← Tools

ISC workbench

Runs in your browser, nothing uploaded

Input

Export from IdentityIQ with export <ObjectType> "<name>" or export -clean all.xml.

Drop .xml files here or press Enter or Space to choose files

Loaded files

Or paste XML

Load at least one file to convert.

Drop an IIQ export here, or load the sample to see a conversion.

Input

Simulates a subset of ISC transform types. Confirm with ISC's transform preview.

Load a transform from the migration result

Transform JSON

Sample identity attributes (JSON object)

Sample accounts (JSON: source name to attribute object or array of objects)

Library (JSON object of transform name to transform, used by reference)

Output

No run yet. Press Run to simulate the transform.

Trace

Warnings

Test cases

Blank identity or accounts cells use the sample values from the input. Expected output is compared as text.

Transform test cases
Name	Identity JSON	Accounts JSON	Expected output	Result	Actions

Help

Migrate

Converts an IdentityIQ XML export into ISC-ready JSON: sources, schemas, identity profiles, transforms, access profiles, roles, SOD policies and schedules. It flags what needs a human and generates a deploy script. The result is shared with Gap analysis and Transform lab.

Cannot do: move workflows, forms, certifications, email templates, lifecycle triggers or quick links. They are reported as needing a human.

How to deploy

In ISC, create a personal access token (or an API client) with the admin scopes needed to create sources, profiles and roles.
Set ISC_BASE_URL, ISC_CLIENT_ID and ISC_CLIENT_SECRET in your shell.
Unzip the output and open a terminal in that folder.
Run node deploy.mjs for a dry run. It lists what would be created and changes nothing.
Run node deploy.mjs --apply --stage 1 to create transforms, sources, schemas, identity attributes and profiles.
Aggregate the new sources in ISC so their entitlements exist.
Run node deploy.mjs --apply --stage 2 to create access profiles, roles and SOD policies.
Provide secrets through the SECRET__* environment variables listed in the report, then re-run the affected stage.

What it covers and what it does not

Converted automatically

Applications to sources: connector mapping, schemas, correlation, manager correlation, provisioning forms to policies.
Identity attribute configuration to identity attributes and identity profiles.
Simple BeanShell rules to transforms.
IT roles to access profiles.
Business roles to roles with membership criteria.
SOD policies.
Aggregation schedules.

Needs a human

Complex BeanShell rules. Cloud and connector rules need SailPoint review.
Workflows (skeleton only), forms, certifications, email templates, lifecycle triggers and quick links.
Secrets.
Connector attribute names for less common connectors.

No ISC equivalent

Identity refresh options.
Activity monitoring.
Rule-based owners.
Role hierarchy (flattened).
Permitted roles.

Caveat: the generated JSON targets the public ISC v3 and beta APIs as documented. Verify it against your tenant before production use.

Gap analysis

Scores the last migration by how hard each part is to move to ISC, then lists the objects behind every finding. The weights are shown so the score can be argued with.

Cannot do: estimate time. The score ranks relative effort. It only sees what is in the export, so plugins, activity and manual processes are not measured.

Transform lab

Runs an ISC transform in the browser against sample identity and account data. The trace shows every step. Test cases check expected outputs.

Cannot do: run ISC's own transform engine. This is a simulation of a subset of ISC transform types. Types it does not model are reported, not guessed. Confirm anything that matters with ISC's own transform preview.

Which transform types are simulated

Entitlements

Plans bulk edits to entitlement owners, descriptions, requestable and privileged flags from a CSV. Every row is checked. The kit is a plan plus a small script you run against your own tenant.

Cannot do: call ISC from the browser or change anything itself. ISC's bulk endpoint only changes requestable and privileged (up to 50 ids per call), so owners and descriptions are patched one entitlement at a time.

Two rows that name the same entitlement are rejected.
requestable and privileged accept true or false (also yes/no and 1/0). A blank cell leaves the value alone.
Owners are looked up in ISC by the key chosen in the input pane. The lookup must match exactly one identity.
Descriptions are written one at a time. Run the kit with --protect to mark them as manually updated so aggregation keeps them.

Run the kit

Unzip the kit and open a terminal in the entitlements folder.
Set ISC_BASE_URL (for example https://TENANT.api.identitynow.com), ISC_CLIENT_ID and ISC_CLIENT_SECRET.
Run node entitlements.mjs for a dry run. It prints each patch and changes nothing.
Run node entitlements.mjs --apply to resolve ids and send the patches.
Optional: add --protect to mark descriptions as manually updated.

Campaigns

Splits an identity list into certification campaigns that stay under a size limit. Each identity appears in exactly one campaign. Group columns keep related identities together, for example by department.

Cannot do: know ISC's real limit. Users report a search-campaign cap of about 10,000 items, so set your own limit. The kit creates campaigns but does not activate them, and it does not check that reviewers exist until you run it.

Run the kit

Unzip the kit and open a terminal in the campaigns folder.
Set ISC_BASE_URL, ISC_CLIENT_ID and ISC_CLIENT_SECRET.
Run node campaigns.mjs for a dry run.
Run node campaigns.mjs --apply to create the campaigns. They are not activated, so review them in ISC first.

Keyboard

Ctrl+Enter (or ⌘+Enter) runs the current module's main action.
? opens this help when you are not typing in a field.
Esc closes Help and Settings.
Arrow keys move between modules in the sidebar and between sub-tabs.

ISC workbench

Loaded files

Weights

Findings by risk

Output

Trace

Warnings

Test cases

Problems

Planned changes

Kit files

Problems

Campaigns

Settings