12.3 Configuring Rapid Setup Aggregation Settings

SailPoint Certified IdentityIQ Engineer Exam

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: The IdentityIQ Engineer Exam

1.1 Exam Format, Official Blueprint, and Study Strategy

2 Chapter 2: Infrastructure, Installation, and Extended Attributes

2.1 IdentityIQ Infrastructure Components 2.2 Installation Steps and Procedures 2.3 Creating Extended Attributes and the Objects That Support Them

3 Chapter 3: Build, Deployment, Patching, Access, and Email

3.1 Ongoing Build and Deployment 3.2 Installing Patches and Performing Upgrades 3.3 Configuring End-User Access 3.4 Email Server Settings and Email Redirection

4 Chapter 4: Lifecycle Manager Configuration, Provisioning Policies, and Workflows

4.1 Configuring Lifecycle Manager 4.2 Identity Provisioning Policies 4.3 Configuring LCM Workflows

5 Chapter 5: Lifecycle Events, QuickLinks, Batch Requests, and Rapid Setup

5.1 Lifecycle Events and Their Workflows 5.2 QuickLinks and QuickLink Populations 5.3 Configuring and Using Batch Requests 5.4 Rapid Setup in Lifecycle Events and Identity Operations

6 Chapter 6: Certification Campaigns and Certification Rules

6.1 Configuring and Scheduling Certification Campaigns 6.2 The Purpose of Common Certification Rules

7 Chapter 7: Policies and Policy Violations

7.1 Configuring and Leveraging Policies 7.2 Responding to Policy Violations

8 Chapter 8: Reporting, Advanced Analytics, and Auditing

8.1 Executing and Leveraging Reports 8.2 Leveraging Advanced Analytics 8.3 Configuring and Using Auditing

9 Chapter 9: Rules, Rule Libraries, and the SailPoint API

9.1 The Purpose and Use of Rule Libraries 9.2 Rule Input and Output Arguments 9.3 Common SailPoint API Objects and Methods

10 Chapter 10: Workflow Development

10.1 Workflow Variables, Transitions, and Step Conditions 10.2 Workflow Steps That Generate Work Items 10.3 The Different Workflow Step Usages 10.4 Leveraging Sub-Workflows

11 Chapter 11: Email Templates, Branding, and Localization

11.1 Customizing and Using Email Templates 11.2 Branding the SailPoint User Interface 11.3 Localizing the SailPoint UI

12 Chapter 12: Application Definitions, Connector Settings, and Rapid Setup Aggregation

12.1 Configuring Application Definitions 12.2 Configuring Common Connector Settings 12.3 Configuring Rapid Setup Aggregation Settings

13 Chapter 13: Data-Loading Tasks and Application and Connector Rules

13.1 Scheduling Tasks for Data Loading and Processing 13.2 Common Application Rule Types 13.3 Common Connector Rule Types

14 Chapter 14: Debugging with log4j, Syslog, and the IdentityIQ Console

14.1 Configuring and Leveraging log4j 14.2 Configuring and Leveraging Syslog 14.3 Leveraging the IdentityIQ Console for Debugging

15 Chapter 15: Debug Pages and the Administrator Console

15.1 Leveraging the Debug Pages for Debugging 15.2 Leveraging the Administrator Console for Debugging

16 Chapter 16: Role Model and Identity Attribute Mappings

16.1 Default Role Models and Role Types 16.2 Configuring Roles and Role Options 16.3 Configuring Identity Attribute Mappings

17 Chapter 17: Data Objects, Relationships, and Group Types

17.1 Common IdentityIQ Data Objects 17.2 Relationships Between Common Data Object Models 17.3 The Difference Between Group Types

12.3 Configuring Rapid Setup Aggregation Settings

Key Takeaways Explain This Topic AI

Rapid Setup aggregation settings are on Applications > Rapid Setup for applications whose connection and schema are already defined.

Create Entitlements That Cannot Be Requested keeps an application's aggregated entitlements out of access requests and the requestable catalog.

Disable Account and Lock Account filters appear only for applications that do not natively support disable or lock, and they take precedence over customization rules.

Rapid Setup allows only one account correlation method and one manager correlation method per application.

Service Account and RPA filters set the identity Type and the account's Identity_Type during aggregation; when both match, Service Account wins.

Last updated: September 2026

Configuring Rapid Setup Aggregation Settings

Objective 5.3 asks you to configure Rapid Setup aggregation settings . Rapid Setup (section 5.4) separates technical onboarding from business onboarding . Technical onboarding (connection parameters, schema, test connection, authoritative flag) is done first in Application Definition. Business onboarding covers how accounts should be interpreted and what happens as people join, move, and leave. The Aggregation section of Applications > Rapid Setup is where a business-savvy administrator tells IdentityIQ how to interpret an application's accounts.

The documentation stresses that Rapid Setup does not add new aggregation functions . It offers a guided way to set options that otherwise need rules or application-definition settings. Sample rules for Rapid Setup are in WEB-INF/config/rapidsetup/rsexamplerules.xml .

Prerequisites

The application exists with its connection parameters and schema , a successful test connection , and a decision on whether it is authoritative .

Lifecycle Manager is licensed and activated, because Rapid Setup comes with LCM.

Helpful extras: populations, birthright roles, provisioning policies, and email templates prepared in advance.

The Aggregation Settings
1. Create Entitlements That Cannot Be Requested

When enabled, entitlements created by aggregation for this application are not requestable , either from the Entitlement Catalog or in access requests. Use it for applications whose access should come only from roles or birthright processes, never from self-service.

2. Disable Account / Lock Account

Some applications have no native concept of disabled or locked accounts, such as a flat file with a STATUS column. For these, Rapid Setup shows Disable Account and Lock Account filters :

The filters appear only for applications that do not natively support disable or lock.

If a filter matches an account during aggregation, IdentityIQ marks the account disabled or locked .

These filters take precedence over aggregation customization rules defined elsewhere. The documentation notes that a Customization rule is the other way to mark accounts disabled or locked.

Example: Disable Account when STATUS Equals T , so terminated rows in an HR extract appear as disabled accounts in IdentityIQ.

3. Account and Manager Correlation

Account correlation : choose an application attribute that uniquely identifies the account, an operator (usually Equals ), and the identity attribute it matches. Example: EMP_NO equals employeeId .

Manager correlation : choose the application attribute that identifies the manager and the identity attribute to match. This is usually the same identity attribute used for account correlation, for example MGR_EMP_NO equals employeeId .

Limits : Rapid Setup supports only one account correlation method and one manager correlation method per application, with no multiple correlation rules . If correlation is already defined in the application definition, Rapid Setup shows it by default so you can edit it or replace it.

4. Service Account and RPA Account Correlation

Filters identify service and RPA (bot) accounts from application attributes:

Filter matches Identity attribute Type Account attribute Identity_Type
Service Account filter Service Account Service
RPA Account filter RPA / BOTS RPA
Both filters match Service Account Service (Service wins)

Only one Service filter and one RPA filter are allowed per application. Correctly typed identities matter later. Certifications can target bots, and access reviews for Service or RPA/Bot identities go to the certifier configured for them. The Leaver process can reassign identities the leaver administered.

How Aggregation Settings Connect to Joiner Processing

The joiner options on the same page depend on good aggregation settings:

Automatically Start Joiner Processing for Newly Created Identities starts joiner processing during aggregation when a new identity is created. That only happens reliably if authoritative correlation is right.

It is not available for non-authoritative accounts when the global joiner configuration excludes uncorrelated identities .

Perform Account-Only provisioning creates accounts on this application for joiners who match the identity selection (Everyone, Filter, Script, IdentitySelector Rule, or Population).

Rapid Setup vs. Full Application Definition

Need Rapid Setup Application Definition
Simple attribute correlation Yes (one method) Yes
Condition-based or multi-rule correlation No Yes
Mark disabled or locked accounts for non-native apps Filters Customization rule
Tag service and bot accounts Filters Rules or extended attributes
Make entitlements non-requestable One checkbox Per-entitlement catalog settings or a rule
Connection, schema, partitioning, provisioning policies No Yes
Worked Example: Onboarding a Payroll Application With Rapid Setup

An administrator has created a JDBC application, Payroll , with a working connection and schema (EMP_NO, STATUS, MGR_EMP_NO, SVC_FLAG). On Applications > Rapid Setup , they set:

Create Entitlements That Cannot Be Requested: on, because payroll roles come only from birthright processing.

Disable Account filter: STATUS Equals I, so inactive payroll records appear as disabled accounts.

Account correlation: EMP_NO equals the identity attribute employeeId. Manager correlation: MGR_EMP_NO equals employeeId.

Service Account filter: SVC_FLAG Equals Y, so these accounts' identities get the Type Service Account .

Joiner: Perform Account-Only provisioning for the Payroll Staff population.

After a sandbox aggregation, the administrator checks that no payroll entitlement is requestable, that inactive rows show as disabled, and that service accounts are no longer uncorrelated.

Troubleshooting

Turn on debug logging for sailpoint.rapidsetup and sailpoint.workflow.RapidSetupLibrary in log4j2.properties (section 14.1). Then rerun aggregation and check the task result and the affected accounts' flags and identity links.