Now based on this problem, we have another problem. The filter in the identity created triggers dont work. In the documentation of triggers there is written, that we can set a filter in order that the workflows will not triggered each time.
Question: If the identity is always created with null values and just after that the identity attributes will be updated, how can we use a filter in the identity create trigger?
Hello Onur Birsoez. The filter on the Identity Created trigger can only evaluate what is available in the event payload at that moment. Since PROD is creating the identity with null values first and populating the attributes in a separate update immediately after, there is nothing useful for the filter to match against.
The docs says the Identity Created event contains all identity attributes configured in the identity profile. If Sandbox sends populated values but PROD sends nulls, that difference is worth raising with SailPoint Support so they can trace the processing sequence.
Until that is sorted, I would try this workaround by removing the attribute filter from the trigger, add a Wait step (around 1 - 2 mins), then use Get Identity with $.trigger.identity.id to retrieve the refreshed attributes. After that, use Compare Strings to check the required value and route the nonmatching path to an End step. Yes, this creates an execution for every new identity, but identities that do not meet the condition will exit immediately after the comparison.
I would not replace this with Identity Attributes Changed trigger to catch cloudLifecycleState, because that trigger specifically does not detect the change from null to active.
