# Need a search query for newly assigned role to a user **URL:** \ **Category:** SHF Discussion and Questions\ **Tags:** identity-security-cloud\ **Created:** [October 29, 2025, 2:24pm UTC](https://developer.sailpoint.com/discuss/t/need-a-search-query-for-newly-assigned-role-to-a-user/186707 "2025-10-29T14:24:08Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![Rakesh\_Singh\_1234](https://avatars.discourse-cdn.com/v4/letter/r/3be4f8/32.png) [@Rakesh\_Singh\_1234](https://developer.sailpoint.com/discuss/u/Rakesh_Singh_1234)\ **Post date:** [October 29, 2025, 2:24pm UTC](https://developer.sailpoint.com/discuss/t/need-a-search-query-for-newly-assigned-role-to-a-user/186707/1 "2025-10-29T14:24:08Z")
I need a query for below requirement : ![image](https://global.discourse-cdn.com/sailpoint/original/3X/1/6/16ea1891dea1ad494b23df3d9764fb5c2e55eca9.png) ---
**Author:** ![chintum136](https://avatars.discourse-cdn.com/v4/letter/c/eada6e/32.png) [@chintum136](https://developer.sailpoint.com/discuss/u/chintum136)\ **Post date:** [October 29, 2025, 3:31pm UTC](https://developer.sailpoint.com/discuss/t/need-a-search-query-for-newly-assigned-role-to-a-user/186707/2 "2025-10-29T15:31:07Z")
Hi @Rakesh_Singh_1234 Can you go through the below documentation having audit events search query present inside it help implement your search query. > **[Search Overview - SailPoint Identity Services](https://documentation.sailpoint.com/saas/help/search/index.html)** > > SailPoint Identity Services Documentation ---
**Author:** ![sidharth\_tarlapally](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/sidharth_tarlapally/32/26178_2.png) [@sidharth\_tarlapally](https://developer.sailpoint.com/discuss/u/sidharth_tarlapally)\ **Post date:** [October 29, 2025, 4:39pm UTC](https://developer.sailpoint.com/discuss/t/need-a-search-query-for-newly-assigned-role-to-a-user/186707/3 "2025-10-29T16:39:01Z")
Hi @Rakesh_Singh_1234 This query will return the events of role changes that occurred in last 30 minutes : `technicalName:"ROLE_UPDATE_PASSED" AND created:[now-30m TO now]` The target column in the resulted events is the name of the role. ![image](https://global.discourse-cdn.com/sailpoint/original/3X/c/7/c726eb51736c51b0e41c47170b82dbe3ca41046d.png) Thanks Sid ---
**Author:** ![Rakesh\_Singh\_1234](https://avatars.discourse-cdn.com/v4/letter/r/3be4f8/32.png) [@Rakesh\_Singh\_1234](https://developer.sailpoint.com/discuss/u/Rakesh_Singh_1234)\ **Post date:** [October 30, 2025, 7:16am UTC](https://developer.sailpoint.com/discuss/t/need-a-search-query-for-newly-assigned-role-to-a-user/186707/4 "2025-10-30T07:16:30Z")
hey thanks @sidharth_tarlapally You mean this will give us role change by role change you mean new role assigned to a user or removed from user? ---
**Author:** ![UjjwalJain](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/ujjwaljain/32/24704_2.png) [@UjjwalJain](https://developer.sailpoint.com/discuss/u/UjjwalJain)\ **Post date:** [October 30, 2025, 10:08am UTC](https://developer.sailpoint.com/discuss/t/need-a-search-query-for-newly-assigned-role-to-a-user/186707/5 "2025-10-30T10:08:52Z")
Hi @Rakesh_Singh_1234 You can use a query like the one below: @accountRequests(attributeRequests.op:“Add” AND attributeRequests.name:“assignedRoles” AND attributeRequests.value:“ROLE\_NAME” AND source.name:“IdentityNow”) AND created:[now-30d TO now] ---
**Author:** ![Rakesh\_Singh\_1234](https://avatars.discourse-cdn.com/v4/letter/r/3be4f8/32.png) [@Rakesh\_Singh\_1234](https://developer.sailpoint.com/discuss/u/Rakesh_Singh_1234)\ **Post date:** [October 30, 2025, 10:14am UTC](https://developer.sailpoint.com/discuss/t/need-a-search-query-for-newly-assigned-role-to-a-user/186707/6 "2025-10-30T10:14:35Z")
> [@UjjwalJain](#): > > @accountRequestsaccountRequests(attributeRequests.op:“Add” AND attributeRequests.name:“assignedRoles” AND attributeRequests.value:“ROLE\_NAME” AND source.name:“IdentityNow”) AND created:[now-30d TO now] i am not getting anything when i searched that query ---
**Author:** ![UjjwalJain](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/ujjwaljain/32/24704_2.png) [@UjjwalJain](https://developer.sailpoint.com/discuss/u/UjjwalJain)\ **Post date:** [October 30, 2025, 10:32am UTC](https://developer.sailpoint.com/discuss/t/need-a-search-query-for-newly-assigned-role-to-a-user/186707/7 "2025-10-30T10:32:16Z")
Hi @Rakesh_Singh_1234 @accountRequests(attributeRequests.op:“Add” AND attributeRequests.name:“assignedRoles” AND attributeRequests.value:“ROLE\_NAME” AND source.name:“IdentityNow”) AND created:[now-30d TO now] Please update **ROLE\_NAME** in above query as per requirement or use below query if you want to get result for all roles: @accountRequests(attributeRequests.op:“Add” AND attributeRequests.name:“assignedRoles” AND source.name:“IdentityNow”) AND created:[now-30d TO now] ---
**Author:** ![sidharth\_tarlapally](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/sidharth_tarlapally/32/26178_2.png) [@sidharth\_tarlapally](https://developer.sailpoint.com/discuss/u/sidharth_tarlapally)\ **Post date:** [October 30, 2025, 11:51am UTC](https://developer.sailpoint.com/discuss/t/need-a-search-query-for-newly-assigned-role-to-a-user/186707/8 "2025-10-30T11:51:58Z")
, No , this will provide events related to changes made to a role, such as: - Role name updates - Description changes - Entitlements or access profiles being added or removed Based on your stated requirement, this should meet your need. Please let me know if this isn’t what you were referring to. ---
**Author:** ![UjjwalJain](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/ujjwaljain/32/24704_2.png) [@UjjwalJain](https://developer.sailpoint.com/discuss/u/UjjwalJain)\ **Post date:** [December 23, 2025, 4:42pm UTC](https://developer.sailpoint.com/discuss/t/need-a-search-query-for-newly-assigned-role-to-a-user/186707/9 "2025-12-23T16:42:14Z")
Hi @Rakesh_Singh_1234, Have you tried using this query ? ---
**Author:** ![agoyal27](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/agoyal27/32/41747_2.png) [@agoyal27](https://developer.sailpoint.com/discuss/u/agoyal27)\ **Post date:** [January 14, 2026, 5:26pm UTC](https://developer.sailpoint.com/discuss/t/need-a-search-query-for-newly-assigned-role-to-a-user/186707/10 "2026-01-14T17:26:58Z")
Hi @Rakesh_Singh_1234 , You can look for the technical name if you are looking for a specific type of event. else, you can paste the role name in double inverted commas “role name” and it will give you all events in search. Inorder to receive it periodically, sailpoint allows daily schedule of one hours with UI. Hope it helps. Kind regards, Aayush ---
**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\ **Post date:** [March 15, 2026, 5:27pm UTC](https://developer.sailpoint.com/discuss/t/need-a-search-query-for-newly-assigned-role-to-a-user/186707/11 "2026-03-15T17:27:56Z")
This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.