commit to a migration plan.
Who you deal with and how it is billed
Your first conversation is with our founder. We have no UK office and work with UK organisations remotely. Dedicated SailPoint engineers are billed monthly on a rolling basis at the published IAM consultant rates in the FAQ below.
Example: the global mining and metals leader's Identity Security Cloud programme was delivered for a UK client, from application onboarding and joiner-mover-leaver automation through certification campaigns to production support. Read the UK global miner case study.
SailPoint identity governance in Dubai and the UAE
For organisations in Dubai and across the UAE, MappOptimist implements, enhances and supports SailPoint IdentityIQ and Identity Security Cloud with engineers in India, where the working day is only 1.5 hours ahead of the UAE. We have delivered SailPoint IdentityIQ 8.x for a leading UAE healthcare provider and a leading UAE banking organisation.
Healthcare: centralised identity governance
IdentityIQ 8.x as the governance core for a major UAE healthcare organisation: Active Directory integration, automated joiner-mover-leaver workflows, custom BeanShell workflows, application onboarding and access certification campaigns.
Banking: SoD controls and regulatory reporting
IdentityIQ implementation and enhancement for a UAE bank: core banking applications integrated through JDBC, Oracle Database and web services, role-based access, Segregation of Duties, certification campaigns and governance reporting for regulators.
Working hours that match the UAE
UAE time is 1.5 hours behind India, so our SailPoint engineers share almost all of your working day: live calls, change windows and production support happen in your hours, not overnight.
Implementation, enhancement or support
A scoped implementation, an enhancement programme on an existing IdentityIQ estate, or SailPoint engineers who join your IAM team on a monthly rolling basis at published hourly rates.
Planning a move to Identity Security Cloud
Both UAE engagements run on IdentityIQ. If you are weighing a move to Identity Security Cloud, our consultants have worked on both platforms and can map your IIQ rules, workflows and roles before you commit.
Both UAE engagements are published as anonymised case studies, alongside our UK and US Identity Security Cloud work. Read the UAE banking case study.
Problems we solve
Provisioning still runs on tickets
Every joiner, mover and leaver needs someone to create, change or remove accounts by hand. Access lags on day one, lingers after exit, and the effort grows with headcount instead of shrinking.
Nobody can say who has access to what
Entitlements are scattered across Active Directory, Entra ID and dozens of applications with no single view. Over-entitlement builds up quietly until an auditor or an incident finds it.
Audits and certifications are a spreadsheet exercise
Reviewers rubber-stamp access lists exported by hand, SoD conflicts are found after the fact, and producing evidence for regulators takes weeks of manual work.
An IdentityIQ estate full of custom code
Years of BeanShell rules, custom workflows and JDBC connectors make IdentityIQ upgrades risky and a move to Identity Security Cloud hard to scope. You need people who can read what is actually there.
Your SailPoint bench is too thin
Consultancies and system integrators win SailPoint work and then struggle to staff it. Experienced IdentityIQ and ISC engineers are hard to hire quickly and expensive to keep idle between projects.
What we build
SailPoint Identity Security Cloud implementation
Tenant configuration, identity profiles, source onboarding and provisioning through REST, SCIM 2.0, JDBC, Web Services and directory connectors. Workday or Oracle HRMS as the authoritative source, Active Directory and Microsoft Entra ID as core targets, with PowerShell for directory automation where needed.
SailPoint IdentityIQ consultants
IdentityIQ 8.x deployment, enhancement and support: application onboarding via JDBC, Oracle Database and web services, custom BeanShell rules and workflows, lifecycle events, provisioning policies and governance reporting. We work inside existing IIQ estates as readily as on new builds.
Joiner-mover-leaver automation
We model the real lifecycle from HR data first, then automate it: birthright access on hire, role changes that remove old entitlements on a move, and timely revocation on exit. Access follows the person, and the team handles exceptions instead of every request.
RBAC, Segregation of Duties and certifications
Role models built from actual entitlement data, SoD policies that block conflicting access at request time, governed access request and approval flows, and recurring certification campaigns (manager, entitlement owner, targeted) that produce audit-ready evidence on demand.
IdentityIQ to Identity Security Cloud migration
We inventory your IIQ applications, BeanShell rules, workflows and custom connectors, then map each one to its ISC equivalent: standard connectors, transforms, cloud rules, workflows or an external service. Sources, roles and certification campaigns move in waves, with both platforms reconciled until cut-over.
SailPoint connector development and support
Onboarding applications with no out-of-the-box connector through JDBC, Web Services, SCIM 2.0 or REST, plus production support after go-live: aggregation failures, provisioning errors, correlation issues and platform tuning as your application estate changes.
How an engagement runs
- Step 01
Map identity where it actually lives
We start with the directories and applications in scope: authoritative sources, account and entitlement data quality, correlation rules and the real joiner-mover-leaver process. Nothing is automated until the data underneath it is understood.
- Step 02
Integrate sources and clean the data
HR systems such as Workday or Oracle HRMS, Active Directory and Entra ID are connected first, and identity data is reconciled so every account correlates to a real person before provisioning is switched on.
- Step 03
Automate lifecycle and governance
We build JML workflows, onboard applications, then layer RBAC, SoD policies, access requests and certification campaigns on the clean foundation, testing each release in non-production before it reaches users.
- Step 04
Go live and support in production
Production support follows every implementation: issue resolution, new application onboarding, campaign runs and platform changes, so governance keeps holding as the organisation changes.
Ways to work with us
SailPoint implementation project
A managed team runs a defined scope such as an ISC rollout, an IIQ enhancement or an IIQ to ISC migration, against outcomes you agree up front. We handle delivery management; you own decisions and sign-off.
Dedicated SailPoint engineers
Individual IdentityIQ or ISC engineers, or a dedicated team with a lead, working inside your IAM team, tools and ceremonies on a monthly rolling basis. You interview and approve everyone before they start.
White-label delivery for consultancies
For IT consultancies and system integrators, our SailPoint engineers deliver under your brand and your client relationship, as overflow capacity or a full delivery pod. You stay the face to the client.
Need individual engineers rather than a project? See the roles you can hire and their rates.
Technology we work with
Case studies
Identity governance for a global miner
SailPoint Identity Security Cloud automating identity lifecycle and access governance across the enterprise for one of the world's leading mining organisations.
Read the case study →SailPoint ISC · DistributionAccess governance for a Fortune 500 distributor
SailPoint Identity Security Cloud streamlining access management and strengthening identity governance controls for a Fortune 500 distribution organisation.
Read the case study →SailPoint ISC · CybersecurityIdentity governance for a global security firm
SailPoint Identity Security Cloud securing user access and automating identity management for a global cybersecurity organisation.
Read the case study →SailPoint IIQ · HealthcareCentralised identity governance in healthcare
SailPoint IdentityIQ establishing centralised identity governance and automating user access management for a major UAE healthcare organisation.
Read the case study →SailPoint IIQ · Banking & FinanceCompliance-grade IAM for a bank
SailPoint IdentityIQ delivering identity governance, regulatory compliance and access management for a leading banking institution.
Read the case study →Frequently asked questions
What SailPoint consulting services do you offer?
Our SailPoint consulting services cover IdentityIQ and Identity Security Cloud: assessment and a phased plan, implementation (HR and directory sources, joiner-mover-leaver automation, RBAC, Segregation of Duties, certification campaigns), application onboarding and custom connectors, IdentityIQ enhancement and migration planning, and production support after go-live. Enterprises in the US, UK and UAE hire us directly, and IAM consultancies use our consultants as white-label SailPoint capacity. Our five published SailPoint case studies cover the UK, US and UAE.
What is SailPoint identity governance?
SailPoint identity governance means using SailPoint IdentityIQ (installed on your own infrastructure) or Identity Security Cloud (SaaS run by SailPoint) to control who has access to what. The platform reads identities from HR and directory sources, grants and removes access as people join, move and leave, enforces roles and Segregation of Duties policies, and runs access certifications that give auditors evidence. MappOptimist implements and supports it on both platforms, with five published SailPoint case studies in the UK, US and UAE.
What does a SailPoint implementation partner do?
A SailPoint implementation partner designs and builds your identity governance on IdentityIQ or Identity Security Cloud: it integrates HR and directory sources, cleans and correlates identity data, onboards applications through standard or custom connectors, automates joiner-mover-leaver access, sets up roles, Segregation of Duties policies and certification campaigns, and supports the platform after go-live. MappOptimist does this for enterprises directly and as white-label SailPoint capacity for consultancies, with five published case studies in the UK, US and UAE.
Do you provide SailPoint support and managed services after go-live?
Yes. After go-live our SailPoint engineers handle production support on IdentityIQ and Identity Security Cloud: aggregation and provisioning issues, correlation problems, new application onboarding, certification campaign runs, role and policy changes and platform tuning. Our published ISC work for a global mining and metals leader and a US cybersecurity firm both ran as implementation followed by production support. Support is billed per engineer, monthly rolling, at our published IAM consultant rates.
Do you work with SailPoint customers in the UK?
Yes. Our published UK SailPoint work is an Identity Security Cloud implementation and production support programme for a global mining and metals leader: application onboarding through REST, JDBC and directory integrations, joiner-mover-leaver automation with Active Directory and Microsoft Entra ID, role-based access and certification campaigns. We work with UK enterprises and IAM consultancies remotely from New Delhi, with engineers on UK business hours and a founder-led first call. We have no UK office.
Do you deliver SailPoint projects in the UAE and Dubai?
Yes. Our published SailPoint IdentityIQ work in the UAE covers a leading healthcare provider (centralised governance, joiner-mover-leaver automation, certifications) and a leading banking organisation (RBAC, Segregation of Duties, certification campaigns and regulatory reporting). We deliver remotely from India, with a founder-led first call and engineers working UAE hours.
Can your SailPoint engineers work UAE business hours?
Yes. India is 1.5 hours ahead of the UAE, so a normal Indian working day covers almost all of the UAE working day. Our engineers join your standups, change windows and support calls in your hours, whether they work as a project team or embedded in your IAM team.
Do you work on SailPoint IdentityIQ, Identity Security Cloud, or both?
Both. Our published case studies cover three Identity Security Cloud engagements (a global miner in the UK, a Fortune 500 distributor and a cybersecurity firm in the US) and two IdentityIQ engagements (a healthcare provider and a bank, both in the UAE). The work spans source integration, JML automation, RBAC, SoD, certification campaigns and production support.
How do you approach an IdentityIQ to Identity Security Cloud migration?
We begin with an inventory of the IIQ estate: applications and connectors, BeanShell rules, custom workflows, roles, SoD policies and certification definitions. Each item is mapped to an ISC equivalent or flagged for redesign, since IIQ customisations do not transfer directly. Sources and roles then move in waves, with aggregation and access reconciled between both platforms before each cut-over.
Is Identity Security Cloud now called SailPoint Human Fabric?
In August 2026 SailPoint launched SailPoint Human Fabric, which it describes as the evolution of Identity Security Cloud, and its developer documentation now uses the new name. The implementation, connector and governance work described on this page applies whichever name you use. If you are planning a move from IdentityIQ, see our IdentityIQ to Identity Security Cloud migration page.
Can you build a connector for an application SailPoint does not support out of the box?
Usually, yes. Most applications can be onboarded through JDBC against the application database, SCIM 2.0, REST or the Web Services connector, which we have used across our ISC and IdentityIQ engagements. We assess the application's API or data model first, then agree what aggregation and provisioning operations are realistic before building.
Can we hire SailPoint developers to join our existing IAM team?
Yes. You can bring in individual SailPoint engineers or a dedicated team with a lead, working in your tools, ticketing and standups on a monthly rolling basis. You interview and approve each engineer before they start, and we match working hours to your team wherever possible.
We are a consultancy. Can you deliver SailPoint work under our brand?
Yes. White-label delivery is designed for IT consultancies and system integrators that win SailPoint projects but need extra engineering capacity. Our engineers work under your delivery lead and client relationship, either filling specific roles on your project or running a scoped workstream such as connector development, certification setup or production support.
How is a SailPoint engagement priced?
Staff augmentation is billed per engineer on a monthly rolling basis, and scoped projects are quoted against agreed outcomes. Our 2026 rate card lists an Identity & Access Management (IAM) Consultant at $46/hr (2-3 years), $54/hr (4-6 years) and $62/hr (6+ years). Rates are indicative and confirmed per engagement scope, duration and resource availability.
Do you hold a SailPoint partner status or certification?
We do not claim a SailPoint partner tier on this site. What we show instead is delivery evidence: five published SailPoint case studies across mining, distribution, cybersecurity, healthcare and banking, with the platforms, integrations and governance controls used in each. We are happy to walk through that work in detail on a call.
Related services
Discuss your SailPoint programme
ISC rollout, IdentityIQ enhancement, an IIQ to ISC migration or engineers for a project you have already won: tell us where you are and we will come back within one business day with a clear point of view.