# Birthright Roles only for New Users

**URL:** <https://developer.sailpoint.com/discuss/t/birthright-roles-only-for-new-users/146374>\
**Category:** SHF Discussion and Questions\
**Tags:** sailpoint-identity-security, provisioning\
**Created:** [June 20, 2025, 3:24am UTC](https://developer.sailpoint.com/discuss/t/birthright-roles-only-for-new-users/146374 "2025-06-20T03:24:49Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![pkumar22](https://avatars.discourse-cdn.com/v4/letter/p/7ea924/32.png) [@pkumar22](https://developer.sailpoint.com/discuss/u/pkumar22)\
**Post date:** [June 20, 2025, 3:24am UTC](https://developer.sailpoint.com/discuss/t/birthright-roles-only-for-new-users/146374/1 "2025-06-20T03:24:49Z")

</div>

Hi

We have requirements like below.

1. We have a birthright AD role, with assignment criteria based on job code and cost center. When enabled in production, it will be assigned to 5,000 identities. However, the existing 1,450 identities do not have birthright AD role groups. Our client requires to assign the birthright AD roles only to new users.

Is there a way to do that?

---

<div class="post-metadata">

**Author:** ![JackSparrow](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/jacksparrow/32/19685_2.png) [@JackSparrow](https://developer.sailpoint.com/discuss/u/JackSparrow)\
**Post date:** [June 20, 2025, 4:00am UTC](https://developer.sailpoint.com/discuss/t/birthright-roles-only-for-new-users/146374/2 "2025-06-20T04:00:14Z")

</div>

Hi @pkumar22 ,

Criteria based assignment assigns the access to all the user, it can be new/existing users. It just checks the criteria, if matches then it will assign the access. SailPoint will not know if its new/existing user.

I can think of workflows here, you can go for scheduled trigger (you can run twice a day pr as per client’s preference), then get list of identities that got created in last 12 hrs (considering workflow run twice a day) and have “ABC” job code and cost center using a query. Then call API to submit a role/access request.

---

<div class="post-metadata">

**Author:** ![jesvin90](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/jesvin90/32/5301_2.png) [@jesvin90](https://developer.sailpoint.com/discuss/u/jesvin90)\
**Post date:** [June 20, 2025, 4:11am UTC](https://developer.sailpoint.com/discuss/t/birthright-roles-only-for-new-users/146374/3 "2025-06-20T04:11:00Z")

</div>

Hi @pkumar22,

Have you considered creating a transform that would flag these existing 1500 users.? May be based on their start date or some other criteria that is already available.

You can then use this identity attribute in the role membership criteria so that it can filter out the existing users.

---

<div class="post-metadata">

**Author:** ![markomanium](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/markomanium/32/29738_2.png) [@markomanium](https://developer.sailpoint.com/discuss/u/markomanium)\
**Post date:** [June 20, 2025, 1:03pm UTC](https://developer.sailpoint.com/discuss/t/birthright-roles-only-for-new-users/146374/4 "2025-06-20T13:03:35Z")

</div>

You’d need some identity attribute which distinguishes new users from ,non-new, users. For example, using transforms, you can calculate a value based on date and add a value to that identity attribute:

If new users are considered for the first 30 days upon hiring:

Something with datecompare,

date1:hiredate+30days

date2=current\_date

If date1\<date2 , assign ,new\_user, ,

else assign ,old\_user,

In birthright role, add that new attribute as an criteria with the value of ,new\_user,

---

<div class="post-metadata">

**Author:** ![hkhandale](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/hkhandale/32/23833_2.png) [@hkhandale](https://developer.sailpoint.com/discuss/u/hkhandale)\
**Post date:** [June 20, 2025, 2:27pm UTC](https://developer.sailpoint.com/discuss/t/birthright-roles-only-for-new-users/146374/6 "2025-06-20T14:27:11Z")

</div>

In our case we created isJoiner identity attribute to validate new user based on start date which is coming from authoritative source

you can assign below transform to isJoiner attribute, it will give Yes if new user else No

```
"name": "Joiner Tranform",
    "type": "dateCompare",
    "attributes": {
        "firstDate": "now",
        "positiveCondition": "Yes",
        "operator": "lte",
        "negativeCondition": "No",
        "secondDate": {
            "attributes": {
                "input": {
                    "attributes": {
                        "values": [
                            {
                                "attributes": {
                                    "name": "startDate"
                                },
                                "type": "identityAttribute"
                            },
                            {
                                "attributes": {
                                    "value": "12/31/2999"
                                },
                                "type": "static"
                            }
                        ]
                    },
                    "type": "firstValid"
                },
                "inputFormat": "MM/dd/yyyy",
                "outputFormat": "ISO8601"
            },
            "type": "dateFormat"
        }
    }

```

then you can add this attribute in role and assign the Equal to “Yes”.

This will resolve your problem

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\
**Post date:** [August 19, 2025, 2:28pm UTC](https://developer.sailpoint.com/discuss/t/birthright-roles-only-for-new-users/146374/7 "2025-08-19T14:28:04Z")

</div>

Closed on August 19, 2025, 2:28pm UTC

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.