SailPoint IIQ Lab Guide | Azure Cloud Lab Setup — IIQ-APP1

SailPoint IdentityIQ Azure Lab

SailPoint Identity Governance — IdentityIQ 8.4
IIQ-APP1 (Application Server) — Single VM lab

Azure Free / Pay-as-you-go Subscription (lab only)

└── Resource Group: SailPoint-Lab (Brazil South — São Paulo)
└── Virtual Network: [Link]/24
└── NSG: RDP allowed from YOUR IP only
└── IIQ-APP1 → Win Server 2022 → SailPoint IIQ 8.4 ([Link])

Stack: OpenJDK 11 (Temurin) | MySQL 8.0 | Apache Tomcat 9.0 |

IdentityIQ 8.4
Access: [Link] (inside RDP session only)
Budget Alert: $25 USD/month

Before You Begin

Always STOP (deallocate) IIQ-APP1 from the Azure Portal after every lab session — not
! COST just Shut Down from inside Windows. Shutdown still bills you. Deallocate = zero compute
charges.

Sign up at [Link] for a free account — you get $200 USD in credits for 30
TIP days. That is enough to run this entire lab installation and several weeks of study without
spending anything.

Find your public IP before starting:

• Open a browser and Google: what is my ip
• Note the IP shown (e.g. [Link]) — you will need it in Step 3
• Important: if you change location or your router reboots, your IP may change. Always verify before
starting a lab session and update your NSG rule if needed.

Register a free SailPoint Community account at [Link] BEFORE your

! WARN lab session. Account approval can take 24–48 hours. You cannot download IdentityIQ
without it.

1 Create a Resource Group

A Resource Group is a container that holds all your lab resources. Deleting it at the end removes everything in
one click.

Portal URL [Link] → sign in

 Navigation Search bar at the top → type Resource Groups → click
Create

Name SailPoint-Lab

Region Brazil South (São Paulo)

Click Review + Create → Create. Wait for the deployment to complete (green check in Notifications).

2 Create a Virtual Network

The Virtual Network (VNet) connects resources inside your lab so they can communicate — this is the equivalent
of an Internal Virtual Switch in a local Hyper-V lab. SailPoint IIQ is a single-VM lab so the VNet is here for future
expansion (e.g. adding a connector host or a second IIQ node).

Navigation Search bar → Virtual Networks → Create

Resource Group SailPoint-Lab

Name SailPoint-VNet

Region Brazil South

Address Space [Link]/24

Subnet Name default

Subnet Range [Link]/24

Click Review + Create → Create.

3 Create the Network Security Group (NSG)

The NSG is your firewall. You will create it first, then attach it to the VM. This restricts RDP access to your IP
address only and keeps Tomcat (port 8080) off the public internet entirely.

3A — Create the NSG

Navigation Search bar → Network Security Groups → Create

Resource Group SailPoint-Lab

Name SailPoint-NSG

Region Brazil South

Click Review + Create → Create.

3B — Add Inbound RDP Rule (Restricted to Your IP)

Once the NSG is created, open it and navigate to: Inbound Security Rules → Add
 Source IP Addresses

Source IP YOUR public IP (e.g. [Link]) — the one you looked

up before starting

Source Port Ranges *

Destination Any

Destination Port 3389

Protocol TCP

Action Allow

Priority 100

Name Allow-RDP-MyIP

Do NOT set Source to 'Any' or '*'. This exposes RDP to the entire internet. Bots scan for
! WARN
open port 3389 constantly and will attempt brute-force logins within minutes.

3C — Block All Other Inbound Traffic

Add a second inbound rule to explicitly deny everything else:

Source Any

Destination Port *

Protocol Any

Action Deny

Priority 4000

Name Deny-All-Inbound

The lower priority number (100) wins over higher (4000) — your RDP rule takes precedence and everything else
is blocked. Port 8080 (Tomcat) will never be exposed to the internet.

4 Deploy VM — IIQ-APP1 (Application Server)

You do not need a Windows ISO. Azure has Windows Server 2022 pre-built as a Marketplace image. The OS
installs automatically during VM creation. SailPoint IIQ requires 4 vCPU and 16 GB RAM minimum for a stable
lab.

4A — Create the VM
Navigation Search bar → Virtual Machines → Create → Azure Virtual
Machine

Resource Group SailPoint-Lab

 VM Name IIQ-APP1

Region Brazil South

Image Windows Server 2022 Datacenter — search Marketplace if

not visible

Size Standard_B4ms (4 vCPU, 16 GB RAM) — approx. $0.25–$0.30

USD/hour

Admin Username labadmin (NOT your real credentials)

Admin Password LabPass@2024! (throwaway — NOT real passwords)

Inbound Ports None — NSG will handle this

4B — Networking Tab
Virtual Network SailPoint-VNet

Subnet default

Public IP Create new → name it IIQ-APP1-pip

NIC Network Security Group Advanced → select SailPoint-NSG

4C — Set Static Private IP

• After VM is created, go to: IIQ-APP1 → Networking → Network Interface → IP Configurations
• Click ipconfig1 → change Private IP Assignment from Dynamic to Static
• Set IP address to: [Link]
• Click Save

5 Configure Auto-Shutdown and Budget Alert

Do both of these before you start installing anything. They are your cost protection net.

5A — Enable Auto-Shutdown
Azure Portal → IIQ-APP1 → Operations → Auto-shutdown

Auto-shutdown On

Shutdown time 22:00 (adjust to end of your study window)

Time zone E. South America Standard Time (São Paulo)

Email notification On — add your email address

Click Save.

5B — Set a Budget Alert

Azure Portal → search Cost Management + Billing → Budgets → Add
 Scope your subscription

Budget amount $25 USD per month

Alert at 80% Sends warning email at $20 USD

Alert at 100% Sends alert email at $25 USD

Add your email for alert notifications → Create.

6 Install Prerequisites — Inside RDP Session

RDP into IIQ-APP1 using the public IP shown in the Azure Portal and the credentials set in Step 4. All installations
from this point happen inside the RDP session. The Azure VM is your local machine for everything that follows.

How to RDP Azure Portal → IIQ-APP1 → Connect → RDP → Download RDP

file → Open → Log in

6A — Download and Install OpenJDK 11 (Eclipse Temurin)

• Inside the RDP session browser:
• Navigate to: [Link]
• Filter: Version = 11, OS = Windows, Architecture = x64, Package Type = JDK
• Download the .msi installer file
• Run the installer → accept all defaults → Install

Installs to C:\Program Files\Eclipse Adoptium\jdk-11.x.x-hotspot\

Version check Open CMD → run: java -version

Expected openjdk version "11.x.x" ...

Note the exact installation path including the build number (e.g. jdk-11.0.22+7-hotspot).
! WARN
You need this exact path for JAVA_HOME in the next sub-step.

6B — Set JAVA_HOME Environment Variable

• Right-click Start → System → Advanced system settings → Environment Variables
• Under System Variables → click New

Variable name JAVA_HOME

Variable value C:\Program Files\Eclipse Adoptium\jdk-11.x.x-hotspot

(your exact path)

• Find Path in System Variables → click Edit → New → add: %JAVA_HOME%\bin

• Click OK on all dialogs to close
• Open a new CMD window (existing CMD windows do not pick up new variables) and verify: java -version
6C — Download and Install MySQL 8.0
• Inside the RDP session browser:
• Navigate to: [Link]
• Download: [Link] (the larger file — not the web installer)
• Run installer → Setup Type: Server Only → Execute
• Set MySQL root password during setup — write this down. It is needed throughout this lab.
• Complete setup with all defaults

Add to PATH C:\Program Files\MySQL\MySQL Server 8.0\bin (same

method as 6B → edit Path in System Variables)

Version check Open new CMD → run: mysql --version

Expected mysql Ver 8.0.x ...

6D — Download and Install Apache Tomcat 9.0

• Inside the RDP session browser:
• Navigate to: [Link]
• Under Binary Distributions → Core → download the zip file ([Link])
• Extract the zip to C:\ (result: C:\apache-tomcat-9.0.x)

Variable name CATALINA_HOME

Variable value C:\apache-tomcat-9.0.x (same method as 6B → add new

System Variable)

Use the zip file, NOT the Windows service installer. The zip gives you full control of the
TIP directory structure, which is required for running iiq commands from the correct paths
later.

7 Download and Deploy SailPoint IdentityIQ

SailPoint IdentityIQ requires a free SailPoint Community account to download. If you have not yet registered, do
so now and wait for approval before continuing.

7A — Create a SailPoint Community Account (if not done)

• Navigate to: [Link]
• Click Register → complete the registration form
• Wait for account approval email (typically 24–48 hours)
• Once approved, log in and verify access to the Products section

Account approval can take up to 48 hours. Do not start Step 7 until your account is
! WARN
approved. Do this registration step in advance, not on the day of your lab session.
7B — Download IdentityIQ 8.4 to the VM
Do this step inside the RDP session browser so the file downloads directly to the VM.
• Log in at: [Link]
• Navigate to: Products → IdentityIQ → Downloads
• Direct link to IIQ 8.4 release notes and download page: What’s New in IdentityIQ 8.4
• Download: [Link] to the VM Downloads folder
• Extract the zip → locate [Link] inside the extracted folder

7C — Deploy the WAR File and Extract

• Copy [Link] to: C:\apache-tomcat-9.0.x\webapps\
• Open CMD → navigate to: C:\apache-tomcat-9.0.x\bin
• Run: [Link]
• Wait until the CMD window shows: "Server startup in [XXXXX] milliseconds" (may take 2–3 minutes)
• Run: [Link]

Delete [Link] from C:\apache-tomcat-9.0.x\webapps\ before the next startup. If

! STOP the WAR file is present when Tomcat restarts it will overwrite all configuration files. This is
a common lab-breaking mistake.

• Verify: C:\apache-tomcat-9.0.x\webapps\identityiq\ folder now exists. This means the WAR was
extracted successfully.

8 Initialize Database and Application

All three sub-steps below must be completed in order. Do not run the IIQ console (Step 8C) before the database
is loaded (Step 8B).

8A — Generate Database Scripts

• Open CMD → navigate to: C:\apache-tomcat-9.0.x\webapps\identityiq\WEB-INF\bin
• Run: iiq schema
• Wait for completion

Command iiq schema

Run from C:\apache-tomcat-9.0.x\webapps\identityiq\WEB-INF\bin

Output 4 SQL scripts generated in ...\WEB-INF\database\

8B — Create and Load the Database

• Open CMD → navigate to: C:\apache-tomcat-9.0.x\webapps\identityiq\WEB-INF\database
• Log into MySQL: mysql -u root -p (enter the root password from Step 6C)
• Once inside the MySQL prompt, run the creation script:
◦ source create_identityiq_tables.mysql;
• Wait for completion — this may take 1–2 minutes
• Verify the databases were created:
 ◦ show databases;
• You should see both identityiq and identityiqplugins in the list
• Exit MySQL:
◦ exit

8C — Initialize the Application via IIQ Console

• Open CMD → navigate to: C:\apache-tomcat-9.0.x\webapps\identityiq\WEB-INF\bin
• Run: iiq console
• Once inside the IIQ console, import each file in order — wait for each to complete before typing the next:
◦ import [Link]
◦ import [Link]
◦ import [Link]
◦ import [Link]
◦ import [Link]
◦ import [Link]
◦ import [Link]
• Type exit to leave the IIQ console

The init XML files are located in ...\WEB-INF\config\. If any import fails, check that all
TIP previous imports completed successfully before retrying. Partial imports can cause IIQ to
start but behave unexpectedly.

9 Launch and Verify

9A — Start Tomcat
• Open CMD → navigate to: C:\apache-tomcat-9.0.x\bin
• Run: [Link]
• Wait until CMD shows: "Server startup in [XXXXX] milliseconds"

9B — Access the SailPoint Dashboard

Open the browser inside your RDP session and navigate to:

URL [Link]

Username spadmin

Password admin

Access [Link] from the browser INSIDE the RDP session only.
! WARN Port 8080 is not open in the NSG — this is intentional. There is no need to expose
Tomcat to the internet for a learning lab.

You should see the SailPoint IdentityIQ dashboard. Installation is complete.

 Change the default spadmin password immediately after first login. Go to: top-right menu
! STOP
→ Preferences → Password. The default credentials are publicly known.

Billing — End of Every Lab Session

After EVERY session: Portal → IIQ-APP1 → Stop. This deallocates the VM and stops all
! STOP compute charges. Do not rely on Shut Down from inside Windows — that keeps the VM
allocated and billing continues.

Scenario Cost (USD) Cost (BRL approx.)

IIQ-APP1 running 24/7 all month ~$200–$220 USD ~R$1,150–R$1,270
4 hrs/day, 5 days/week ~$20–$24 USD ~R$115–R$138
2 hrs/day, 5 days/week ~$10–$12 USD ~R$58–R$70
VM deallocated (idle) Cents (storage only) < R$3

Security Checklist

• NSG restricts RDP to your IP only — never open port 3389 to 'Any'
• Port 8080 (Tomcat) is NOT open in the NSG — access IIQ only from inside the RDP session
• Update NSG rule with your new IP when you change locations or your IP changes
• Never use real passwords or real company data inside lab VMs
• Never connect lab VMs to production Azure AD / Entra ID tenants
• Deallocate VM after every session — do not just Shut Down from inside Windows
• Budget alert set at $25 USD/month with email notification
• Auto-shutdown configured with email notification before shutdown
• Change default spadmin/admin credentials after first login

Quick Reference

Item IIQ-APP1
Role SailPoint Application Server

OS Windows Server 2022 Datacenter

Private IP [Link] (static)

VM Size Standard_B4ms (4 vCPU / 16 GB RAM)

Java Eclipse Temurin OpenJDK 11

JAVA_HOME C:\Program Files\Eclipse Adoptium\jdk-11.x.x-hotspot

 Database MySQL 8.0

App Server Apache Tomcat 9.0

CATALINA_HOME C:\apache-tomcat-9.0.x

IIQ Version IdentityIQ 8.4

IIQ URL [Link] (inside RDP only)

Default Username spadmin

Default Password admin (change after first login)

Config files ...\webapps\identityiq\WEB-INF\config\

DB scripts ...\webapps\identityiq\WEB-INF\database\

IIQ bin ...\webapps\identityiq\WEB-INF\bin\

Mandatory Links — SailPoint Resources

All links referenced throughout this lab guide in one place. Open these inside your RDP session browser or
bookmark them before starting.

Resource URL
IdentityIQ 8.4 Download What’s New in IdentityIQ 8.4 (download page)
SailPoint Community [Link]
SailPoint University [Link]
SailPoint Documentation [Link]
SailPoint Developer / Open [Link]
Source
SailPoint Developer [Link]/discuss
Discussions
IIQ Development Guide Getting Started with SailPoint IIQ Development
Ambassador Program Getting Started as a Developer Community Ambassador
Eclipse Temurin OpenJDK 11 [Link]/temurin/releases/?version=11
MySQL Community Installer [Link]/downloads/installer
Apache Tomcat 9.0 [Link]/[Link]

For lab use only. Deallocate VM after every session.