10.2 Workflow Steps That Generate Work Items

SailPoint Certified IdentityIQ Engineer Exam

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: The IdentityIQ Engineer Exam

1.1 Exam Format, Official Blueprint, and Study Strategy

2 Chapter 2: Infrastructure, Installation, and Extended Attributes

2.1 IdentityIQ Infrastructure Components 2.2 Installation Steps and Procedures 2.3 Creating Extended Attributes and the Objects That Support Them

3 Chapter 3: Build, Deployment, Patching, Access, and Email

3.1 Ongoing Build and Deployment 3.2 Installing Patches and Performing Upgrades 3.3 Configuring End-User Access 3.4 Email Server Settings and Email Redirection

4 Chapter 4: Lifecycle Manager Configuration, Provisioning Policies, and Workflows

4.1 Configuring Lifecycle Manager 4.2 Identity Provisioning Policies 4.3 Configuring LCM Workflows

5 Chapter 5: Lifecycle Events, QuickLinks, Batch Requests, and Rapid Setup

5.1 Lifecycle Events and Their Workflows 5.2 QuickLinks and QuickLink Populations 5.3 Configuring and Using Batch Requests 5.4 Rapid Setup in Lifecycle Events and Identity Operations

6 Chapter 6: Certification Campaigns and Certification Rules

6.1 Configuring and Scheduling Certification Campaigns 6.2 The Purpose of Common Certification Rules

7 Chapter 7: Policies and Policy Violations

7.1 Configuring and Leveraging Policies 7.2 Responding to Policy Violations

8 Chapter 8: Reporting, Advanced Analytics, and Auditing

8.1 Executing and Leveraging Reports 8.2 Leveraging Advanced Analytics 8.3 Configuring and Using Auditing

9 Chapter 9: Rules, Rule Libraries, and the SailPoint API

9.1 The Purpose and Use of Rule Libraries 9.2 Rule Input and Output Arguments 9.3 Common SailPoint API Objects and Methods

10 Chapter 10: Workflow Development

10.1 Workflow Variables, Transitions, and Step Conditions 10.2 Workflow Steps That Generate Work Items 10.3 The Different Workflow Step Usages 10.4 Leveraging Sub-Workflows

11 Chapter 11: Email Templates, Branding, and Localization

11.1 Customizing and Using Email Templates 11.2 Branding the SailPoint User Interface 11.3 Localizing the SailPoint UI

12 Chapter 12: Application Definitions, Connector Settings, and Rapid Setup Aggregation

12.1 Configuring Application Definitions 12.2 Configuring Common Connector Settings 12.3 Configuring Rapid Setup Aggregation Settings

13 Chapter 13: Data-Loading Tasks and Application and Connector Rules

13.1 Scheduling Tasks for Data Loading and Processing 13.2 Common Application Rule Types 13.3 Common Connector Rule Types

14 Chapter 14: Debugging with log4j, Syslog, and the IdentityIQ Console

14.1 Configuring and Leveraging log4j 14.2 Configuring and Leveraging Syslog 14.3 Leveraging the IdentityIQ Console for Debugging

15 Chapter 15: Debug Pages and the Administrator Console

15.1 Leveraging the Debug Pages for Debugging 15.2 Leveraging the Administrator Console for Debugging

16 Chapter 16: Role Model and Identity Attribute Mappings

16.1 Default Role Models and Role Types 16.2 Configuring Roles and Role Options 16.3 Configuring Identity Attribute Mappings

17 Chapter 17: Data Objects, Relationships, and Group Types

17.1 Common IdentityIQ Data Objects 17.2 Relationships Between Common Data Object Models 17.3 The Difference Between Group Types

10.2 Workflow Steps That Generate Work Items

Key Takeaways Explain This Topic AI

Approval steps, form steps, provisioning-form subprocesses, and manual-action subprocesses are the workflow constructs that put work items in someone's inbox.

A step holds either an action or an approval, never both.

Send lists pass workflow variables into the work item, and Return lists copy values back when it completes.

Approval mode (serial, serialPoll, parallel, parallelPoll, any) controls how multiple owners are asked; poll modes need AfterScript logic to decide the outcome.

Work item configuration on an approval can override the notification template and set reminders and escalation; child approvals inherit it unless they override it.

Last updated: September 2026

Workflow Steps That Generate Work Items

Objective 4.4 asks you to understand workflow steps that generate work items . A work item is a task in someone's IdentityIQ inbox (the bell icon). When a workflow needs a human decision or data, it creates a work item and waits . The WorkflowCase is saved so it can resume when the item is completed.

Which Workflow Constructs Create Work Items?

• Construct Work item type Example
• Approval step (a step containing <Approval> ) Approval Manager approval in LCM Provisioning
• Form step (an approval that presents a form) Form Ask the requester for a business justification
• Do Provisioning Forms subprocess Form Ask for missing account attributes (section 4.2)
• Do Manual Actions subprocess Manual Action Ask an application owner to change a system with no connector

Policy violation handling (a violation business process) Policy Violation Violation review from a workflow (section 7.2)

Other work item types exist outside workflows: Access Review, Challenge, Delegation, Remediation, Request Violation, Impact Analysis, and Signoff.

Approval Steps

A step holds either an action or an approval, never both . Add one in the Process Designer with right-click > Add Approval : <Step icon="Approval" name="Manager Approval">

• <Approval mode="serial" owner="script:getManagerName(identityName, launcher, fallbackApprover);"
• send="approvalSet,identityDisplayName,identityName,policyViolations"
• renderer="lcmWorkItemRenderer.xhtml">
• <Arg name="workItemDescription" value="Manager Approval - Account Changes for User: $(identityDisplayName)"/>
• <Arg name="workItemNotificationTemplate" value="ref:managerEmailTemplate"/>
• <AfterScript>
• <Source>
• assimilateWorkItemApprovalSet(wfcontext, item, approvalSet);
• auditDecisions(item);
• </Source>
• </AfterScript>
• </Approval>
• <Transition to="Build Owner ApprovalSet"
• when="script:isApprovalEnabled(approvalScheme, &quot;owner&quot;)"/>
• <Transition to="end"/>
• </Step>

This excerpt is from the documentation's LCM example, lightly trimmed. Its RuleLibraries declares Approval Library and LCM Workflow Library so that the AfterScript can call those methods.

Approval setting Purpose

Owner Who receives the item: an identity or workgroup name from a string, reference, script, rule, or call. Several owners are allowed.

• Mode How multiple owners are asked (below)
• Send Comma-separated workflow variables copied into the work item
• Return Comma-separated variables copied back when the item completes

Renderer JSF include used to display the item. Not needed with the default renderer.

• Description Shown as the work item name in the inbox
• Args Values that need transformation (script, rule, call) or reserved names such as workItemDescription

AfterScript Runs after each completion. It records decisions, audits them, and for poll modes decides the outcome.

Approval Modes

serial : one owner at a time, in order. Any rejection rejects.

serialPoll : one at a time. All responses are collected, and the AfterScript decides .

parallel : all owners at once. Any rejection rejects.

parallelPoll : all at once. Responses are collected, and the AfterScript decides .

any : all at once. The first response decides for the group.

Child Approvals

Add Child Approval builds structured approvals. For example, one child approval could go to "any HR approver" (mode any ) and another to the identity's manager. The parent then only organizes its children and is no longer an approval itself. Children inherit the parent's work item configuration unless they override it.

Work Item Configuration

On the approval's Work Item Configuration tab, choose Override Work Item Configuration to set the Initial Notification Email and an escalation style: None , Send Reminders , Reminders then Escalation (using an escalation owner rule), or Escalation Only . Override Electronic Signature Configuration requires an electronic signature on the decision.

Designing an Approval: A Checklist

Who approves? Resolve the owner with a script or call (for example, the manager, with a fallback approver) so a missing manager does not leave the item without an owner.

How do several approvers interact? Pick the mode. Use any for a pool such as "any HR partner," serial for a strict chain, and a poll mode only if you will write AfterScript logic.

What does the approver need to see? Put those variables in Send , and add a clear workItemDescription using $() references.

What must come back? List the decisions or comments in Return , or assimilate them in the AfterScript as LCM does with its approval set.

What if nobody acts? Configure reminders and escalation on the Work Item Configuration tab.

Form Steps

Choose Add Form on a step to reference a shared Form object or create one inline. You set a Description , Send (variables used as initial field values), Return (fields copied back into variables), and an Owner . Fields use the same editor as provisioning policies, although Owner, Display Only, and Authoritative do not apply to workflow forms. Buttons define what happens on submit:

Button action Result

Next Assimilates the data and advances. The approval is set to Approved .

Back Assimilates the data and returns. The approval is set to Rejected and the workflow advances.

Cancel Leaves the page. The work item stays active .

Refresh Assimilates the data and regenerates the form. This is not a state change.

Work Item Settings Outside the Workflow

Global Settings > IdentityIQ Configuration > Work Items sets defaults: days before expiration, reminder timing and frequency, notices before escalation, assignment emails, priority editing, which work item types are archived , and rules such as the inactive user work item escalation rule , the global forwarding rule , and the self-certification forwarding rule . The Perform Maintenance task's Forward inactive user work items option forwards items owned by inactive users: by rule, otherwise to their manager, otherwise to the Administrator. Work item actions can be audited (section 8.3).