I have a case : If an employee resigns, when their status changes to Inactive, all access will be disabled, and seven days after the Inactive date, all access will be deleted.
what should do I ?
Hi @rsobar
By all access will be disabled or deleted, do you mean the accounts themselves will be disabled and deleted?
To configure this, create two lifecycle states under the relevant Identity Profile: Inactive and Delete.
-For the Inactive lifecycle state:
Enable the lifecycle state, select Disable Accounts, and choose All Sources under Settings for Previous Accounts.
Set the Identity State to Inactive (ShortâTerm).
-For the Delete lifecycle state:
Enable the lifecycle state, set the Identity State to Inactive (LongâTerm), select Delete Accounts, and choose All Sources under Settings for Previous Accounts.
And update Lifecycle State Transform with logic similar to the example below
{
ânameâ: âtestoneâ,
âtypeâ: âstaticâ,
âattributesâ: {
âisdelteligâ: {
âattributesâ: {
ânegativeConditionâ: ânoâ,
âpositiveConditionâ: âyesâ,
âfirstDateâ: ânowâ,
âoperatorâ: âgteâ,
âsecondDateâ: {
âtypeâ: âdateFormatâ,
âattributesâ: {
âinputFormatâ: âyyyy-MM-ddâTâHH:mmâ,
âoutputFormatâ: âISO8601â,
âinputâ: {
âattributesâ: {
âinputâ: {
âtypeâ: âfirstValidâ,
âattributesâ: {
âignoreErrorsâ: âtrueâ,
âvaluesâ: [
{
âattributesâ: {
âinputâ: {
âattributesâ: {
âsourceNameâ: ââ,
âattributeNameâ: ââ
},
âtypeâ: âaccountAttributeâ
},
âinputFormatâ: âyyyy-MM-ddâ,
âoutputFormatâ: âISO8601â
},
âtypeâ: âdateFormatâ
},
"now"
]
}
},
âexpressionâ: â+7d/dâ,
âroundUpâ: false
},
âtypeâ: âdateMathâ
}
}
}
},
âtypeâ: âdateCompareâ
},
âvalueâ: â#if($isdeltelig == âyesâ)delete#{else}inactive#endâ
}
}
@rsobar - Right, Delete Accounts wonât allow All sources to prevent mass deletion, please choose Specific Source and select the sources required
@rpriya , I use this transform in the Lifecycle State attribute in the mapping attribute, is that correct ?
They should not have had that option there at all. You can delete all accounts as this will include HR source too that makes no sense
Hi @rpriya , if I donât have an account attribute for the resignation date, only an account attribute for employee status that contains: active or inactive. How can I handle the case I asked about ?
Hello @rsobar , so HR source doesnât have any attribute that says the userâs last working date? In that case, you can have a custom identity attribute created something like lastDateWorked and have the same date populated when user become inactive in the HR system. Now you can use lastDateWorked + 7 days to calculate new lifecyclestate.
@rsobar -Since the delete state is calculated based on resignation date + 7 days, youâll need a way to capture the date the user first became inactive. If no account attribute exists for the resignation date, create an identity attribute that records the timestamp when the employee status changes from Active to Inactive. Hereâs an example of transform to be used for the new identity attribute to capture inactivity date:
{
"name": "testone",
"type": "static",
"attributes": {
"currVal": {
"type": "firstValid",
"attributes": {
"ignoreErrors": "true",
"values": [
{
"type": "dateFormat",
"attributes": {
"inputFormat": "yyyy-MM-dd'T'HH:mm:ss.SSSSSSS",
"outputFormat": "yyyy-MM-dd",
"input": {
"attributes": {
"name": "<inactiveDateAttr>"
},
"type": "identityAttribute"
}
}
},
"none"
]
}
},
"status": {
"attributes": {
"values": [
{
"attributes": {
"sourceName": "",
"attributeName": "<employeeStatus>"
},
"type": "accountAttribute"
},
"none"
]
},
"type": "firstValid"
},
"currDate": {
"type": "dateFormat",
"attributes": {
"inputFormat": "yyyy-MM-dd'T'HH:mm:ss.SSSSSSS",
"outputFormat": "yyyy-MM-dd",
"input": {
"attributes": {
"expression": "now",
"roundUp": false
},
"type": "dateMath"
}
}
},
"value": "#if($currVal == 'none' && $status == 'inactive')$currDate#{else}none#end"
}
}
@rpriya , from the transform code you provided, why is the result 2026-03-01, even though its still february .
@rsobar To implement a disable-then-delete workflow in SailPoint Identity Security Cloud (ISC), you should use a Lifecycle State (LCS) Transform to calculate the correct state based on the termination date.
Since ISC does not have a âdelayed actionâ button within a single lifecycle state, you must split the process into two distinct states: Inactive and Delete.
- Configure the Two Lifecycle States
Go to Admin > Identities > Identity Profiles and select your profile. Under the Provisioning tab, create or edit the following states:
State 1: Inactive
Identity State: Set to Inactive (short-term).
Settings for Previous Accounts: Select Disable Accounts for âAll Sourcesâ.
Access Profiles: (Optional) Ensure no access profiles are assigned here to ensure all birthright access is also revoked.
State 2: Terminated_Delete
Identity State: Set to Inactive (long-term). This state is required to enable the âDeleteâ option.
Settings for Previous Accounts: Select Delete Accounts for âSpecific Sourcesâ (Note: âAll Sourcesâ is not available for deletion to prevent accidental mass wipes).
- Implement the Lifecycle State Transform
You need a Lifecycle State Transform to automatically move the user from âInactiveâ to âTerminated_Deleteâ exactly 7 days after their termination date. - Replace
terminationDatewith the actual name of the attribute in your identity profile that holds the exit date.
JSON
{
"name": "Lifecycle State Transition Logic",
"type": "static",
"attributes": {
"terminationDate": {
"attributes": {
"values": [
{
"attributes": {
"attributeName": "terminationDate",
"sourceName": "Workday"
},
"type": "identityAttribute"
},
"none"
]
},
"type": "firstValid"
},
"value": "#if($terminationDate == 'none')active#{else}#set($termDateObj = $dateTool.toDate('yyyy-MM-dd', $terminationDate))#set($sevenDaysLater = $dateTool.toCalendar($termDateObj))$sevenDaysLater.add(5, 7)#set($now = $dateTool.getSystemTime())#if($now < $sevenDaysLater.getTimeInMillis())inactive#{else}terminated_delete#end#end"
}
}
@rsobar - Update the currDate logic as below,
"currDate": {
"type": "dateMath",
"attributes": {
"expression": "now",
"roundUp": false
}
}
Hi @Deepak_Chaudhary
I donât think dateTool is available. Is this something you have tested out?
@rpriya , for currDate is working as expected. Next , regarding the transform code that i will attach below, why does seconDate contain null ?
{
"name": "Generate status delete",
"type": "static",
"attributes": {
"isdeltelig": {
"attributes": {
"negativeCondition": "no",
"positiveCondition": "yes",
"firstDate": "now",
"operator": "gte",
"secondDate": {
"type": "dateFormat",
"attributes": {
"inputFormat": "yyyy-MM-ddâTâHH:mm",
"outputFormat": "ISO8601",
"input": {
"attributes": {
"input": {
"type": "firstValid",
"attributes": {
"ignoreErrors": "true",
"values": [
{
"attributes": {
"input": {
"attributes": {
"name": "zinactivedate"
},
"type": "identityAttribute"
},
"inputFormat": "yyyy-MM-dd",
"outputFormat": "ISO8601"
},
"type": "dateFormat"
},
"now"
]
}
},
"expression": "+7d/d",
"roundUp": false
},
"type": "dateMath"
}
}
}
},
"type": "dateCompare"
},
"value": "#if($isdeltelig == âyesâ)delete#{else}inactive#end"
}
}
@rsobar -The inputFormat must follow the same format used in zinactivedate. If youâve implemented the transform I shared earlier, then the expected format in zinactivedatewould be yyyy-MM-dd'T'HH:mm:ss.SSSSSSS
@rpriya I have adjusted it, but it still shows an error.
@rsobar The transform works for me, you might have to troubleshoot it on your end. Also, ensure youâve selected Apply Changes on the identity profileâif itâs still in Preview mode, the calculated value wonât actually populate the identity attributes