---
updatedAt: 2026-07-16T20:45:24.000Z
---

# SailPoint IdentityIQ | EPM-WM

This document provides the steps required to configure the integration between SailPoint IdentityIQ and Endpoint Privilege Management for Windows and Mac.

## Create the IdentityIQ service account in EPM

1. Log on to the EPM web console as an Administrator.
2. Go to **Configuration**, and then **API Settings**.
3. Create an API account for IdentityIQ.

You must log on to IdentityIQ using administrator credentials.

4. Click the **Add New Application** button.
5. From the **Application Type** menu, select **SCIM 2.0**. Provide a name for the application.
6. On the **Configuration** tab, provide the base URL and token URL. Select **Client Credentials** for **Grant type**. Enter the client ID and secret for the **svc\_iiq** API account.

> ℹ️
>
> If the instance URL is <https://pmc01.acme.somedomain.net> then the API URLs are based on <https://pmc01-services.acme.somedomain.com>.

7. Try testing the connection at this point.
8. Go to the **Schema** tab.
9. Click **Discover Schema Attributes** for Object Type: **account**.
10. The attributes discovered for **account** are shown.
11. Delete extra attributes and keep the attributes shown here.
12. Discover the schema attributes for roles, and keep the attributes as shown.
13. Click **Provisioning Policies**.
14. Click **Add Policy**, and then click **Create Policy Form**.
15. Click **Add Section**, then + on the new Section and Add Field. The first field is **userName** which maps to email address. Click **Apply**.

    The script format: **return identity.getAttribute("email");**
16. Set the attribute **name.givenName**. Click **Apply**.
17. Set the attribute **name.familyName**. Click **Apply**.
18. Set the attribute **email**. Click **Apply**.
19. Set the attribute **displayName**. Click **Apply**.
20. Set the attribute **active**. Click **Apply**.
21. Set the attribute **locale** to static, and **Value** to **en-US** or **en-GB**. This can be mapped to an Identity attribute, if available.
22. Set the attribute **timezone** to static value. This can be mapped to an Identity attribute, if available.
23. Provide a form name and description, and then save the form. Don’t forget to save the application.
24. Edit the application again, and go to **Correlation**.
25. Create a correlation rule. Save the application.
26. Create the aggregation task for EPM. Navigate to **Setup**, then **Tasks**.
27. Click the **New Task** menu, then select **Account Aggregation**.
28. Configure the task to scan **PM Cloud**. Scroll to the bottom of the page and click **Save and Execute**.
29. Confirm the **Task** result is **Success**.
30. Create a group aggregation task for roles, and filter for only the roles type. Click **Save and Execute**, and confirm the task executed successfully.
31. Go back to the application and select the **Accounts** tab.
32. Review the discovered or aggregated accounts together with roles.
33. Go to **Applications**, then **Entitlement Catalog**. Use **Advanced Search** to filter for the application. The screen capture shows the discovered roles.
34. Go to **Applications**, then **Entitlement Catalog**. Use **Advanced Search** to filter for the Application. The screen capture shows the discovered roles.

> ℹ️
>
> Only roles are requestable. Entitlements are read-only in the current RBAC model.

35. Select a user that does not yet have access to EPM from the menu in the upper left corner. Select **Manage Access**, and then **Manage User Access**.
36. Select a test user on the **Manage User Access**. Click **Next**.
37. Select a role under the EPM **Application**. Click **Next**.
38. Click **Submit**.
39. The request should be in **Verifying** mode.
40. Confirm the new user is added in EPM.
41. Go to the **Application Accounts** tab and view the user application account and roles.