How password expiration email is triggered and what process checks the last set password and what triggers the email?

[Prashanth1812 (Prashanth Pullammagari)]

Hi,
Could someone explain how the whole password expiration reminder is sent OOTB? Is there a way we can customize this ?

[Carlatto (Carl Nelson)]

The IdentityNow Admin Guide gives a lot of good information. https://documentation.sailpoint.com/saas/help/pwd/policies.html

Set the password expiration setting and then your users will get an email every day about changing their password based on what you set.

One thing to keep in mind, users will only get these expiration emails if they have registered with IdentityNow. Registration occurs the first time a user has logged into IdentityNow. When we have new users onboard, we make sure they log into IdentityNow during their orientation to ensure they receive the expiration emails.

Password resets through IdentityNow have 2 parts. Part 1 checks the IdentityNow password policy. If the password passes the IdentityNow check, the password is then sent to the source system (part2). The source system then checks the password against its internal password policies. If that checks out, then the password is reset on the source.

IdentityNow doesn’t store the users’ passwords, so it is unable to check to see if the new password is the same as the old password. But when the new password is sent to the source system, the source system will verify that the new password isn’t the same as the old password if that is part of the source’s password settings.

[Prashanth1812 (Prashanth Pullammagari)]

Hi Carl,

thanks for the response.

I want to know if we can stop sending password expiration emails to active/onleave/registered users according to the policy.
Policy: 90 days and reminders are set to send starting 5 days prior of expiration.
Now after 90 days if an active user is onleave or something, we don’t want system to remind him everyday after 90 days(policy) to reset password.

[RAKGDS (Rakesh Bhati)]

Hi Prashanth,
I doubt this is currently supported in IdentityNow. Can you try using a workflow ?

Thanks
Rakesh Bhati

[colin_mckibben]

Check out this post I solved with a similar requirement to stop emails from being sent based on a specific user variable.

Email Templating and Conditional Routing

I did some testing on my end and I was able to conditionally stop emails from being sent on a per template basis. I accomplished this by adding an if condition in the subject of the template. If the condition evaluates to true, then it will insert the #stop variable so the email is not sent. If the condition is false, then the #stop variable won’t be inserted into the subject, and the email will be sent. Here is what I put in the subject: #if(true)#stop#end A user has been granted ${accessP…

I don’t know if the password expiration email surfaces the right user attributes for lifecycle state, but it’s worth a try.