No, an access profile does not directly reference roles to provide access. Instead, access profiles are collections of entitlements or permissions that are bundled together to simplify access provisioning. Access profiles can be associated with roles, but they do not reference roles directly. Roles in IdentityNow define broader sets of permissions, which may include access profiles, but access profiles themselves are not tied directly to roles.
References:
* SailPoint IdentityNow Access Profiles Documentation.
* SailPoint IdentityNow Roles and Access Profiles Configuration Guide.

No, custom connectors are not developed and compiled inside IdentityNow. Custom connectors are typically developed outside of the IdentityNow platform using a development environment and then tested and packaged before being uploaded to the platform. These connectors can be developed using tools provided by SailPoint, but the actual development process occurs externally, not directly within the IdentityNow environment.
Key Reference from SailPoint Documentation:
* Custom Connector Development: Custom connectors are developed outside of the IdentityNow platform and then integrated into it for use.

IQService does not run on the Virtual Appliance (VA). It is a separate service that must be installed on a Windows Server within the environment that has access to the target system, particularly for Active Directory and other Windows-based systems. IQService acts as a proxy between the IdentityNow tenant and these target systems, allowing operations such as password management and account provisioning to be executed on systems that do not support native connectors on the VA. It communicates with the VA but is not hosted on it.
References:
* SailPoint IdentityNow IQService Installation Guide.
* SailPoint IdentityNow Target Connector Architecture.

The provided transform is of type "Concat", which means it concatenates values from multiple sources. In this case, it appears to be concatenating the "cn" value with the "displayName" attribute of an identity. The
"type": "IdentityAttribute" section specifies that the transform is pulling the "displayName" attribute from the identity object.
Given the input where the displayName is "Thomas Miller", the expected output is in the format cn=Thomas Miller,ou=users,dc=example, which aligns with the displayed output in the example. The transformation concatenates the displayName value with the rest of the distinguished name (DN), which is a common use case for generating a DN from user attributes.
Key Reference from SailPoint Documentation:
* Concat Transform in IdentityNow: The concat transform is used to join multiple attribute values, and in this example, it successfully creates the expected DN string using the provided displayName input.

No, the Generic Cloud Connector is not the most suitable connector type for this use case. The system described is a modern, cloud-based web application that exposes a SCIM 2.0 interface with OAuth 2.0 client credentials for authentication. The Generic Cloud Connector is typically used for systems that do not have specialized connectors but can integrate via general APIs or REST endpoints. Since the application supports SCIM 2.0, which is a standardized protocol for managing identities, the SCIM 2.0 Connector would be the more appropriate choice, as it is specifically designed for this type of integration.
References:
* SailPoint IdentityNow SCIM 2.0 Connector Guide.
* SailPoint IdentityNow Connector Overview Documentation.