Identity Search Range Queries Not Working on Custom Date Identity Attribute (lastLoginValue) Although ISO8601 Format Is Populated

SailPoint Human Fabric (SHF) SHF Discussion and Questions
, ,
1

Hi SailPoint Community,

I am facing an issue with Identity Search range queries on a custom identity attribute called lastLoginValue.

Background

I have created an identity attribute named lastLoginValue using a transform that determines the most recent login across multiple sources (Entra ID, Active Directory, and Okta). The transform outputs a single date value in ISO8601 format. The logic compares login timestamps from the three sources and returns the most recent login date.

Example output values stored in the identity attribute:

2026-08-14T09:15:30.000Z

2026-08-12T18:42:11.000Z

Issue

Identity Search range queries work correctly for built-in date attributes such as:

attributes.endDate:[now-500d TO now]

and

attributes.created:[now-500d TO now]

These return the expected results.

However, the same type of query does not work for lastLoginValue.

Examples attempted:

attributes.lastLoginValue:[now-500d TO now]

attributes.lastLoginValue:[now-60d TO now]

attributes.lastLoginValue:now

I even have identities whose lastLoginValue is populated with the current timestamp, but:

attributes.lastLoginValue:now

returns no results.

In fact, none of the range queries seem to return any identities for this attribute.

Validation Performed

  • Confirmed that the identity attribute is populated.
  • Confirmed that values are in ISO8601 format.
  • Confirmed that other date attributes (created, endDate) support range searches in the same tenant.
  • Confirmed that the transform successfully evaluates and populates the identity attribute.

Questions

  1. Are custom identity attributes populated via transforms indexed differently from standard date attributes?
  2. Does a custom identity attribute need to be configured as a specific data type (Date vs String) to support Identity Search range queries?
  3. Is there any limitation on using relative date operators such as now, now-60d, etc., against custom identity attributes?
  4. Has anyone successfully implemented range searches against a custom ISO8601 identity attribute?

The transform used for the attribute is given below -

{
    "name": "LastLoginValue",
    "type": "static",
    "attributes": {
        "MascoLastLogon": {
            "type": "firstValid",
            "attributes": {
                "values": [
                    {
                        "attributes": {
                            "attributeName": "signInActivity.lastSuccessfulSignInDateTime",
                            "sourceName": "Test Workday"
                        },
                        "type": "accountAttribute"
                    },
                    {
                        "type": "dateMath",
                        "attributes": {
                            "expression": "now",
                            "roundUp": false
                        }
                    }
                ],
                "ignoreErrors": false
            }
        },
        "ADLastLogon": {
            "type": "firstValid",
            "attributes": {
                "values": [
                    {
                        "type": "dateFormat",
                        "attributes": {
                            "input": {
                                "attributes": {
                                    "attributeName": "lastLogonTimeStamp",
                                    "sourceName": "Test Workday"
                                },
                                "type": "accountAttribute"
                            },
                            "inputFormat": "EPOCH_TIME_WIN32",
                            "outputFormat": "ISO8601"
                        }
                    },
                    {
                        "type": "dateMath",
                        "attributes": {
                            "expression": "now",
                            "roundUp": false
                        }
                    }
                ],
                "ignoreErrors": false
            }
        },
        "OktaLastLogon": {
            "type": "firstValid",
            "attributes": {
                "values": [
                    {
                        "attributes": {
                            "attributeName": "lastLogin",
                            "sourceName": "Test Workday"
                        },
                        "type": "accountAttribute"
                    },
                    {
                        "type": "dateMath",
                        "attributes": {
                            "expression": "now",
                            "roundUp": false
                        }
                    }
                ],
                "ignoreErrors": false
            }
        },
        "NearestOfAdAndOkta": {
            "type": "dateCompare",
            "attributes": {
                "firstDate": {
                    "type": "firstValid",
                    "attributes": {
                        "values": [
                            {
                                "type": "dateFormat",
                                "attributes": {
                                    "input": {
                                        "attributes": {
                                            "attributeName": "lastLogonTimeStamp",
                                            "sourceName": "Test Workday"
                                        },
                                        "type": "accountAttribute"
                                    },
                                    "inputFormat": "EPOCH_TIME_WIN32",
                                    "outputFormat": "ISO8601"
                                }
                            },
                            {
                                "type": "dateMath",
                                "attributes": {
                                    "expression": "now",
                                    "roundUp": false
                                }
                            }
                        ],
                        "ignoreErrors": false
                    }
                },
                "secondDate": {
                    "type": "firstValid",
                    "attributes": {
                        "values": [
                            {
                                "attributes": {
                                    "attributeName": "lastLogin",
                                    "sourceName": "Test Workday"
                                },
                                "type": "accountAttribute"
                            },
                            {
                                "type": "dateMath",
                                "attributes": {
                                    "expression": "now",
                                    "roundUp": false
                                }
                            }
                        ],
                        "ignoreErrors": false
                    }
                },
                "operator": "gt",
                "positiveCondition": "AD",
                "negativeCondition": "Okta"
            }
        },
        "NearestOfEntraAndOkta": {
            "type": "dateCompare",
            "attributes": {
                "firstDate": {
                    "type": "firstValid",
                    "attributes": {
                        "values": [
                            {
                                "attributes": {
                                    "attributeName": "signInActivity.lastSignInDateTime",
                                    "sourceName": "Test Workday"
                                },
                                "type": "accountAttribute"
                            },
                            {
                                "type": "dateMath",
                                "attributes": {
                                    "expression": "now",
                                    "roundUp": false
                                }
                            }
                        ],
                        "ignoreErrors": false
                    }
                },
                "secondDate": {
                    "type": "firstValid",
                    "attributes": {
                        "values": [
                            {
                                "attributes": {
                                    "attributeName": "lastLogin",
                                    "sourceName": "Test Workday"
                                },
                                "type": "accountAttribute"
                            },
                            {
                                "type": "dateMath",
                                "attributes": {
                                    "expression": "now",
                                    "roundUp": false
                                }
                            }
                        ],
                        "ignoreErrors": false
                    }
                },
                "operator": "gt",
                "positiveCondition": "Entra",
                "negativeCondition": "Okta"
            }
        },
        "NearestOfEntraAndAd": {
            "type": "dateCompare",
            "attributes": {
                "firstDate": {
                    "type": "firstValid",
                    "attributes": {
                        "values": [
                            {
                                "attributes": {
                                    "attributeName": "signInActivity.lastSignInDateTime",
                                    "sourceName": "Test Workday"
                                },
                                "type": "accountAttribute"
                            },
                            {
                                "type": "dateMath",
                                "attributes": {
                                    "expression": "now",
                                    "roundUp": false
                                }
                            }
                        ],
                        "ignoreErrors": false
                    }
                },
                "secondDate": {
                    "type": "firstValid",
                    "attributes": {
                        "values": [
                            {
                                "type": "dateFormat",
                                "attributes": {
                                    "input": {
                                        "attributes": {
                                            "attributeName": "lastLogonTimeStamp",
                                            "sourceName": "Test Workday"
                                        },
                                        "type": "accountAttribute"
                                    },
                                    "inputFormat": "EPOCH_TIME_WIN32",
                                    "outputFormat": "ISO8601"
                                }
                            },
                            {
                                "type": "dateMath",
                                "attributes": {
                                    "expression": "now",
                                    "roundUp": false
                                }
                            }
                        ],
                        "ignoreErrors": false
                    }
                },
                "operator": "gt",
                "positiveCondition": "Entra",
                "negativeCondition": "AD"
            }
        },
        "value": "#if($NearestOfAdAndOkta == 'Okta' && $NearestOfEntraAndOkta == 'Okta')$OktaLastLogon#elseif($NearestOfAdAndOkta == 'AD' && $NearestOfEntraAndAd == 'AD')$ADLastLogon#else$MascoLastLogon#end"
    },
    "internal": false
}
2

Hi @VasanthRam !

You need to add “dateType” to the end of your identity attribute name to force ISC to treat it as a date/time value. You can find more info about this behavior in this post.

Please let me know if this helps!

  • Zach
3

I agree with @zachm117 - the dateType suffix will give you the behavior you are looking for.

So you should have lastLoginValueDateType for the technical name, Last Login Value Date Type for the display name.

Your search will be: attributes.lastLoginValueDateType:[now-60d TO now]

4

Just chiming in to also say that @zachm117’s answer is the correct solution. Please don’t forget to mark it as such, @VasanthRam.

5

Screenshot 2026-08-17 at 6.34.01 PM
Screenshot 2026-08-17 at 6.34.01 PM4110×2166 355 KB

Screenshot 2026-08-17 at 6.37.03 PM
Screenshot 2026-08-17 at 6.37.03 PM4110×2166 358 KB

Screenshot 2026-08-17 at 6.34.15 PM
Screenshot 2026-08-17 at 6.34.15 PM1920×1012 182 KB

6

@zachm117 Thank you for your response. Adding the suffix DateType didn’t help. Am I missing something here? Kindly provide your inputs.

7

have you made apply changes?

8

Hi Chaithanya, Yes, I have.

9

Double check your search syntax. attributes.lastLoginValueDateType:now is going to have to match exactly now, the current date and time. Not likely to return any results ever.

attributes.lastLoginValueDateType:[now-100 TO now]is also incorrect, and will probably tell you it’s a bad syntax. The 100 needs to be defined as days, months, years, minutes, seconds, etc. Try now-100d

10

One more detail: make sure your identity attribute is going through a dateFormat transform to apply ISO8601 outputFormat, just to ensure that the value matches what the value of now will look like.

11

Thank you so much for you response. It worked!