His application for residency was rejected in June a year ago and he was being sought by immigration officials, police said.
"We know that the suspect had expressed sympathy for extremist organisations, among them IS", Jonas Hysing, chief of national police operations, told a news conference, using an acronym for the ultra-hardline militant group.
Hysing explained: "The Migration Agency rejected it in June 2016 and also decided that he was to be expelled".
Ihrman and police spokesman Lars Bystrom said only one person had been arrested in the case.
The man suspected of ramming a stolen truck into a crowd in Stockholm on Friday and killing four people was an Uzbek asylum-seeker whose application was rejected and was supposed to be deported.
People flee after a terror suspect rammed a beer truck into Ahlens department store in Stockholm on Thursday.
Four people were killed and 15 were injured when the lorry crashed into the front of a department store.
Other sources quoted by Expressen on Saturday said the man had already confessed to police at the time of his arrest in a northern Stockholm suburb on Friday, saying "I'm the one who did it".More news: McKay fancies Gers for Old Firm upset
"Today, all of Sweden is in mourning but we are going to get through this together", he said last Saturday.
According to sources close to the investigation cited by various media, the suspect, bloodied from the crash, fled the scene and ran into the nearby T-centralen subway station, taking advantage of the panic to blend into the crowd.
But police apparently never found the man, whom authorities have said was known to Sweden's intelligence service for undisclosed reasons. Earlier the authorities said seven people had been brought in for questioning over the attack.
It was the second terror attack in Stockholm.
Meanwhile, a peace vigil attracted thousands of people in central Stockholm on Sunday afternoon.
A child is among ten people who remain in hospital, two of whom are in intensive care.
The driver fled from the truck, prompting lockdowns at Parliament and the city's subway system as police looked for the suspect.
A failed suicide bombing in December 2010 killed an attacker only a few hundred yards from the site of Friday's incident.