Capture received date of an Identity Attribute

[vijaylca (Vijay Alla)]

Hi, I’m looking for a possible solution for the below scenario. Any ideas will be really appreciated.

Requirement:
We want to capture the date on which we received “Termination” worker status from our HR system.
We want to store that value in an Identity attribute called “Term Recieved Date”

Our Use Case:

Using “Term Recieved Date” value, we want configure our “User De-provisioning” life cycle states

• if “Term Recieved Date” is today and worker status is “Terminated” , then Disable AD account
• if “Term Recieved Date” is 7+ days and worker status is “Terminated” , then Remove entitlements.
• if “Term Recieved Date” is 30+ days and worker status is “Terminated” , then Delete AD account

We do receive “termination date” from HR but we don’t want to use that as in some cases it could be date from the past.Our deproviosiong clock should start from the date we received “Termination” worker status from our HR system

I believe we can use “Identity Attribute change” event trigger/workflows to capture the received date but how to write back to another Identity attribute is something I’m not sure.

I’m looking for a solution that we can handle using Transform or something that doesn’t involve calling external API etc.

Thanks
Vijay

[KRM7 (Krishna Mummadi)]

Try this

{
    "attributes": {
        "workerStatus": {
            "attributes": {
                "sourceName": "HR Source",
                "attributeName": "status"
            },
            "type": "accountAttribute"
        },
        "termDate": {
            "attributes": {
                "values": [
                    {
                        "attributes": {
                            "name": "Term Recieved Date"
                        },
                        "type": "identityAttribute"
                    },
                    {
                        "attributes": {
                            "expression": "now",
                            "roundUp": false
                        },
                        "type": "dateMath"
                    }
                ]
            },
            "type": "firstValid"
        },
        "value": "#if($workerStatus=='Terminated')$termDate#{else}#end"
    },
    "type": "static",
    "name": "EndDate Static Transform"
}

[vijaylca (Vijay Alla)]

Thank you @KRM7 , This looks promising and but one limitation is “Term Recieved Date” will show as date on which transform is applied for all past termination. But anything new going forward will have correct date.

To avoid showing the wrong “Term Recieved Date” for past termination, i have applied additional logic in above transform to filter out past termination.

Ideally “Access History” has details of when a term is received. If there is a way to tap into that information, it will help to get correct term received date.

[KRM7 (Krishna Mummadi)]

You can rely on some more attributes to filter past terminations. Do you have end date for already terminated users, you can use that attribute maybe.

Also we can use $oldValue to have previous value of the attribute, we can give a try on that, Something like from any status (other than terminated) to Terminated

[vijaylca (Vijay Alla)]

yes, for short term I will use “transform” solution which can capture “Term Recieved Date” from now on. For all the past terminations, I will leave it a blank value. thank you @KRM7 for your help.