# Filter by manager relationship for Cloud Rule

**URL:** <https://developer.sailpoint.com/discuss/t/filter-by-manager-relationship-for-cloud-rule/216202>\
**Category:** SHF Discussion and Questions\
**Tags:** identity-security-cloud, rules\
**Created:** [July 10, 2026, 9:09pm UTC](https://developer.sailpoint.com/discuss/t/filter-by-manager-relationship-for-cloud-rule/216202 "2026-07-10T21:09:16Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![chrisk](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/chrisk/32/34678_2.png) [@chrisk](https://developer.sailpoint.com/discuss/u/chrisk)\
**Post date:** [July 10, 2026, 9:09pm UTC](https://developer.sailpoint.com/discuss/t/filter-by-manager-relationship-for-cloud-rule/216202/1 "2026-07-10T21:09:16Z")

</div>

Hello all,

Trying to create a Cloud Rule to take the place of what we used to do in IIQ with an Identity Selector Rule - [Identity Selector Rule Alternative in ISC](https://developer.sailpoint.com/discuss/t/identity-selector-rule-alternative-in-isc/214387)

Basically, we need to identify managers who are NOT in Canada but have Canadian direct reports.

I’m several versions into the rule and still can’t get it to work.

1. Is there any supported way to filter by manager relationship in `findIdentitiesBySearchableIdentityAttribute` without creating a flat intermediate Identity Attribute?
2. Has anyone successfully queried direct reports in an Identity Attribute Cloud Rule?

We have tried searching against manager.id and manager.name and get `IllegalStateException: Unable to find definition of attribute named 'manager.id'`

Current rule -

```auto
    import java.util.List;
    import java.util.Map;

    String CANADA = "Canada";

    try {
        String identityCountry = (String) identity.getAttribute("countryName");
        if (CANADA.equalsIgnoreCase(identityCountry)) {
            return "false";
        }

        String managerEmployeeId = (String) identity.getAttribute("identificationNumber");
        if (managerEmployeeId == null || managerEmployeeId.trim().equals("")) {
            return "false";
        }

        List directReports = idn.findIdentitiesBySearchableIdentityAttribute(
            "manager.name", "Equals", managerEmployeeId, "uid"
        );

        if (directReports != null) {
            for (Object reportObj : directReports) {
                sailpoint.object.Identity report = (sailpoint.object.Identity) reportObj;
                Map reportAttributes = report.getAttributes();
                if (reportAttributes != null) {
                    String reportCountry = (String) reportAttributes.get("countryName");
                    if (CANADA.equalsIgnoreCase(reportCountry)) {
                        return "true";
                    }
                }
            }
        }
        return "false";
    } catch (IllegalStateException ise) {
        return "false";
    } catch (Exception e) {
        return "false";
    }

```

Thanks in advance for any insight!

---

<div class="post-metadata">

**Author:** ![schattopadhy](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/schattopadhy/32/8854_2.png) [@schattopadhy](https://developer.sailpoint.com/discuss/u/schattopadhy)\
**Post date:** [July 11, 2026, 2:18am UTC](https://developer.sailpoint.com/discuss/t/filter-by-manager-relationship-for-cloud-rule/216202/2 "2026-07-11T02:18:04Z")

</div>

> [@chrisk](#):
>
> Trying to create a Cloud Rule to take the place of what we used to do in IIQ with an Identity Selector Rule - [Identity Selector Rule Alternative in ISC](https://developer.sailpoint.com/discuss/t/identity-selector-rule-alternative-in-isc/214387)
> 
> Basically, we need to identify managers who are NOT in Canada but have Canadian direct reports.
> 
> I’m several versions into the rule and still can’t get it to work.
> 
> 1. Is there any supported way to filter by manager relationship in `findIdentitiesBySearchableIdentityAttribute` without creating a flat intermediate Identity Attribute?
> 2. Has anyone successfully queried direct reports in an Identity Attribute Cloud Rule?
> 
> We have tried searching against manager.id and manager.name and get `IllegalStateException: Unable to find definition of attribute named 'manager.id'`
> 
> Current rule -

@chrisk

The `IllegalStateException` you’re getting is expected — in ISC, `manager.id` and `manager.name` are **not registered as searchable identity attributes** in any identity profile, and you can’t promote them to be searchable through the UI. The `findIdentitiesBySearchableIdentityAttribute` method strictly rejects any name that isn’t in the identity profile’s searchable attribute list, hence the “Unable to find definition of attribute” error.

This is one of the more painful gaps between IIQ and ISC Cloud Rules: IIQ’s BeanShell had a working `Context.findObjectsByFilter()` over the DB, and IIQ’s `findIdentitiesBySearchableIdentityAttribute` was much more permissive. ISC Cloud Rules run in a sandboxed API surface and the manager relationship isn’t queryable in that direction (only read on the current identity via `identity.getManager()`).

---

<div class="post-metadata">

**Author:** ![JackSparrow](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/jacksparrow/32/19685_2.png) [@JackSparrow](https://developer.sailpoint.com/discuss/u/JackSparrow)\
**Post date:** [July 11, 2026, 11:08am UTC](https://developer.sailpoint.com/discuss/t/filter-by-manager-relationship-for-cloud-rule/216202/3 "2026-07-11T11:08:54Z")

</div>

Hello @chrisk,

If I understand the requirement correctly, we need to identify managers who are not located in Canada but have one or more direct reports located in Canada and then assign a specific role to those managers.

I can think of an approach using workflows to achieve this. However, this would be a request-based approach rather than a criteria-based role assignment.

### **High-Level Steps**

**Step 1:** Create a scheduled workflow that runs periodically.

**Step 2:** Use the Search API to retrieve all managers who are not located in Canada. You can use the following search query:

**isManager:true AND NOT attributes.location:“CANADA”**

**Step 3:** Loop through each manager returned by the query and retrieve their direct reports using the Search API. Use a query similar to:

**manager.id:“${managerEmpId}”**

**Step 4:** Iterate through the direct reports and check whether any of them are located in Canada.

**Step 5:** If at least one direct report is located in Canada, verify whether the manager already has the required role assigned. If not, assign the role using either the Access Request APIs or the Manage Access action.

### Workflow Design

This approach would require **two separate workflows** :

1. **Parent Workflow** – Retrieves and loops through all eligible managers.
2. **Child Workflow** – Processes each manager’s direct reports and determines whether the role assignment criteria are met.

This should help automate the identification and role assignment process for managers who are outside Canada but manage employees located in Canada.

---

<div class="post-metadata">

**Author:** ![chrisk](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/chrisk/32/34678_2.png) [@chrisk](https://developer.sailpoint.com/discuss/u/chrisk)\
**Post date:** [July 30, 2026, 5:13pm UTC](https://developer.sailpoint.com/discuss/t/filter-by-manager-relationship-for-cloud-rule/216202/4 "2026-07-30T17:13:19Z")

</div>

In case someone else is trying to do something similar, this is what I ended up doing and it works. Not saying it’s the best/right way - but it is working

Created two new Identity Attributes

NonCaCanadaMGR - This will be True of False and what the Role will look at for assignment

ManagerCode - This holds the empID of the Identities manager, I had trouble pulling it from anywhere else successfully. This is mapped to HR.

Created a Cloud Rule -

```auto
    import java.util.List;
    import java.util.Map;

    String CANADA = "Canada";

    try {

        String identityCountry = (String) identity.getAttribute("countryName");
        if (identityCountry == null || identityCountry.trim().equals("")) {
            return "false";
        }
        if (CANADA.equalsIgnoreCase(identityCountry)) {
            return "false";
        }

        String managerEmployeeId = (String) identity.getAttribute("identificationNumber");
        if (managerEmployeeId == null || managerEmployeeId.trim().equals("")) {
            return "false";
        }

        List directReports = null;
        try {
            directReports = idn.findIdentitiesBySearchableIdentityAttribute(
                "managerCode", "Equals", managerEmployeeId, "uid"
            );
        } catch (IllegalStateException ise) {
            return "STOP-1: IllegalStateException - " + ise.getMessage();
        } catch (Exception ex) {
            return "STOP-2: Exception on findIdentities - " + ex.getMessage();
        }

        if (directReports == null) {
            return "false";
        }
        if (directReports.isEmpty()) {
            return "false";
        }

        for (Object reportObj : directReports) {
            sailpoint.rule.Identity report = (sailpoint.rule.Identity) reportObj;
            Map reportAttributes = report.getAttributes();
            if (reportAttributes == null) {
                continue;
            }
            String reportLifecycle = (String) reportAttributes.get("cloudLifecycleState");
            if (!"active".equalsIgnoreCase(reportLifecycle) &&
                !"preHire".equalsIgnoreCase(reportLifecycle) &&
                !"leaveOfAbsence".equalsIgnoreCase(reportLifecycle)) {
                continue;
            }
            String reportCountry = (String) reportAttributes.get("countryName");
            if (CANADA.equalsIgnoreCase(reportCountry)) {
                return "true";
            }
        }

        return "false";

    } catch (Exception e) {
        return "STOP-ERROR: " + e.getMessage();
    }

```

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\
**Post date:** [September 28, 2026, 5:13pm UTC](https://developer.sailpoint.com/discuss/t/filter-by-manager-relationship-for-cloud-rule/216202/5 "2026-09-28T17:13:20Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.