Identity Lifecycle Tracker

[Bassem_Mohamed]

Overview

A recurring request from identity security cloud customers is to gain visibility into identity lifecycle events like when a user joins, moves internally, leaves, or is rehired.

Currently, Identity Security Cloud lacks a native way to provide a human-readable audit trail of these events within the product.

Solution

This lightweight solution offers a smart and extensible approach to record lifecycle state transitions with timestamps directly on the identity record.

For example, an identity’s attribute might show:
Joined on 2025-05-27T14:18Z → Mover on 2025-05-27T14:19Z → Leaver on 2025-05-27T14:20Z → Re-joined on 2025-05-27T14:23Z

This status trail is dynamically built starting from the moment the solution is deployed, without requiring access to historical data.

How it works

1. Lifecycle States

Configure meaningful lifecycle states for your organization:

• Pre-Hire

• Active

• Mover

• Inactive

These states will help track transitions relevant to the employee lifecycle.

2. Mover Detection Workflow

A workflow that:

• Detects if an identity meets mover criteria (e.g., department or manager changes)

• Temporarily updates the lifecycle state to Mover

• After a defined period (e.g., 24h), resets it back to the original state

3. JML Status Transform

A transform script that builds a concatenated string of lifecycle events. It evaluates changes to cloudLifecycleState and appends timestamped labels.

4. Identity Attribute

Create a new identity attribute (e.g., JML Status) and bind it to the transform. This attribute will be updated automatically and show lifecycle history in plain text format.

The current Identity Attribute character length is 450 chars

Deployment Steps

• Define Lifecycle States
  Go to Identity Profiles → Lifecycle States and configure relevant statuses like Mover. Ensure it preserves the identity’s account status.

• Import and Configure Workflow
  Update the provided workflow template with:

  • Your API endpoint

  • OAuth credentials

  • Lifecycle state IDs

  • Detection criteria for Movers

  • Wait duration before reverting lifecycle state

JML - MoverDetector20250617 (1).json (2.7 KB)

• Add the Transform Json
  Create the JML Transform and insert the logic.
  Example Transform:

{
  "name": "JML State",
  "type": "firstValid",
  "attributes": {
    "requiresPeriodicRefresh": true,
    "values": [
      {
        "type": "static",
        "attributes": {
          "oldValue": {
            "type": "firstValid",
            "attributes": {
              "values": [
                {
                  "type": "static",
                  "attributes": {
                    "value": "$oldValue"
                  }
                },
                "N/A"
              ],
              "ignoreErrors": true
            }
          },
          "currentTimeStamp": {
            "type": "dateMath",
            "attributes": {
              "expression": "now/m"
            }
          },
          "lcs": {
            "type": "identityAttribute",
            "attributes": {
              "name": "cloudLifecycleState"
            }
          },
          "value": "#if($lcs == 'active' && $oldValue == \"N/A\")Joined on $currentTimeStamp" +
                   "#elseif($lcs == 'mover')$oldValue -> Mover on $currentTimeStamp" +
                   "#elseif($lcs == 'inactive')$oldValue -> Leaver on $currentTimeStamp" +
                   "#elseif($lcs == 'active' && $oldValue.contains(\"Leaver\"))$oldValue -> Re-joined on $currentTimeStamp" +
                   "#{else}$oldValue#end"
        }
      },
      ""
    ]
  }
}

• Create the Identity Attribute
  Name it JML Status (or similar) and attach it to the transform.

Result

With this solution, organizations can track and display lifecycle transitions per identity in a clear, readable format. It offers valuable context for identity operations, audit readiness, and compliance reporting.

This solution can be extended based on customer-specific JML use cases or integrated with analytics/reporting tools for deeper insights.