Hello All, We are looking to capture the list/report of the accounts which are disabled outside of SailPoint ISC. However, In our environment we do not have Native change detection enabled. Is there any way we can get the report. Thanks, Maninder K

Have you tried a search? @accounts(source.name:"Active Directory" AND disabled:true) Call the search API from “outside of SailPoint ISC” and parse through the results. If you provide more details, we could give more direct insight. Here’s the API request: POST {{apiURL}}/search/v1 { "indices…

One additional detail - that query will get you identities with disabled accounts. If you want all disabled accounts, even uncorrelated, then you will want to iterate over the /accounts/v1 endpoint instead of using search.

Thanks Matt, this query appears to give the accounts that are disabled by Sailpoint. I am primarily looking for the accounts which got disabled outside of Sailpoint i.e. via any other automation or from the AD tool. could you provide any insights. Thank you, Maninder Kaur

You can enable native change detection. Capture events where the userAccountControl attribute is changed. Then your workflow will need to evaluate the new value of userAccountControl to see whether it indicates a disabled account.

Hi @maninderkaur_co-op , Not exactly. This query will return all identities that have a disabled AD account. For your use case, the recommended approach would be to use NCD, as it can be configured to target the specific scenario you’re looking for more effectively.

Moving forward from here, you can get Sailpoint to set a field when it disables/enablea account. You can then use that absence to determine what is being disabled outside of IDN. We use: { "name": "comment", "transform": { "attributes": { "values": [ { "attributes":…

HI @maninderkaur_co-op This ain’t gonna be straight forward but i can think of a longer route: Download Active Directory accounts export. Get all the AD disabled accounts. For all those AD accounts you perform a search query again. Something like this: (attributes.identificationNumber:“A” OR att…

Capture AD Disabled accounts outside sailpoint

SailPoint Human Fabric (SHF) SHF Discussion and Questions

vikaspawar0303 (vikas pawar) September 2, 2026, 12:04am 5

@maninderkaur_co-op

You can write a powershell script to pull the AD disable records and using the task scheduler you can run it on schedule basis that is one way you can achieve this.

:tada: Thank you for an awesome Q3!

Topic		Replies	Views
Search query for number of source accounts disabled SHF Discussion and Questions identity-security-cloud	4	188	December 19, 2025
Enable/Disable account for an identity using SailPoint APIs SHF Discussion and Questions apis , identity-security-cloud	3	394	October 15, 2024
IIQDisabled" is missing from the sources account schema - Active Directory SHF Discussion and Questions identity-security-cloud	2	101	February 17, 2026
How do I disable the SailPoint source? SHF Discussion and Questions	5	2780	August 8, 2022
How to disable old AD and enable new AD in rehire scenario SHF Discussion and Questions identity-security-cloud , provisioning , accounts , connectors	5	254	January 2, 2025

Capture AD Disabled accounts outside sailpoint

Related topics