Hi all, I am trying to find out disabled identities that have active application links and entitlements. Can someone help me with a code snippet? Or is there any OOTB report? Thanks in advance

@rishavghoshacc Try this OOTB report Identity Effective Access Live Report. If your identity status attribute is searchable then it will be shown in identity extended properties section, there you can select status and run the report.

Try below filter to fetch the inactive users who has active application links QueryOptions qo = new QueryOptions(); qo.addFilter(Filter.eq("inactive", true)); qo.addFilter(Filter.notnull("name")); qo.addFilter(Filter.notnull("links.application.name")); qo.addFilter(Filter.ne("links.appli…

@vemadeepak I would also need to get the app name for the link that is still active. For that I would need to iterate over all the links of the identity. Is there a way to optimize the part where I can directly get the app name too?

Can you please try this code, import sailpoint.object.Identity; import sailpoint.object.Link; import sailpoint.object.Application; import sailpoint.object.Schema; import sailpoint.object.AttributeDefinition; import sailpoint.object.QueryOptions; import sailpoint.object.Filter; import sailpoi…

@rishavghoshacc You can configure a custom report of data source on Link Object, and you can add a filters on identity status and schedule the report. Let me see if i have a sample i’ll share it here.

Check below blog to acheieve with Active Specific Application. [image] Identifying Inactive Identities with Active Specific Application in SailPoint IIQ Discussion and Questions When managing identities within SailPoint, one common requirement is to identify “…

try fliter like below application name used filter.in anything available. also add the logic for entitlement based on identity QueryOptions qo = new QueryOptions(); qo.addFilter(Filter.eq(“inactive”, true)); qo.addFilter(Filter.and(Filter.eq(“links.application.name”, “Active Directory”),Filter.ne…

I have seen quickest way to get this information is to use SQL query (if you can access IIQ DB even as read only). Something like below should get you what you need select id.name 'Inactive Identity',l.display_name 'Active Account ID',app.name 'Application' from spt_link l, spt_application app, sp…

@rishavghoshacc @vemadeepak . This is working solution. Please try from custom rule. It should work.

@rishavghoshacc shared a sample report. please check and let us know for any further issues.

Disabled identities with active accounts and entitlements

IdentityIQ (IIQ) IIQ Discussion and Questions

neel193 (Neelmadhav Panda) June 18, 2026, 3:32am 12

@rishavghoshacc Please check this article as well: How to Detect Active Application Links for Terminated Identities via IIQ LiveReports or SQL Queries - IdentityIQ (IIQ) / IIQ Community Knowledge Base - SailPoint Developer Community

Topic		Replies	Views
Extracting, via Rule, Inactive Identities with Active Application Account in SailPoint IIQ Discussion and Questions rules , identityiq	9	354	February 10, 2025
Filter Script to list Identities having active accounts on an application IIQ Discussion and Questions identityiq	6	251	November 28, 2024
How to Detect Active Application Links for Terminated Identities via IIQ LiveReports or SQL Queries IIQ Community Knowledge Base identityiq	3	206	June 18, 2026
Identifying Inactive Identities with Active Specific Application in SailPoint IIQ Discussion and Questions identityiq	2	341	November 26, 2024
Code to get all active identities with active directory links IIQ Discussion and Questions workflows , transforms , apis , rules , identity-security-cloud , identityiq , provisioning	4	171	October 24, 2025

Disabled identities with active accounts and entitlements

Related topics