Deliver search query results to non-admin users

[SreeshaC93 (Sreesha Chittadimeluveettil)]

Hi all,

I understand that ISC does not natively support building a workflow to email a CSV attachment. I’m seeking help to see if anyone has found an alternative way to accomplish this use case.

Context - I need to send a scheduled report of all identities from a specific source (Consultants), including attributes like display name, status, manager, end date, and company info.

What I’ve tried: Created a saved search query and set up a subscription — this works, but recipients need at minimum the Report Admin user level to access and download the report.

My ask s s there any approach — via workflow, API, or another pattern — that allows delivering the report content directly to a user (or DL) without requiring them to have any SailPoint user level assigned?

Any experience, examples, or leads would be much appreciated. Thanks!

[PhilRawlings1 (Phil Rawlings)]

Powershell script hosted on a remote server (think IQserver) that has outbound mail privileges. It’s a bit of a pig, but will do what you want

Otherwise, a very simple option is to make it a scheduled calendar task for your lowest level Report Admin person, and get them to email it out to a DL manually

[MattUribe]

It’s not a CSV, but you can embed a table using HTML. Here’s an example from a workflow in a demo tenant:

It’s built from the results of a search. Implementation details can be found in a post by @trettkowski here:

Designing Beyond Default: The Ultimate Guide to SailPoint Form UI Customization

[blog title card] Form Adoption vs. Form Function As IAM professionals, we spend weeks designing robust joiner mover leaver processes, automated workflows, and complex approvals. When it’s time to roll them out to the business, we deploy them using out of the box, plain text forms. We tell ourselves that as long as the form is functional and the backend APIs provision access correctly, our job is done. But then the complaints roll in. Business managers find the forms confusing. End users requ…

Instead of putting the table into a form, you can put it into a Send Email action. The drawback is that PII is being sent over email. I’d much rather make it available in a form for an interactive launcher. That way, no one has to be an admin, they just need access to the launcher. The drawback to that is the workflow will spend a lot of time in the Serial Loop step, and the user will just have a blank interactive process until the full contents of the table gets built.

Matt

[punna0001 (harish Punna)]

Hello Sreesha. Yes, there is no workflow-native way to email a CSV attachment today. Send Email doesn’t support attachments, and HTTP Request expects JSON responses.

Before building anything custom, it’s worth checking the saved-search subscription’s Add a detailed summary of results to the report option. That includes the identity data directly in the email body. If a CSV file isn’t a hard requirement, this may already cover the use case without giving recipients an admin/Search user level. Additional permissions are only needed if they want to open or download the generated report in ISC.

If you would rather build it in a workflow, @MattUribe’s HTML-table approach also looks good. Get List of Identities can use a search query or saved search and feed the results into Send Email. Just note the 250-identity limit, so larger populations would need to be segmented.

If an actual CSV attachment is required, @PhilRawlings1’s external-script direction makes sense. A scheduled PowerShell/Python job, Azure Function, or Lambda could use OAuth Client Credentials with sp:search:read, call POST /search/v1 with the search query, generate the CSV, and either email it or place it in an access-controlled location such as SharePoint, Teams, or SFTP. For more than 10,000 results, use searchAfter pagination.

[vguleria (Vikas Guleria)]

Hi @Seema_Rane

You could also explore AIC (Access inteligence center) , may be with reader permission users can download the report themselves.

If users are not willing to login to ISC, then workflow option with HTML based content is good suggestion or may be build some custom scripts and host them on cloud so they can run periodically and do this action.

If you are on Azure cloud, may be logic apps can do this with simple workflow.

Thank You.
Regards
Vikas.

[SreeshaC93 (Sreesha Chittadimeluveettil)]

@punna0001

Hello Sreesha. Yes, there is no workflow-native way to email a CSV attachment today. Send Email doesn’t support attachments, and HTTP Request expects JSON responses.

Before building anything custom, it’s worth checking the saved-search subscription’s Add a detailed summary of results to the report option. That includes the identity data directly in the email body. If a CSV file isn’t a hard requirement, this may already cover the use case without giving recipients an admin/Search user level. Additional permissions are only needed if they want to open or download the generated report in ISC.

If you would rather build it in a workflow, @MattUribe’s HTML-table approach also looks good. Get List of Identities can use a search query or saved search and feed the results into Send Email. Just note the 250-identity limit, so larger populations would need to be segmented.

If an actual CSV attachment is required, @PhilRawlings1’s external-script direction makes sense. A scheduled PowerShell/Python job, Azure Function, or Lambda could use OAuth Client Credentials with sp:search:read, call POST /search/v1 with the search query, generate the CSV, and either email it or place it in an access-controlled location such as SharePoint, Teams, or SFTP. For more than 10,000 results, use searchAfter pagination.

Thanks all for the great input and additional ideas! Appreciate it

[SreeshaC93 (Sreesha Chittadimeluveettil)]

hi Harish, i tried to turn on the add detailed summary but still it won’t show the report - it only give me option with clickable link

[uppala (Mahesh Babu Uppala)]

Hi Sreesha,

Using APIs and writing a script in your preferred language, such as Python or PowerShell (personally, I prefer PowerShell), is the best approach. You can schedule the script using Windows Task Scheduler and configure it to send notifications to an individual email address or a distribution list (DL).

Let me know if you need sample script, will share it with you.

Thanks,

Mahesh

[SreeshaC93 (Sreesha Chittadimeluveettil)]

Thanks Mahesh! Yes, a sample PowerShell script would be really helpful , much appreciated if you can share it.
I can adapt it to our use case as a longer-term option for broader distribution.

[uppala (Mahesh Babu Uppala)]

@SreeshaC93

I need to send a scheduled report of all identities from a specific source (Consultants), including attributes like display name, status, manager, end date, and company info.

Here you go

$OrgName = “”
$ClientId = “”
$ClientSecret = “”

$ReportPath = “C:\Reports”
$ReportFile = Join-Path $ReportPath (“Consultants_Report_{0}.csv” -f (Get-Date -Format “yyyyMMdd”))

if (!(Test-Path $ReportPath)) {
New-Item -Path $ReportPath -ItemType Directory -Force | Out-Null
}

$TokenBody = @{
grant_type = “client_credentials”
client_id = $ClientId
client_secret = $ClientSecret
}

$TokenResponse = Invoke-RestMethod -Method Post
-Uri “https://$OrgName.api.identitynow.com/oauth/token” -ContentType "application/x-www-form-urlencoded"
-Body $TokenBody

$AccessToken = $TokenResponse.access_token

$Headers = @{
Authorization = “Bearer $AccessToken”
“Content-Type” = “application/json”
}

$SearchBody = @"
{
“indices”: [“identities”],
“query”: {
“query”: “attributes.employeeType:“Consultant””
}
}
"@

Write-Host “Retrieving Consultant identities…”

$Results = Invoke-RestMethod -Method Post
-Uri “https://$OrgName.api.identitynow.com/v3/search” -Headers $Headers
-Body $SearchBody

Write-Host “Identities returned:” $Results.Count

$Report = foreach ($Identity in $Results) {

[PSCustomObject]@{
    DisplayName       = $Identity.attributes.displayName
    FirstName         = $Identity.attributes.firstName
    LastName          = $Identity.attributes.lastName
    EmployeeNumber    = $Identity.attributes.employeeNumber
    EmployeeType      = $Identity.attributes.employeeType
    
}

}

$Report | Export-Csv -Path $ReportFile
-NoTypeInformation `
-Encoding UTF8

Write-Host “”
Write-Host “Report generated successfully”
Write-Host $ReportFile

$SendEmail = $false

if ($SendEmail) {

$smtpServer = "smtp.company.com"
$from       = "isc-reports@company.com"
$to         = "xyz@company.com"

Send-MailMessage `
    -SmtpServer $smtpServer `
    -From $from `
    -To $to `
    -Subject "Consultants Identity Report" `
    -Body "Attached is the latest Consultants identity report." `
    -Attachments $ReportFile

}

I tested this script and working for me, make changes according to your requirements.

Thanks,

Mahesh