Hi @kdossen,
Welcome to the community!
I am not sure if we can do that via workflow, but I do have a suggestion. I think it’s better to handle this using the “Services Standard IdentityNow BeforeProvisioning Rule."
Check out this post to get more information on how to import the cloud rule to your tenant - Services Standard Before Provisioning Rule
But first, you can verify if the rule is in your tenant with the following API call,
https:///cc/api/rule/get/Services Standard IdentityNow BeforeProvisioning Rule
I am attaching the readme file, which shows all the things you can accomplish using that rule.
SSI BeforeProvisioning Rule - README.pdf (110.2 KB)
Also, if you are not able to import the cloud rule, you can request SailPoint, as they already have a working version of this rule. This will be a one-time thing; just open a support ticket, and they will immediately deploy the rule to your tenant.
Once the rule is in your tenant, it’s just a matter of patching it to the source and defining the actions. Examples are in the attached Readme file.
I hope this helps!