Yes. In SailPoint IdentityIQ provisioning, the system evaluates the requested access change in the context of the identity's existing application accounts. When a provisioning request requires a modification on an application, IdentityIQ must determine whether the identity already has an account, represented by a Link, on that application. If no existing account is available and the requested change requires one, IdentityIQ can include account creation as part of the provisioning activity before applying attribute or entitlement modifications.
This behavior is central to request-based provisioning. For example, if a user requests an entitlement on an application where they do not yet have an account, IdentityIQ cannot simply add the entitlement to a nonexistent account. The provisioning process must first establish the account, collect required values through provisioning policies, and then apply the requested access. The provisioning plan may therefore be expanded or adjusted during compilation and fulfillment.
Therefore, the statement is true: IdentityIQ can determine whether an account must be created before modification. Reference topics: Provisioning, provisioning plan processing, account requests, provisioning policies, account creation, entitlement modification, and plan compilation.

No. This statement does not accurately describe role acquisition in IdentityIQ. Business roles are not restricted to being requested only by managers. In IdentityIQ, roles may be acquired through role assignment logic, role detection, access requests, or administrative action, depending on the role configuration and the organization's request model.
A business role commonly represents access associated with a business function, job, department, location, or organizational responsibility. Users may receive business roles automatically when their identity attributes satisfy configured role profiles or assignment rules, typically recalculated during Identity Refresh. Separately, roles may be made requestable through Lifecycle Manager and exposed through QuickLinks, where request eligibility is controlled by QuickLink Populations, request configuration, and workflow rules.
Managers may be allowed to request roles for direct reports, but that is only one possible configuration. IdentityIQ can also allow users to request roles for themselves, allow delegated requesters to request for others, or restrict requests to specific populations.
Therefore, "only requested by managers" is too narrow and incorrect. Reference topics: Access Modeling, business roles, role assignment, role detection, Identity Refresh, User-Driven Requests, QuickLink Populations, and role request configuration.

The statement is true. In SailPoint IdentityIQ, group factories are used to generate identity groups dynamically based on identity attribute values or configured grouping logic. A group factory defines the rule or attribute basis for grouping identities, but the actual creation or refresh of the resulting groups occurs when the appropriate task is executed. For example, a group factory might be configured to create groups by department, location, cost center, or business unit. When the task runs, IdentityIQ evaluates identities against the factory definition and creates or updates the corresponding groups.
This differs from populations, which are typically defined sets of identities used for targeting, filtering, reporting, or governance scoping. Group factories are more generation-oriented because they can produce multiple group objects from identity data. The task execution step is important because it materializes the groups so they can be used in IdentityIQ operations.
Therefore, new groups can be created as a result of executing a task tied to group factory processing.
Reference topics: Identity Modeling - groups and populations, group factories, identity grouping, and task- driven group creation.

The statement is true. In SailPoint IdentityIQ, the Identity Refresh task is used to recalculate and update identity-level data stored on IdentityCubes. One of its core functions is refreshing identity attributes, which are the normalized identity fields IdentityIQ uses for governance, correlation, lifecycle processing, certifications, policy evaluation, role assignment, and reporting. These attributes may originate from authoritative sources, account links, rules, mappings, or configured identity attribute definitions.
When the Identity Refresh task runs with the appropriate options selected, IdentityIQ evaluates the configured identity attribute mappings and updates the IdentityCube accordingly. This ensures that changes from authoritative data or aggregated account information are reflected at the identity level. For example, department, manager, location, job title, status, or lifecycle state may be recalculated and stored on the IdentityCube for downstream governance processes.
This task is different from aggregation. Aggregation collects account and entitlement data from applications, while Identity Refresh updates IdentityIQ's internal identity model using the data already stored in the repository.
Reference topics: Identity Modeling - IdentityCubes, identity attributes, manager correlation, and common Identity Refresh task options.

Yes. In SailPoint IdentityIQ, the Identity Warehouse presents identity-centered information collected and modeled inside the IdentityCube. Entitlements are part of that identity view because they represent the user's permissions or access rights on connected applications. During aggregation, IdentityIQ reads account data from applications, including entitlement-bearing attributes such as groups, roles, permissions, or other managed access values. These are stored on the identity's application accounts and surfaced in the Identity Warehouse so reviewers, administrators, and governance users can understand what access the identity currently has.
This is distinct from identity attributes such as department, manager, location, or lifecycle state. Entitlements describe access on target systems and are central to access reviews, policy evaluation, role modeling, and access request decisions. Displaying entitlements in the Identity Warehouse allows IdentityIQ to provide a complete access profile for the identity, including accounts, assigned roles, detected roles, policy violations, and application permissions.
Therefore, entitlements are displayed as part of the Identity Warehouse identity details. Reference topics: Identity Modeling, IdentityCube contents, Identity Warehouse, application accounts, entitlement aggregation, managed attributes, and access visibility.