# Account aggregation filter string **URL:** \ **Category:** SHF Discussion and Questions\ **Tags:** sailpoint-identity-security\ **Created:** [December 22, 2025, 1:13pm UTC](https://developer.sailpoint.com/discuss/t/account-aggregation-filter-string/191558 "2025-12-22T13:13:46Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![Soundary](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@Soundary](https://developer.sailpoint.com/discuss/u/Soundary)\ **Post date:** [December 22, 2025, 1:13pm UTC](https://developer.sailpoint.com/discuss/t/account-aggregation-filter-string/191558/1 "2025-12-22T13:13:47Z")
Hi All, We recently updated the `account.filterString` in one of our web service sources. Previously, it was: ```auto !(market == "ABC") ``` This worked fine for including ABC users. Due to an organizational change, we now need to **include users from market “ABC” OR business unit “BU1244”**. We tried using: ```auto !(market == "ABC" || businessUnit == "BU1244") ``` However, this seems to exclude both ABC and BU1244 users, which is not what we intended. To include both, we believe the correct filter should be: ```auto (market == "ABC" || businessUnit == "BU1244") ``` Any guidance would be appreciated. Thanks! ---
**Author:** ![markomanium](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/markomanium/32/29738_2.png) [@markomanium](https://developer.sailpoint.com/discuss/u/markomanium)\ **Post date:** [December 22, 2025, 1:54pm UTC](https://developer.sailpoint.com/discuss/t/account-aggregation-filter-string/191558/2 "2025-12-22T13:54:40Z")
Hello, what connector is this for? E.g. if the connector is Workday, then the filter actually excludes accounts if the criteria is met. I remember in the past that group negation didn’t work as expected in the case when I wanted group inclusion, so had to go by “!=" on each attribute. Can you try `(market != "ABC" || businessUnit != "BU1244")` or `(market != \"ABC\" || businessUnit != \"BU1244\")` ? ---
**Author:** ![j\_place](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/j_place/32/19181_2.png) [@j\_place](https://developer.sailpoint.com/discuss/u/j_place)\ **Post date:** [December 22, 2025, 1:58pm UTC](https://developer.sailpoint.com/discuss/t/account-aggregation-filter-string/191558/3 "2025-12-22T13:58:37Z")
You need to AND your NOT statements, ie NOT market is ABC AND NOT businessunit is BU1244 ---
**Author:** ![Soundary](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@Soundary](https://developer.sailpoint.com/discuss/u/Soundary)\ **Post date:** [December 22, 2025, 2:00pm UTC](https://developer.sailpoint.com/discuss/t/account-aggregation-filter-string/191558/4 "2025-12-22T14:00:51Z")
Hey @markomanium I did try this earlier only. It doesn’t seem to fetch any accounts ---
**Author:** ![Soundary](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@Soundary](https://developer.sailpoint.com/discuss/u/Soundary)\ **Post date:** [December 22, 2025, 2:01pm UTC](https://developer.sailpoint.com/discuss/t/account-aggregation-filter-string/191558/5 "2025-12-22T14:01:22Z")
Hey sorry i didnt get you! ---
**Author:** ![markomanium](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/markomanium/32/29738_2.png) [@markomanium](https://developer.sailpoint.com/discuss/u/markomanium)\ **Post date:** [December 22, 2025, 2:27pm UTC](https://developer.sailpoint.com/discuss/t/account-aggregation-filter-string/191558/6 "2025-12-22T14:27:31Z")
Can you show us the whole filter in case this is only a part you want to change? (mask any sensitive data) ---
**Author:** ![iamnithesh](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/iamnithesh/32/42445_2.png) [@iamnithesh](https://developer.sailpoint.com/discuss/u/iamnithesh)\ **Post date:** [December 22, 2025, 2:56pm UTC](https://developer.sailpoint.com/discuss/t/account-aggregation-filter-string/191558/7 "2025-12-22T14:56:42Z")
> [@Soundary](#): > > `!(market == "ABC" || businessUnit == "BU1244")` The filter string filters out the accounts, which means any account that satisfies the condition will be excluded during aggregation. Try this `(market != “ABC” || businessUnit != “BU1244”)` ---
**Author:** ![j\_place](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/j_place/32/19181_2.png) [@j\_place](https://developer.sailpoint.com/discuss/u/j_place)\ **Post date:** [December 22, 2025, 3:01pm UTC](https://developer.sailpoint.com/discuss/t/account-aggregation-filter-string/191558/8 "2025-12-22T15:01:47Z")
You want something like: `(market != “ABC” && businessUnit != “BU1244”)` ie filter those accounts where the market does not match ABC and the businessUnit does not match BU1244 ---
**Author:** ![iiq-isc](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/iiq-isc/32/28687_2.png) [@iiq-isc](https://developer.sailpoint.com/discuss/u/iiq-isc)\ **Post date:** [December 22, 2025, 3:41pm UTC](https://developer.sailpoint.com/discuss/t/account-aggregation-filter-string/191558/9 "2025-12-22T15:41:29Z")
Let me explain through venn diagram for better understanding. I hope this clarifies your doubt. ![image](https://global.discourse-cdn.com/sailpoint/original/3X/1/f/1fed872e21c28b2db9bb3bde2e18099fc8a01b70.png) Now tell me what is your Goal in terms of venn diagram, so we can help with exact filter condition. Scenario#5 ![image](https://global.discourse-cdn.com/sailpoint/original/3X/c/9/c9d85e850ce4ec4e2e29f471564759730a12ac6d.png) The filter would look like this: `((market == "ABC" || businessUnit == "BU1244") && !(market == "ABC" && businessUnit == "BU1244"))` Scenario#2 is exactly what @j_place filter condition does and the correct representation in terms of filter condition is (market != “ABC” && businessUnit != “BU1244”) note: use light theme ![image](https://global.discourse-cdn.com/sailpoint/original/3X/e/4/e4a1df4f768df7223a2a0e568397d8d3e908c2f5.png) in the browser. ---
**Author:** ![prashanthrns](https://avatars.discourse-cdn.com/v4/letter/p/87869e/32.png) [@prashanthrns](https://developer.sailpoint.com/discuss/u/prashanthrns)\ **Post date:** [December 22, 2025, 5:25pm UTC](https://developer.sailpoint.com/discuss/t/account-aggregation-filter-string/191558/10 "2025-12-22T17:25:40Z")
Alternate option: As you are using a web service source, consider filtering the required values directly in the account aggregation API (if your API supports it) instead of relying on source config filters and this will also help improve the aggregation performance. ---
**Author:** ![markomanium](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/markomanium/32/29738_2.png) [@markomanium](https://developer.sailpoint.com/discuss/u/markomanium)\ **Post date:** [December 22, 2025, 8:11pm UTC](https://developer.sailpoint.com/discuss/t/account-aggregation-filter-string/191558/11 "2025-12-22T20:11:12Z")
I suggested that too, and OP says it doesn’t work. I’m wondering what else could be the problem.. ---
**Author:** ![j\_place](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/j_place/32/19181_2.png) [@j\_place](https://developer.sailpoint.com/discuss/u/j_place)\ **Post date:** [December 22, 2025, 9:39pm UTC](https://developer.sailpoint.com/discuss/t/account-aggregation-filter-string/191558/12 "2025-12-22T21:39:39Z")
@iamnithesh and @markomanium if you use the NOT on the predicate expressions you need an AND The OP expression: > [@Soundary](#): > > `!(market == "ABC" || businessUnit == "BU1244")` should work if ISC honoured the parentheses in a classic Boolean way, but I’m not sure it does, hence my suggestion above. I believe > !((market == “ABC”) || (businessUnit == “BU1244”)) should also work ---
**Author:** ![GOKUL\_ANANTH\_M](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/gokul_ananth_m/32/14416_2.png) [@GOKUL\_ANANTH\_M](https://developer.sailpoint.com/discuss/u/GOKUL_ANANTH_M)\ **Post date:** [December 24, 2025, 5:44am UTC](https://developer.sailpoint.com/discuss/t/account-aggregation-filter-string/191558/13 "2025-12-24T05:44:04Z")
Hi @Soundary , Have you tried this, ```auto ((market != "ABC") && (businessUnit != "BU1244")) ``` ---
**Author:** ![harshamin9](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/harshamin9/32/8977_2.png) [@harshamin9](https://developer.sailpoint.com/discuss/u/harshamin9)\ **Post date:** [December 24, 2025, 6:20am UTC](https://developer.sailpoint.com/discuss/t/account-aggregation-filter-string/191558/14 "2025-12-24T06:20:10Z")
Hello @Soundary I would recommend you using this documentation to get this handled, as per the doc the things matching the filter will be skipped from being brought into ISC. [IdentityNow Account Filtering during Account Aggregation - Compass](https://community.sailpoint.com/t5/Identity-Security-Cloud-Wiki/IdentityNow-Account-Filtering-during-Account-Aggregation/ta-p/142873#:%5C~:text=Accounts%20which%20match%20the%20filter%20string%20will%20be%20filtered.%20Accounts%20which%20do%20not%20match%2C%20will%20be%20sent%20to%20IdentityNow%20as%20normal) . So, as per the same I would recommend below operations, either of them should work: Option 1: (market != “ABC“) || (businessUnit != “BU1244“) So the subsequent API call payload should look something like this for the value component: “(market != \“ABC\“) || (businessUnit != \“BU1244\“)” Option 2: !(market == “ABC“) || !(businessUnit == “BU1244“) So the subsequent API call payload should look something like this for the value component: “!(market == \“ABC\“) || !(businessUnit == \“BU1244\“)” Thank You ---
**Author:** ![iiq-isc](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/iiq-isc/32/28687_2.png) [@iiq-isc](https://developer.sailpoint.com/discuss/u/iiq-isc)\ **Post date:** [December 24, 2025, 12:42pm UTC](https://developer.sailpoint.com/discuss/t/account-aggregation-filter-string/191558/15 "2025-12-24T12:42:01Z")
Option#3 `!(market == "ABC") || (businessUnit == "BU1244")` > **Composite Filter** : Grouping `component: "!(market == \"ABC\") || (businessUnit == \"BU1244\")"` ---
**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\ **Post date:** [February 22, 2026, 12:42pm UTC](https://developer.sailpoint.com/discuss/t/account-aggregation-filter-string/191558/16 "2026-02-22T12:42:05Z")
Closed on February 22, 2026, 12:42pm UTC This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.