BUilding an Immediate Identity Termination Workflow Using Forms in SailPoint IdentityNow

Identity Security Cloud (ISC) ISC Community Knowledge Base
,
1

In many organizations, timely user termination is critical for security and compliance. While lifecycle events usually depend on HR systems like Workday, there are situations where an immediate manual termination is required — for example, contractor exits, policy violations, or urgent access revocation.

In this post, I’ll walk through how to build a form-driven immediate termination workflow in SailPoint IdentityNow that allows HR or admins to trigger termination instantly.

Use Case

We wanted a solution where:

  • HR/Admins can select users manually
  • Termination happens immediately (real-time)
  • Only valid users (from authoritative source) are processed
  • Notifications are sent for success, failure, or rejection
  • Supports bulk termination

Solution Overview

We built a workflow triggered via an Interactive Form, where users can select one or more identities and submit a termination request.

Once submitted, the workflow:

  1. Validates the identity source
  2. Updates lifecycle state via API
  3. Sends appropriate notifications
  4. Handles errors gracefully

Workflow Design

1. Interactive Form (Entry Point)

The workflow starts with a form:

  • Users select identities (selectIdentities)
  • You can select upto 30 identites at a time
  • Submitted by HR/Admin
  • Title: Immediate Identity Termination
    image
    image1645×682 16.4 KB

This makes the process simple and accessible without needing backend access.

Processing & Looping

After submission:

  • Workflow loops through each selected identity
  • Ensures bulk processing is handled efficiently

Identity Validation

Before termination, we validate:

If NOT:

  • The request is rejected
  • A notification is sent to the requester

This prevents accidental termination of invalid users.

4. Real-Time Termination via API

Once validation succeeds, the workflow invokes the Identity Security Cloud Set Lifecycle State API using the HTTP Request action.

image
image1390×768 68.2 KB

HTTP Method

POST

Endpoint

/v3/identities/{{$.hTTPRequest.body[0].id}}/set-lifecycle-state

The identity ID is dynamically retrieved from the previous workflow step.

Request Body

{
  "lifecycleStateId": "3267548732642374"
}

The lifecycleStateId represents the configured Terminated lifecycle state within Identity Security Cloud.

When this API executes successfully, Identity Security Cloud immediately updates the user’s lifecycle state and automatically triggers any configured lifecycle processes, including:

  • Disabling connected accounts
  • Revoking access
  • Executing termination policies
  • Initiating downstream provisioning actions

The workflow evaluates the API response for every identity. Successful responses continue to the success notification, while failed responses are routed to the error-handling branch.

5. Error Handling

The workflow includes built-in error handling to ensure failures are reported without interrupting bulk processing.

If the HTTP Request action returns an API error (such as authorization issues or invalid requests), the workflow captures the response and sends a failure notification containing the relevant error details.

Rather than stopping execution, the workflow continues processing the remaining identities in the request.

6. Email Notifications

The workflow sends different email notifications based on the outcome.

Success

  • Confirms that the identity has been moved to the Terminated lifecycle state.
  • Indicates that the termination request completed successfully.

API Failure

  • Includes the API response or error message.
  • Helps administrators troubleshoot the issue quickly.

Validation Failure

  • Informs the requester that the selected identity does not belong to the Workday authoritative source.
  • Explains why the termination request was skipped.

These notifications provide complete visibility into the execution results.

Testing

The workflow was validated using the following scenarios:

Scenario Expected Result
Valid Workday identity Lifecycle state updated successfully
Non-Workday identity Validation failed and notification sent
Multiple identities All identities processed individually
API failure Failure notification generated
Mixed valid and invalid identities Valid identities terminated while invalid identities skipped

Conclusion

This approach provides a practical solution for handling urgent termination scenarios in IdentityNow. By combining forms, validation, and API-driven actions, you can build a secure and flexible termination process that works alongside standard lifecycle management.
ImmediateIdentityTermination.json (7.3 KB)

2 Likes