1. What is the IAM Modernization Program? 

The IAM Modernization Program is a multi-phase initiative to establish a modern Digital Identity and Access management service to advance UCSF’s health missions, enhance educational and research experiences, and identify security risks. Phase 1 was completed as of January 2026 and established the foundational setup of the SailPoint platform. Phase 2 focuses on leveraging automation and application integrations to enhance user experience and strengthen security and governance. 

2. What new or improved tools are being introduced? 

The program will roll out new capabilities for:

• Modern identity governance and administration (SailPoint, SCUBA): SailPoint provides advanced controls and automated processes for managing who has access to UCSF systems while SCUBA serves as the identity repository.
• Centralized service account and group lifecycle management (SailPoint): Provides a centralized governance framework for managing service accounts and group’s lifecycle
• AI-assisted integration and documentation (AppOn.AI): Provides accelerated application onboarding with AI-driven automation and standardized workflows 

3. How will this program affect me?  

Most of the UCSF community will not see day-to-day changes. Those who manage or support digital identity processes, non-employee onboarding, or user data may use the new tools or encounter updated workflows. Impacted users and teams will receive specific guidance and training.

4. Why are these updates happening? 

UCSF is committed to strengthening security and making IT processes more efficient. Modernizing identity management helps protect sensitive data, reduce security risk, and ensure compliance with regulations. 

5. What is MyAffiliate and who should use it? 

MyAffiliate is a new platform for onboarding and managing non-employees—such as vendors, contractors, volunteers, and guests. If your job involves sponsoring or managing access for non-employees, you will use MyAffiliate for a smoother, faster process. 

6. How do I learn to use the new MyAffiliate platform? 

Training resources and step-by-step guides will be provided on the MyAffiliate service page in January 2026. Look out for invitations to training sessions from the IAM Modernization Program team. 

7. What are the new Unique Identifier Tools (02 Generator and De-Duplication web app)? 

The updated 02 Generator and De-Duplication web application help ensure that every UCSF user has a unique digital identity and that duplicate records are eliminated. These changes will mostly impact teams handling identity and data integrity, creating a more reliable experience for all.

8. What is SailPoint ISC? 

SailPoint ISC is a new back-end system that automates and governs how access is granted and changed across UCSF’s core systems. While mostly used by IT, this platform means increased automation of access changes and a more secure environment for everyone. 

9. Will I need to do anything differently because of these updates? 

Unless you manage users or handle onboardin or access for affiliates, most changes will happen behind the scenes. If any action is needed from you, you will receive clear instructions and support. 

10. Will there be additional phases as part of this modernization effort?

Yes, this is the beginning of an effort to redefine how access controls are managed within UCSF. SailPoint's latest capabilities provide additional opportunities to strengthen security, improve access governance, and enhance compliance across UCSF, helping the organization better manage identity and access risks.  UCSF will continue to monitor SailPoint and conduct periodic access reviews throughout our modernization effort to ensure identity and access management remains secure and streamlined. 

11. How can I learn more about this program?  

If you have additional questions or would like to learn more about the IAM Modernization Program, please contact the program inbox at [email protected].  

12. What’s changing as part of Phase 2?

Phase 2 introduces four major areas of change:

• Business-critical application integration with SailPoint to automate access provisioning and deprovisioning.
• User interface (UI) and governance enhancements including a unified access request and access review experience.
• AI-enabled onboarding and documentation through AppOn.AI with human oversight.
• Service account and group lifecycle management through centralized governance and automation. 

13. Where will I go to make access requests once this is live?

Once Phase 2 is live, users will submit access requests through a unified SailPoint access portal that brings together access requests and access reviews into a single, streamlined experience. Additional details and training materials will be provided before go-live. 

14. What is AppOn.AI?

AppOn.AI is an AI-powered application onboarding platform that will help UCSF migrate applications into SailPoint more quickly and consistently. It guides application owners through the collection of key application and access information, automates much of the documentation and validation process, and helps ensure onboarding requirements are completed accurately.

AppOn.AI is designed to reduce manual effort and accelerate the process of making applications available through SailPoint's access request and approval workflows. All data remains within UCSF-controlled Azure environments and is never used to train AI models. AppOn.AI maintains data protection through enterprise-grade security and compliance controls. 

15. How will AppOn.AI help with the application integration process? 

AppOn.AI simplifies and accelerates the application integration process by helping teams gather and manage the information required for SailPoint application integration. It provides an automated, structured process to collect, validate, and track onboarding requirements from start to finish. AppOn.AI helps applications move through the onboarding process more efficiently while supporting UCSF's governance, security, and compliance requirements.