ExamFinch.com My Study

Study guide

17.3 The Difference Between Group Types

Practice this exam

SailPoint Certified IdentityIQ Engineer Exam

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: The IdentityIQ Engineer Exam

1.1 Exam Format, Official Blueprint, and Study Strategy

2 Chapter 2: Infrastructure, Installation, and Extended Attributes

2.1 IdentityIQ Infrastructure Components 2.2 Installation Steps and Procedures 2.3 Creating Extended Attributes and the Objects That Support Them

3 Chapter 3: Build, Deployment, Patching, Access, and Email

3.1 Ongoing Build and Deployment 3.2 Installing Patches and Performing Upgrades 3.3 Configuring End-User Access 3.4 Email Server Settings and Email Redirection

4 Chapter 4: Lifecycle Manager Configuration, Provisioning Policies, and Workflows

4.1 Configuring Lifecycle Manager 4.2 Identity Provisioning Policies 4.3 Configuring LCM Workflows

5 Chapter 5: Lifecycle Events, QuickLinks, Batch Requests, and Rapid Setup

5.1 Lifecycle Events and Their Workflows 5.2 QuickLinks and QuickLink Populations 5.3 Configuring and Using Batch Requests 5.4 Rapid Setup in Lifecycle Events and Identity Operations

6 Chapter 6: Certification Campaigns and Certification Rules

6.1 Configuring and Scheduling Certification Campaigns 6.2 The Purpose of Common Certification Rules

7 Chapter 7: Policies and Policy Violations

7.1 Configuring and Leveraging Policies 7.2 Responding to Policy Violations

8 Chapter 8: Reporting, Advanced Analytics, and Auditing

8.1 Executing and Leveraging Reports 8.2 Leveraging Advanced Analytics 8.3 Configuring and Using Auditing

9 Chapter 9: Rules, Rule Libraries, and the SailPoint API

9.1 The Purpose and Use of Rule Libraries 9.2 Rule Input and Output Arguments 9.3 Common SailPoint API Objects and Methods

10 Chapter 10: Workflow Development

10.1 Workflow Variables, Transitions, and Step Conditions 10.2 Workflow Steps That Generate Work Items 10.3 The Different Workflow Step Usages 10.4 Leveraging Sub-Workflows

11 Chapter 11: Email Templates, Branding, and Localization

11.1 Customizing and Using Email Templates 11.2 Branding the SailPoint User Interface 11.3 Localizing the SailPoint UI

12 Chapter 12: Application Definitions, Connector Settings, and Rapid Setup Aggregation

12.1 Configuring Application Definitions 12.2 Configuring Common Connector Settings 12.3 Configuring Rapid Setup Aggregation Settings

13 Chapter 13: Data-Loading Tasks and Application and Connector Rules

13.1 Scheduling Tasks for Data Loading and Processing 13.2 Common Application Rule Types 13.3 Common Connector Rule Types

14 Chapter 14: Debugging with log4j, Syslog, and the IdentityIQ Console

14.1 Configuring and Leveraging log4j 14.2 Configuring and Leveraging Syslog 14.3 Leveraging the IdentityIQ Console for Debugging

15 Chapter 15: Debug Pages and the Administrator Console

15.1 Leveraging the Debug Pages for Debugging 15.2 Leveraging the Administrator Console for Debugging

16 Chapter 16: Role Model and Identity Attribute Mappings

16.1 Default Role Models and Role Types 16.2 Configuring Roles and Role Options 16.3 Configuring Identity Attribute Mappings

17 Chapter 17: Data Objects, Relationships, and Group Types

17.1 Common IdentityIQ Data Objects 17.2 Relationships Between Common Data Object Models 17.3 The Difference Between Group Types

17.3 The Difference Between Group Types

Key Takeaways Explain This Topic AI

Account groups are target-system groups, aggregated as ManagedAttributes in the Entitlement Catalog and certified in account group certifications.

Workgroups are sets of identities (stored as Identity objects) that share ownership, work items, and IdentityIQ capabilities and scopes.

Groups are generated by a Group Factory from one Group Factory identity attribute, one GroupDefinition per value, for filtering and statistics.

Populations are saved Advanced Analytics queries on searchable attributes, stored as GroupDefinition objects and re-evaluated each time they are used.

Populations can be used in IT role mining and Activity Search, but groups cannot.

Last updated: September 2026

The Difference Between Group Types

Objective 7.7 asks you to understand the difference between different group types . In IdentityIQ, "group" can mean four different things, plus roles , which also group access. The exam checks that you pick the right one.

The Four "Groups" at a Glance

Type What it groups How it is created Stored as Main purpose

Account group (application object) Accounts on a target application , such as an AD group Account Group Aggregation from a group schema ManagedAttribute (group entitlements) Entitlements: catalog, requests, account group membership and permissions certifications

Workgroup IdentityIQ identities who share responsibilities Setup > Groups > Workgroups (Create Workgroup) An Identity flagged as a workgroup Shared ownership, work items, approvals, certifications, and capabilities and scopes

Group (Group Factory group) Identities that share one value of one identity attribute Setup > Groups > Groups , Create New Group on a Group Factory attribute GroupFactory , a GroupDefinition per value, and a GroupIndex (scorecard) Filtering tasks, certifications, and reports, plus statistics such as members, violations, and risk

Population Identities matching a multi-criteria query Advanced Analytics : save identities as a population GroupDefinition Filtering and targeting: certifications, tasks, reports, QuickLink populations, role mining, Rapid Setup

Roles (Bundles) are different again. They model job functions and entitlements , affect provisioning, and appear in certifications (section 16.1).

Account Groups

Account groups exist on the target system . IdentityIQ reads them with Account Group Aggregation (section 13.1), and all groups read are added to the Entitlement Catalog as managed attributes. Account groups:

can be requestable , owned , described , and classified .

are certified in Account Group Membership certifications (the right accounts in the group) and Account Group Permissions certifications (the right permissions on the group). Groups without owners are certified by the application owner.

are linked to accounts through the account schema's entitlement attribute type (section 12.2).

Workgroups

A workgroup lets several people act as one owner . Assign a workgroup as an application owner, certifier, approver, policy violation owner, or work item owner, and any member can act. Workgroups also carry Capabilities and Authorized Scopes , which members inherit. For example, a "Certification Admins" workgroup can hold the Certification Administrator capability.

Workgroup settings include an owner, description, a scope that limits who can see the workgroup in selection lists, a Group Email (ideally a distribution list), and Notification Setting :

  • Notify members and group email (members may receive two copies if the group email is a distribution list)
  • Notify group email only
  • Notify members only
  • Disable notifications
  • Groups (Group Factories)

Only identity attributes flagged Group Factory (section 16.3) can define groups.

Creating a group on, say, Region produces one GroupDefinition per value , for example North America, Western Europe, and Asia. You create sets of groups, not single groups.

Membership is evaluated when the group is used , by filter. The list of GroupDefinitions and the GroupIndex statistics are updated only when Identity Refresh runs with Refresh the group scorecards . A new attribute value gets no group until that refresh runs . The Refresh Groups task and console refreshGroups / refreshFactories also maintain them.

Groups can also be based on common entitlements through the role group attribute. Identities matching no role fall into a No role group, and a Global group contains everyone.

Populations

Built in Advanced Analytics from Identity Search or Advanced Search. They can combine multiple criteria on searchable attributes, with AND/OR and operators beyond equals.

The query is saved, not the member list . Membership is re-evaluated at each use.

They are also stored as GroupDefinition objects, so they can be exported, edited, and reimported as deployment artifacts through the Debug pages or the console.

Where Groups and Populations Can Be Used

  • Use Population Group
  • Identity Refresh and Policy Scan task filters Yes Yes
  • Advanced certifications Yes Yes
  • Targeted certifications ("who to certify") Yes Not listed (use attribute filters)
  • Access Review Search criteria Yes Yes
  • Activity Search criteria Yes No

Report filters (such as Advanced Access Review, Identity Effective Access, Identity Risk, Identity Role) Yes Yes

  • IT role mining Yes No
  • QuickLink populations, lifecycle events, and Rapid Setup filters (selectors) Yes Not directly
  • Exam Traps

"Assign the Help Desk capability to everyone in the Help Desk group ." If this means people in IdentityIQ, use a workgroup . An AD group is an account group and grants no IdentityIQ rights.

"Certify who is in the VPN-Users AD group." That is an Account Group Membership certification, not a workgroup review.

"Run a refresh only for EMEA employees in Finance with high risk." That is a population (multi-criteria), not a group (single attribute).

"A new region value appeared yesterday, but no group exists for it." Run Identity Refresh with Refresh the group scorecards .