8.1 Executing and Leveraging Reports

SailPoint Certified IdentityIQ Engineer Exam

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: The IdentityIQ Engineer Exam

1.1 Exam Format, Official Blueprint, and Study Strategy

2 Chapter 2: Infrastructure, Installation, and Extended Attributes

2.1 IdentityIQ Infrastructure Components 2.2 Installation Steps and Procedures 2.3 Creating Extended Attributes and the Objects That Support Them

3 Chapter 3: Build, Deployment, Patching, Access, and Email

3.1 Ongoing Build and Deployment 3.2 Installing Patches and Performing Upgrades 3.3 Configuring End-User Access 3.4 Email Server Settings and Email Redirection

4 Chapter 4: Lifecycle Manager Configuration, Provisioning Policies, and Workflows

4.1 Configuring Lifecycle Manager 4.2 Identity Provisioning Policies 4.3 Configuring LCM Workflows

5 Chapter 5: Lifecycle Events, QuickLinks, Batch Requests, and Rapid Setup

5.1 Lifecycle Events and Their Workflows 5.2 QuickLinks and QuickLink Populations 5.3 Configuring and Using Batch Requests 5.4 Rapid Setup in Lifecycle Events and Identity Operations

6 Chapter 6: Certification Campaigns and Certification Rules

6.1 Configuring and Scheduling Certification Campaigns 6.2 The Purpose of Common Certification Rules

7 Chapter 7: Policies and Policy Violations

7.1 Configuring and Leveraging Policies 7.2 Responding to Policy Violations

8 Chapter 8: Reporting, Advanced Analytics, and Auditing

8.1 Executing and Leveraging Reports 8.2 Leveraging Advanced Analytics 8.3 Configuring and Using Auditing

9 Chapter 9: Rules, Rule Libraries, and the SailPoint API

9.1 The Purpose and Use of Rule Libraries 9.2 Rule Input and Output Arguments 9.3 Common SailPoint API Objects and Methods

10 Chapter 10: Workflow Development

10.1 Workflow Variables, Transitions, and Step Conditions 10.2 Workflow Steps That Generate Work Items 10.3 The Different Workflow Step Usages 10.4 Leveraging Sub-Workflows

11 Chapter 11: Email Templates, Branding, and Localization

11.1 Customizing and Using Email Templates 11.2 Branding the SailPoint User Interface 11.3 Localizing the SailPoint UI

12 Chapter 12: Application Definitions, Connector Settings, and Rapid Setup Aggregation

12.1 Configuring Application Definitions 12.2 Configuring Common Connector Settings 12.3 Configuring Rapid Setup Aggregation Settings

13 Chapter 13: Data-Loading Tasks and Application and Connector Rules

13.1 Scheduling Tasks for Data Loading and Processing 13.2 Common Application Rule Types 13.3 Common Connector Rule Types

14 Chapter 14: Debugging with log4j, Syslog, and the IdentityIQ Console

14.1 Configuring and Leveraging log4j 14.2 Configuring and Leveraging Syslog 14.3 Leveraging the IdentityIQ Console for Debugging

15 Chapter 15: Debug Pages and the Administrator Console

15.1 Leveraging the Debug Pages for Debugging 15.2 Leveraging the Administrator Console for Debugging

16 Chapter 16: Role Model and Identity Attribute Mappings

16.1 Default Role Models and Role Types 16.2 Configuring Roles and Role Options 16.3 Configuring Identity Attribute Mappings

17 Chapter 17: Data Objects, Relationships, and Group Types

17.1 Common IdentityIQ Data Objects 17.2 Relationships Between Common Data Object Models 17.3 The Difference Between Group Types

8.1 Executing and Leveraging Reports

Key Takeaways Explain This Topic AI

Reports are on Intelligence > Reports, with My Reports, Reports, Scheduled Reports, and Report Results tabs.

Adding filters to a standard report and saving it creates a customized instance on My Reports; the template itself stays on the Reports tab.

A report is a TaskDefinition of type LiveReport run by sailpoint.reporting.LiveReportExecutor, and its output is a TaskResult.

Previous Result Action (Delete, Rename Old, Rename New, Cancel) and Allow Concurrency control what happens when a report runs again.

Report data sources can be Filter, Java, or HQL; Filter is the simplest and runs a projection query.

Last updated: September 2026

Executing and Leveraging Reports

Objective 3.5 is execute and leverage reporting . Reports give auditors, managers, and administrators an at-a-glance view of IdentityIQ data, such as uncorrelated accounts, certification decisions, policy violations, and provisioning transactions. They can run on demand or on a schedule.

The Reports UI

Go to Intelligence > Reports :

• Tab Contents
• My Reports Your customized report instances , meaning saved versions of templates with your parameters
• Reports All standard report templates , grouped by category, plus any custom report templates
• Scheduled Reports Reports scheduled for future or repeated runs
• Report Results Completed runs you are allowed to see
• Three Kinds of Report

Report templates are the out-of-the-box reports on the Reports tab. You can run them directly or use them as a base.

Custom reports are customer-specific reports built as a new TaskDefinition specification. Once imported, they also appear on the Reports tab.

Customized report instances are your saved copies with preset parameters, shown on My Reports . If you add filters to a standard report and save it, you create an instance and the template does not change.

The documentation also groups output styles: Detailed reports (grid data you can export to CSV), and Archived and Summary reports (end-of-period audit information, best exported to PDF).

Running, Scheduling, and Distributing

Run: right-click and choose Execute (progress window, then results) or Execute in background (check the Report Results tab later). Save and Preview lets you adjust the layout, including column order, sort order, and hiding the summary or detail section.

Schedule: right-click and choose Schedule . Give the schedule a unique name and description so a scheduled run is not overwritten by someone running the same report ad hoc. Frequencies are once, hourly, daily, weekly, monthly, quarterly, or annually.

Export: export the results to a file. Exported reports do not appear on the Report Results page.

Delete: deleting a report also deletes its results.

Standard Report Properties

• Property Purpose
• Name (required) and Description Identify the instance

Require Signoff Creates sign-off work items for chosen signers. Results cannot be viewed or downloaded until sign-off is done. Choose a notification template and escalation style (None, Send Reminders, Reminders then Escalation, or Escalation only).

Previous Result Action Delete (overwrite), Rename Old (default; the old result gets a number), Rename New , or Cancel (do not run if a result with this name exists)

Allow Concurrency Lets two identical reports run at once, with the second renamed. Otherwise the second is cancelled.

Email Recipient , Email Attachment Format (PDF and/or CSV), Don't email empty reports Distribution without logging in

• Maximum results to display Caps the rows, on some reports
• Scope Only identities that control the scope can see the results

Searches from Advanced Analytics can also be saved as reports (section 8.2). They appear in the Search category on My Reports.

• Reports Under the Hood
• A report runs as a specialized task : <TaskDefinition executor="sailpoint.reporting.LiveReportExecutor"
• name="Uncorrelated Accounts Report" progressMode="Percentage"
• resultAction="Rename" subType="Identity and User Reports"
• template="true" type="LiveReport">

type="LiveReport" for all reports, including custom ones, and executor="sailpoint.reporting.LiveReportExecutor" .

template="true" puts the report on the Reports tab. Instances saved from it appear on My Reports.

resultAction is the Previous Result Action: Rename, RenameNew, Cancel, or Delete.

Results are stored as TaskResult objects.

The report body, <LiveReport> , defines a DataSource , Columns made of ReportColumnConfig entries, and optional forms, charts, and scripts. Data sources come in three types:

Filter – the simplest. It runs a projection query on an objectType , such as sailpoint.object.Link , using query parameters, and returns only the properties the columns need.

Java – a Java data source class for complex logic.

HQL – a Hibernate query.

For example, the Uncorrelated Accounts Report queries Link objects where identity.correlated is false, and shows columns such as nativeIdentity and application.name . To study the real definitions, export them from the console with export taskDefs.xml TaskDefinition , or open them in the Debug pages.

Designing a Custom Report

When no template fits, copy the closest standard report's TaskDefinition and change it, instead of starting from nothing. A custom report has these parts:

Report form – the parameters users fill in, built with the Forms API, such as applications or date ranges.

DataSource – where the data comes from (Filter, Java, or HQL), with query parameters bound to the form inputs.

Columns – ReportColumnConfig entries with a field, a header message key, the property to read, and sort settings.

Optional scripts or rules – for validation, initialization, extended columns, and charts.

Import the XML (section 3.1) with template="true" and a subType that places it in the right category.

Choosing Reports for Common Needs

• Need Example standard report or approach
• Accounts not tied to any identity Uncorrelated Accounts Report
• Proof of reviewer decisions Access review and certification reports, such as decision and sign-off reports
• Current SOD exposure Policy violation reports
• What a role grants and who has it Role details, role members, and role composition reports
• Provisioning failures Provisioning transaction reports, or the Administrator Console (section 15.2)
• An ad hoc question that no template answers An Advanced Analytics search saved as a report