IBM ISIM, Oracle OIM or homegrown provisioning to SailPoint or Saviynt
Cohash moves identity governance off IBM Security Identity Manager, Oracle Identity Manager or homegrown provisioning scripts and onto SailPoint or Saviynt. We read the old tool's workflows, adapters, policies and scripts, decide what to rebuild, connect HR and target systems in waves, run provisioning and certifications in parallel for a cycle, and archive the old audit trail before switching off.
- 01Read the old tool
- 02Pick the platform and design the model
- 03Connect HR and targets in waves
- 04Parallel run
- 05Cut-over and archive
The story
Told without the client's name or anything that could identify them.
A bank's identity team ran joiner and leaver provisioning on an aging Oracle Identity Manager install plus scheduled scripts that one person maintained. Quarterly certifications went to managers as emailed spreadsheets, adapters for key apps had stopped working after target upgrades, and pulling together approval evidence for auditors was slow manual work. We read every policy, workflow, adapter and script and decided what to rebuild before comparing SailPoint and Saviynt on connectors and SoD needs. HR came first, then targets in waves, with account correlation checked by hand on a sample. Both tools ran in parallel through a pilot certification, provisioning switched target by target, and the old approval history was exported before the servers were shut down.
why it was urgentIBM folded Security Identity Manager into Verify Governance 10.0, so ISIM customers face a platform change either way. Oracle's Lifetime Support Policy ends Premier Support for OIG 12.2.x in December 2026. Homegrown scripts have no vendor date, but they rarely pass an audit request for who approved what.
- openYour joiner and leaver provisioning lives in scripts and scheduled jobs that only one person maintains.
- recurringCertifications are spreadsheets emailed to managers every quarter.
- blockedAdapters for a few key apps quit working in ISIM or OIM when the target systems were upgraded.
- openAuditors asked for evidence of who approved access, and it took weeks to put together.
The estate, before and after
Before: legacy provisioning, scripts and spreadsheet reviews
HR data got to targets through an old IGA tool and some scheduled scripts, and a few adapters broke when targets were upgraded. Access reviews were account exports, emailed to managers.
Read the diagram as text
- HR system → IBM ISIM or Oracle OIM: HR feed
- HR system → Provisioning scripts: scheduled extract
- IBM ISIM or Oracle OIM → Active Directory: provision
- IBM ISIM or Oracle OIM → Business apps: adapter
- Provisioning scripts → ERP: scripted accounts
- Active Directory → Spreadsheet certifications: account export
After: SailPoint or Saviynt provisions targets and runs reviews
Joiner, mover and leaver events go from HR into the new IGA platform, which provisions each target through connectors and runs the certification campaigns. The legacy history is in a readable archive next to the new audit records.
Read the diagram as text
- HR system → SailPoint or Saviynt: joiner · mover · leaver
- SailPoint or Saviynt → Active Directory: provision
- SailPoint or Saviynt → ERP: provision
- SailPoint or Saviynt → Business apps: provision
- SailPoint or Saviynt → Certifications: campaigns
- Certifications → Audit records: review decisions
- Archived legacy history → Audit records: prior history
How we run it, phase by phase.
5 phases take you from IBM ISIM, Oracle OIM or homegrown scripts to SailPoint or Saviynt. Each one ends with something you can check before the next starts. As you scroll, the blocks show the estate moving across.
- phase 01
Read the old tool
Export the provisioning policies, workflows, adapters, account-matching rules, password policies and every script, and read them. Then decide for each: native in the new platform, rebuild as a rule or workflow, or retire.
- phase 02
Pick the platform and design the model
Compare SailPoint and Saviynt on your connectors, ERP SoD needs, hosting rules and team skills. Design identity attributes, correlation rules, birthright access and the role model before building anything.
- phase 03
Connect HR and targets in waves
We connect the HR source first and then the targets, grouped by connector type and audit scope. Correlation gets checked by hand on a sample for each target before we touch an account.
- phase 04
Parallel run
Run both tools against the same targets and do a pilot certification. Where they disagree about who has what, explain it or fix it before provisioning moves.
- phase 05
Cut-over and archive
We switch provisioning one target at a time. The old approvals, certifications and provisioning history get exported in a format people can read, and only then are the legacy servers and jobs turned off.
What the client got
What changed for the client once the work was done. Described, not scored: we don't publish client figures.
- result 01
Provisioning logic is native or rebuilt, not scripted
Every old policy, workflow, adapter and script ended up as a native feature, a rebuilt rule or workflow, or retired. The scheduled scripts don't run anymore.
- result 02
Certifications run in the platform
Managers and owners now review access in SailPoint or Saviynt campaigns. The emailed spreadsheets are gone, and each decision is recorded with the person who made it.
- result 03
Accounts correlate to people
Correlation rules were tested on a sample per target, and orphan and mismatched accounts were reviewed with owners before cut-over.
- result 04
Old audit evidence is still readable
We exported approvals, certifications and provisioning history from the legacy tool, with approver, date and decision, and only then retired its database.
Risks we plan for
-
Orphan and mismatched accounts
Years of manual fixes leave accounts that don't correlate to any person. They're reviewed with owners before cut-over, or the first certification fills up with noise.
-
Business rules buried in scripts
The logic for usernames, email creation and contractor end dates is often in a script nobody wrote down. We dig those out while reading the old tool, so the first leaver after go-live doesn't expose them.
-
Two tools provisioning the same target
In the parallel run each target has exactly one tool writing to it. Let both write and they'll keep reversing each other.
-
Losing audit evidence
An auditor can ask about a decision from years back. So we export the history with approver, date and decision before the old database is retired.
Where AI helps, and where it needs guardrails
On the SailPoint side, Identity Security Cloud adds AI access recommendations and role discovery, and Agentic Fabric governs AI agents. Saviynt Identity Security for AI discovers agents in Amazon Bedrock, Copilot Studio, Vertex AI, ServiceNow and Agentforce and gives each an owner. While you're building new IGA anyway, bring agents and service accounts into the same reviews as people, and keep any MCP tool that grants access behind an approval.
forward deployed engineers →What you're left with
We write these for your setup, and they're working documents. Your team should be able to keep things running from them long after we've gone.
- inventory01
Inventory of policies, workflows, adapters and scripts with a decision per item
yours to keep - design02
Platform comparison and identity model design
yours to keep - tests03
Connector wave plan with correlation test results per target
yours to keep - report04
Parallel-run comparison report
yours to keep - document05
Archived approval, certification and provisioning history
yours to keep
Platforms and services on this move
Learn the background
Terms from this page in plain English. If you want the why, the field note behind it is right there.
- 01Connector
- The integration between an identity platform and an app. It's how the platform reads and changes accounts and access in that app.in context →
- 02Role model
- The set of business roles and the access each one grants, used to assign access by job instead of one permission at a time.in context →
Certified engineers, wherever you need them.
Some clients want a project team, some want a couple of engineers on theirs. Either works. Onsite, nearshore or offshore, with handovers across time zones that keep things moving.
Onsite
Engineers at your sites in the US
Nearshore
Overlapping hours with US teams
Offshore
Overnight progress on your backlog
All time zones
Coverage handed over across time zones
01SailPoint or Saviynt?
It depends on your target applications, ERP SoD needs, whether you need a self-hosted option and what your team already knows. SailPoint offers IdentityIQ self-hosted and Identity Security Cloud as SaaS; Saviynt is SaaS. We compare both on your connector list rather than a feature sheet.
02Why not move ISIM to IBM Verify Governance?
It's a fair option, since IBM folds ISIM into Verify Governance. If IBM suits you and the adapters cover your apps, that upgrade may cost less than a move. We'll say so if the inventory points there.
03How long will both tools run together?
Usually at least one full certification cycle, so you can compare results. Beyond that it depends on the number of targets and how clean the account data is.
04Do you also onboard new applications?
Yes. Once the migrated apps are stable, we use the same connector patterns to bring in apps the old tool never covered.
Often on the same roadmap
On-premises Active Directory to cloud-first Microsoft Entra ID
We shrink on-premises Active Directory one application at a time, moving groups, users and app authentication to Microsoft Entra ID as each app is ready.
read the case studyAD FS federation to Entra ID authentication
Converting federated domains from AD FS to Entra ID cloud authentication, moving relying parties app by app and retiring the AD FS farm.
read the case studyAuth0 Rules and Hooks to Actions before end of life
Rewriting Auth0 Rules and Hooks as Actions before their 18 November 2026 end of life, with token claims compared before and after each change.
read the case study34618f7f - 01IBM: IGI becomes Verify Governance 10.0, Identity Manager now includedibm.com ↗
- 02Oracle Lifetime Support Policy: Oracle Fusion Middleware (effective 13 April 2026)oracle.com ↗
- 03SailPoint: Identity Security Cloudsailpoint.com ↗
- 04ITBrief: SailPoint launches Agentic Fabric (4 Aug 2026)itbrief.co.uk ↗
- 05Saviynt press release: Identity Security for AI (24 Mar 2026)saviynt.com ↗
Planning this move?
A 30-minute working session with a senior engineer. No slides.
- The platform and the version you're on
- Where you need to get to, and by when
- What's custom: rules, plugins, integrations
- Any audit finding or deadline driving it