@SebastianWilmsen Get the operation type in the Aftermodify script like below,
# Parse the XML request string from the environment variable
$sReader = New-Object System.IO.StringReader([System.String]$env:Request)
$xmlReader = [System.xml.XmlTextReader]([sailpoint.utils.xml.XmlUtil]::getReader($sReader))
$requestObject = New-Object Sailpoint.Utils.objects.AccountRequest($xmlReader)
# Get the operation type (e.g., "Disable", "Modify", "Enable", etc.)
$operation = $requestObject.Operation.ToString()
# --- Your Custom Logic Here ---
# Only execute your custom logic for the 'Disable' operation
if ($operation -ieq "Enable") {
This is the best straightforward approach. I implemented custom logic for Disable operation. Check my post here - ISC triggers multiple account modify requests during identity termination - #3 by Jhm356