Reusing Microsoft Entra groupFilter in a Native Change Detection workflow filter (extension attribute)

Hi everyone,

we’re working on a SailPoint IdentityNow deployment where we integrate a Microsoft Entra ID tenant through the source:

Source name: acme - Sandbox - Microsoft Entra ID

On this source we’ve configured group scoping using groupFilters and groupMembershipFilters so that we only aggregate a subset of Entra groups, based on a custom extension attribute:

groupFilters: (ext0c65sc8o_igaEntitlement/igaEntitlement eq true)
groupMembershipFilters: (ext0c65sc8o_igaEntitlement/igaEntitlement eq true)

This means that only groups where the extension attribute ext0c65sc8o_igaEntitlement/igaEntitlement is true are brought into IdentityNow as entitlements.

We also have a Native Change Detection workflow:

Workflow name: Acme - Native Change Detection - Notifica modifica gruppi (Acme - Sandbox - Microsoft Entra ID)

Trigger: idn:native-change-account-updated

The trigger currently uses a filter.$ expression that:

  • limits the events to a specific source id,

  • checks for ENTITLEMENTS_ADDED / ENTITLEMENTS_REMOVED on the groups attribute, and

  • finally filters by group name using a regex over a list of prefixes

This works, but it’s not ideal: the list of prefixes is hard-coded in the workflow, whereas the “real” functional rule that should define the interesting groups is the Entra extension attribute (igaEntitlement == true) which we are already using in the connector’s groupFilters.

What I would like to do is to:

  • stop relying on regex over group names in the workflow, and

  • instead reuse the same condition we have in the connector: (ext0c65sc8o_igaEntitlement/igaEntitlement eq true)

My questions for the community:

  1. Has anyone successfully referenced Microsoft Entra extension attributes for groups within the idn:native-change-account-updated event payload and then used them in the workflow filter.$ JSONPath?

  2. Do the Native Change Detection events for group membership changes actually contain the extension attribute ext0c65sc8o_igaEntitlement/igaEntitlement (or the mapped entitlement attribute on the group object) so that we can filter on it in the workflow?

  3. Is there any supported way to “reuse” or align the source’s groupFilters / groupMembershipFilters with the workflow trigger filter, so we don’t end up maintaining two sets of scoping logic (connector filter vs. regex on names)?

  4. If this is not currently possible, what patterns / best practices are you using to keep:

    • the set of groups that are aggregated, and

    • the set of group changes that fire NCD workflows
      in sync over time?

I’m basically trying to understand whether I’m missing a cleaner way to do this with extension attributes, or if relying on naming conventions and regex in the workflow filter is still the recommended approach.

Any insights, examples, or confirmation from your own implementations would be really appreciated.

Thanks!

Please find below the Acme - Sandbox - Microsoft Entra ID json:

{
        "description": "Sistema target integrazione Microsoft Entra ID acme",
        "owner": {
            "type": "IDENTITY",
            "id": "48b91e90b85e4e85bf88574c6d16f051",
            "name": "SailPoint Services"
        },
        "cluster": {
            "type": "CLUSTER",
            "id": "5851f45690f244c8b6d31d6965ba62d7",
            "name": "sp_connect_proxy_cluster"
        },
        "accountCorrelationConfig": {
            "type": "ACCOUNT_CORRELATION_CONFIG",
            "id": "3d5ad3a2c434447eb7f989a7fa5606ec",
            "name": "acme - Sandbox - Microsoft Entra ID [source] Account Correlation"
        },
        "accountCorrelationRule": null,
        "managerCorrelationMapping": null,
        "managerCorrelationRule": null,
        "beforeProvisioningRule": null,
        "schemas": [
            {
                "configuration": {},
                "type": "CONNECTOR_SCHEMA",
                "id": "ce4641125b35496ca54ecf52055aba03",
                "name": "account"
            },
            {
                "configuration": {},
                "type": "CONNECTOR_SCHEMA",
                "id": "bcc24df54ccb48e6b8243b772991b67d",
                "name": "group"
            },
            {
                "configuration": {},
                "type": "CONNECTOR_SCHEMA",
                "id": "53b1474a50154e93b6b6cdcd23a68743",
                "name": "applicationRole"
            }
        ],
        "passwordPolicies": null,
        "features": [
            "PASSWORD",
            "ENABLE",
            "AUTHENTICATE",
            "AI_AGENT_AGGREGATION",
            "APPLICATION_DISCOVERY",
            "DELETE",
            "PROVISIONING"
        ],
        "type": "2631a78f-e9b0-4a59-859f-f37f3e549d9f",
        "connector": "Microsoft-Entra",
        "connectorClass": "",
        "connectorAttributes": {
            "healthCheckTimeout": 60,
            "channelFilter": null,
            "groupsDeltaToken": "jZ7CqON7QqYpS8Zo-RjjKwwcNNlWgs4Nm5Z2o96q6nkWw2cwLjEamJ9L7cmLr_ICc6U88TeIYW44WT_8TWfqCC8MPI6UqmvFdhn6hha7OV10FQ9pg7p7LEMD8iKVasRfrF8V271fg_8X4bMqbAp4vM5ccnqFkyusiDt4bxE3i5HxEwZ17_Q2sZ_CGOJ0KGhPqQabGN7AzO2OGCuR7YLHTPM_AkZteulUPI9hOVYQfBSYIp1-rB5leIodd5nT2koHtHLvet5GsuH0WFSDZwM_TLP7GyffmKKHsCYsoJik_dl8XwJ5fu-ushAVQoHnfjpxWB0kpeliXHdqtH_Ud0R9uQEYA4SRd4BSkZTtDCVlCJUXxI6iGVpIHSJldn98Kmi4kXs45J1wp_m2K6y5SC8Sj0R9EJ7ItRjPLrcSYh3d489qBpLtswYUUz3Vnf1VHrVU_ADRLomQKh3uxtIpreMA_0zpzU5AsGFJRHQHLIC4I_GAabbRNdp29wbhk-YVIn-KRYxeVgrlgkaL7qqsEWxnciJaHsbSKoZbsWjpQpks6a0Y_lrG9gPt9Uj38j9R6NeuISsN_yy_FPRJBbLxKfotH68qOvUEGFdDWu9F0oZBvT9_eFbi8YKmlplczM2B-8F7f861i0E-43NxvOkU_xp95_a9UhgT0sVtOTqHy6mY-Kfpk3OpijSPjQtWZIs0njdFbU2GQ2cbm-HvL3TZKr4wBPA4mLVm2dfBNxzgcmiC2SRny31kl7tgiRKP4BbLcZeBTXMw7gLtQZiRozxNgnlvG8jGaRxmXtWpzYgILk6dDHm3agiCtNJUl6VBUPDtyHmsg46q0op-WZT5utFfp311U1J-hyIqMeCgTyd4QJJlUjuB6z4vXDjE32rwlOkwNDlEkv8IDgTuRqRoxgvWpJR9RyqPIyGhrE3HnvQQdVOJxXgWJQ7nHkrttH84oMmQYvJL2Rj_nG-I3_0BQzr72XWS52ZLCaZ8C_6zAhTdPpfFRfhou2wJHXsu4tBGzHj_ZYRh89id1hrUCtHnh2IGJ_s_ku_JbfRoyE8HyNoQi4DGHtGgsO_ESmuTg95wztuvLa9Q3xDTc5LMXGeMydjLZ8PsI-nmrYmE_leq-S4PI0msOeRSEMcoZ9NZ_N7Tq11vEb1sSJvhQ1jpNLcWsYcyAxnmPpqBILMsLPKi5m4eZLEa0zaGNKTpIp5r5J9xPgu4BK5u2xFxyhHgNvaWBDXgXP0x8lQ-h7txT1w51yWvBLgn-FO7tv2a-MVauUcNjdSQFzuMfqkdXHVbXDRTIhOSsRN9VjUnQIy9PGzi6sDCED_iHOQK3OTEw6tSefPhAZHwT-1JAi9PK9aXrCtNbD2LqOoLaiq_MinH5Tab620tAS8jZU9TPKT3z7_W4X5tC6aDOrE_pNyoncNwFaMItBIjBBBTRCyq0hZC-M6N3_nA4cla011602XloBD0HUaLrrwuYtL4FtozDT9clJTj7u-dptga0eSslnre0N0CqMPMKnWtASdtW65gk9mNiWzOkdLitPWNWek3SbNDQHATTmFmQl3DUQRKebXWcT24Q1K-MT4fr7eenUX1yDah0hSMn-SfSV8b8y5k7SewG-w3wBTahimgRVk7onm2JUS-NgizCutHI5hI-FsMRBHUtZGdwtkpmJWmOKWbaeVImvlJpnCmO21fVTH-wqQhPGLGM0FzZT5naE0OWpMCRaE2zBmz0CJ0J5_wlKL7kmxNl-jcRB18RgFJFRegaqtJG3QxmDC03vHtNugKbD_UaOrKzfXgaJ4tMgezog7fsu1VzWYwJ37BUJ5WSJXHpcYhd3Qt8TAvOPEWya-e8Ih1fLB40zQcKrIEgbz16SMubbS3BuDzRF2jzTY0Np8FL-VxwiEbmWJe5A74ZU0S4pwvAMBKUSLyz-mTFHI1XpWsxSytr4Cxbc57nQmScAY_RWJRWeH1Z19vYp3-FKIh-gN0W-McbHkFdusdPrUJETdRZ4YNox7IjpPVb3uoB45HQ6cJDD9ZcSMazU3OL90BF7O_zBlnrPIzZMmz8c_bIvkqZQuoqXBXT_s4SX2Yel3bTMOB8HSpAQOxsAxUFD3kfZBvJnHm-yurg32XsnxkGfiwiG2YB22_6-n6QkSxYXGPY-0s_POS84jkPYiIzainpGHbbFyk165pHRXxokgN2LFMDd_a0So5HcshiJLJn66e1RIJTIdHZuSN3s6lMKaAhZcBok-PlFnZnfCahggRbo3j3v9MGkUjXEA5NjgoQ-OET_yLvDhdylZfXIDcI_MTrBxR0QeKESelauVwt48acewuEiBtA2i8_WoL6LpgVfKnMl06mGWRKM8xblyGwj_gQOZPpjnKMSiuFyUmGzU9.Eqc5G1cW2Gs5HK0I2z9uWwm7mr4L_cblGlceD5rJoWM",
            "idnProxyType": "sp-connect",
            "clientCertificate": null,
            "clientID": "e276898f-4ad6-418b-b683-440b6fb82672",
            "deltaAggregationEnabled": false,
            "mailContactFilter": null,
            "pageSize": "100",
            "manageAdminConsentedPermissions": null,
            "checkDeletedDisabled": true,
            "connectionType": "direct",
            "exoAuthenticationType": null,
            "spnAccountFilter": null,
            "spConnectorInstanceId": "00fbd0f9-e8ef-4dbb-8d01-3859f7538864",
            "enableProvisioningFeature": true,
            "appTemplateData": "{\"whiteListedAttributes\":[\"enableProvisioningFeature\"]}",
            "userDeltaToken": "",
            "clientSecret": "\"}",
            "isCaeEnabled": false,
            "aggregateHiddenAccessPackages": null,
            "spnManageAzureADPIM": null,
            "aggregateAllGroups": true,
            "aggregateGroupHierarchy": false,
            "manageO365Groups": true,
            "sourceConnected": true,
            "userFilters": null,
            "directoryRolesDeltaToken": "",
            "enableAdministrativeUnits": false,
            "enableManagedIdentityManagement": false,
            "private_key": null,
            "slpt-source-diagnostics": "{\"connector\":\"Microsoft-Entra\",\"status\":\"SOURCE_STATE_HEALTHY\",\"healthy\":true,\"healthcheckDisabled\":false,\"healthcheckCount\":39,\"lastHealthcheck\":1765267973785,\"statusChanged\":1764634521387}",
            "formPath": null,
            "refresh_token": null,
            "cloudCacheUpdate": 1764951441929,
            "privateKeyPassword": null,
            "domainName": "contoso.onmicrosoft.com",
            "connectorName": "Microsoft Entra",
            "spnManageAppRoles": null,
            "grantType": "CLIENT_CREDENTIALS",
            "since": "2025-12-02T00:15:21.387Z",
            "status": "SOURCE_STATE_HEALTHY",
            "groupFilters": "(ext0c65sc8o_igaEntitlement/igaEntitlement eq true)",
            "spConnectorSupportsCustomSchemas": "true",
            "supportsAdvancedGroupFilter": true,
            "supportsDeltaAgg": "true",
            "enableTeamsGovernance": false,
            "exchangeUserName": null,
            "enablePIM": false,
            "enableAccessPackageManagement": false,
            "azureRolesFilter": null,
            "recommendationStatus": null,
            "hasFullAggregationCompleted": true,
            "deltaAggregation": [
                "std:account:list"
            ],
            "manageAzureServicePrincipalAsAccount": false,
            "manageExchangeOnline": false,
            "spnManageAzurePIM": null,
            "exchangeCertificate": null,
            "spnManageGroups": null,
            "exchangeUserPassword": null,
            "directoryRolesFilter": null,
            "spConnectorSpecId": "2631a78f-e9b0-4a59-859f-f37f3e549d9f",
            "deleteThresholdPercentage": 100,
            "supportsStatefulCommands": "true",
            "spnManageDirectoryRole": null,
            "templateApplication": "Microsoft Entra",
            "encrypted": "clientSecret, clientCertificate, privateKeyPassword, private_key, refresh_token, exchangeUserPassword",
            "healthy": true,
            "spnManageRBACRoles": null,
            "supportsAdvancedAccountFilter": false,
            "cloudDisplayName": "acme - Sandbox - Microsoft Entra ID",
            "groupMembershipFilters": "(ext0c65sc8o_igaEntitlement/igaEntitlement eq true)",
            "azureADRolesFilter": null,
            "exchangeCertificatePassword": null,
            "enableSystemAssignedManagedIdentity": false,
            "beforeProvisioningRule": null,
            "enableMailContactGovernance": null
        },
        "deleteThreshold": 100,
        "authoritative": false,
        "healthy": true,
        "status": "SOURCE_STATE_HEALTHY",
        "since": "2025-12-02T00:15:21.387Z",
        "connectorId": "Microsoft-Entra",
        "connectorName": "Microsoft Entra",
        "connectionType": "direct",
        "connectorImplementationId": "Microsoft-Entra",
        "managementWorkgroup": null,
        "credentialProviderEnabled": false,
        "category": null,
        "accountsFile": null,
        "id": "fdb57b6827e24201a8c241935f5aca85",
        "name": "acme - Sandbox - Microsoft Entra ID",
        "created": "2025-10-06T09:41:20.552Z",
        "modified": "2025-12-09T08:12:53.800Z"
    }

and the workflow json

{
        "description": "Sistema target integrazione Microsoft Entra ID acme",
        "owner": {
            "type": "IDENTITY",
            "id": "48b91e90b85e4e85bf88574c6d16f051",
            "name": "SailPoint Services"
        },
        "cluster": {
            "type": "CLUSTER",
            "id": "5851f45690f244c8b6d31d6965ba62d7",
            "name": "sp_connect_proxy_cluster"
        },
        "accountCorrelationConfig": {
            "type": "ACCOUNT_CORRELATION_CONFIG",
            "id": "3d5ad3a2c434447eb7f989a7fa5606ec",
            "name": "acme - Sandbox - Microsoft Entra ID [source] Account Correlation"
        },
        "accountCorrelationRule": null,
        "managerCorrelationMapping": null,
        "managerCorrelationRule": null,
        "beforeProvisioningRule": null,
        "schemas": [
            {
                "configuration": {},
                "type": "CONNECTOR_SCHEMA",
                "id": "ce4641125b35496ca54ecf52055aba03",
                "name": "account"
            },
            {
                "configuration": {},
                "type": "CONNECTOR_SCHEMA",
                "id": "bcc24df54ccb48e6b8243b772991b67d",
                "name": "group"
            },
            {
                "configuration": {},
                "type": "CONNECTOR_SCHEMA",
                "id": "53b1474a50154e93b6b6cdcd23a68743",
                "name": "applicationRole"
            }
        ],
        "passwordPolicies": null,
        "features": [
            "PASSWORD",
            "ENABLE",
            "AUTHENTICATE",
            "AI_AGENT_AGGREGATION",
            "APPLICATION_DISCOVERY",
            "DELETE",
            "PROVISIONING"
        ],
        "type": "2631a78f-e9b0-4a59-859f-f37f3e549d9f",
        "connector": "Microsoft-Entra",
        "connectorClass": "",
        "connectorAttributes": {
            "healthCheckTimeout": 60,
            "channelFilter": null,
            "groupsDeltaToken": "",
            "idnProxyType": "sp-connect",
            "clientCertificate": null,
            "clientID": "e276898f-4ad6-418b-b683-440b6fb82672",
            "deltaAggregationEnabled": false,
            "mailContactFilter": null,
            "pageSize": "100",
            "manageAdminConsentedPermissions": null,
            "checkDeletedDisabled": true,
            "connectionType": "direct",
            "exoAuthenticationType": null,
            "spnAccountFilter": null,
            "spConnectorInstanceId": "00fbd0f9-e8ef-4dbb-8d01-3859f7538864",
            "enableProvisioningFeature": true,
            "appTemplateData": "{\"whiteListedAttributes\":[\"enableProvisioningFeature\"]}",
            "userDeltaToken": "",
            "clientSecret": "\"}",
            "isCaeEnabled": false,
            "aggregateHiddenAccessPackages": null,
            "spnManageAzureADPIM": null,
            "aggregateAllGroups": true,
            "aggregateGroupHierarchy": false,
            "manageO365Groups": true,
            "sourceConnected": true,
            "userFilters": null,
            "directoryRolesDeltaToken": "",
            "enableAdministrativeUnits": false,
            "enableManagedIdentityManagement": false,
            "private_key": null,
            "slpt-source-diagnostics": "{\"connector\":\"Microsoft-Entra\",\"status\":\"SOURCE_STATE_HEALTHY\",\"healthy\":true,\"healthcheckDisabled\":false,\"healthcheckCount\":39,\"lastHealthcheck\":1765267973785,\"statusChanged\":1764634521387}",
            "formPath": null,
            "refresh_token": null,
            "cloudCacheUpdate": 1764951441929,
            "privateKeyPassword": null,
            "domainName": "contoso.onmicrosoft.com",
            "connectorName": "Microsoft Entra",
            "spnManageAppRoles": null,
            "grantType": "CLIENT_CREDENTIALS",
            "since": "2025-12-02T00:15:21.387Z",
            "status": "SOURCE_STATE_HEALTHY",
            "groupFilters": "(ext0c65sc8o_igaEntitlement/igaEntitlement eq true)",
            "spConnectorSupportsCustomSchemas": "true",
            "supportsAdvancedGroupFilter": true,
            "supportsDeltaAgg": "true",
            "enableTeamsGovernance": false,
            "exchangeUserName": null,
            "enablePIM": false,
            "enableAccessPackageManagement": false,
            "azureRolesFilter": null,
            "recommendationStatus": null,
            "hasFullAggregationCompleted": true,
            "deltaAggregation": [
                "std:account:list"
            ],
            "manageAzureServicePrincipalAsAccount": false,
            "manageExchangeOnline": false,
            "spnManageAzurePIM": null,
            "exchangeCertificate": null,
            "spnManageGroups": null,
            "exchangeUserPassword": null,
            "directoryRolesFilter": null,
            "spConnectorSpecId": "2631a78f-e9b0-4a59-859f-f37f3e549d9f",
            "deleteThresholdPercentage": 100,
            "supportsStatefulCommands": "true",
            "spnManageDirectoryRole": null,
            "templateApplication": "Microsoft Entra",
            "encrypted": "clientSecret, clientCertificate, privateKeyPassword, private_key, refresh_token, exchangeUserPassword",
            "healthy": true,
            "spnManageRBACRoles": null,
            "supportsAdvancedAccountFilter": false,
            "cloudDisplayName": "acme - Sandbox - Microsoft Entra ID",
            "groupMembershipFilters": "(ext0c65sc8o_igaEntitlement/igaEntitlement eq true)",
            "azureADRolesFilter": null,
            "exchangeCertificatePassword": null,
            "enableSystemAssignedManagedIdentity": false,
            "beforeProvisioningRule": null,
            "enableMailContactGovernance": null
        },
        "deleteThreshold": 100,
        "authoritative": false,
        "healthy": true,
        "status": "SOURCE_STATE_HEALTHY",
        "since": "2025-12-02T00:15:21.387Z",
        "connectorId": "Microsoft-Entra",
        "connectorName": "Microsoft Entra",
        "connectionType": "direct",
        "connectorImplementationId": "Microsoft-Entra",
        "managementWorkgroup": null,
        "credentialProviderEnabled": false,
        "category": null,
        "accountsFile": null,
        "id": "fdb57b6827e24201a8c241935f5aca85",
        "name": "acme - Sandbox - Microsoft Entra ID",
        "created": "2025-10-06T09:41:20.552Z",
        "modified": "2025-12-09T08:12:53.800Z"
   }

When you look at the sample JSON from the Account Updated Native Change, you’ll see why what you want to do is a challenge on the workflow trigger filter. You likely already know this since you’ve implemented a regex filter

{
  "identity": {
    "manager": {
      "name": "Martena Heath",
      "id": "2c91808378eb9fa30178fb8caf90097f",
      "type": "IDENTITY",
      "email": "martena.heath@sample_email.com"
    },
    "name": "Ann English",
    "alias": "Ann.English",
    "id": "2c91808978eb9fab0178fb8ca6d308fb",
    "type": "IDENTITY",
    "email": "ann.english@sample_email.com"
  },
  "singleValueAttributeChanges": [
    {
      "newValue": "Call Center Representative",
      "name": "title",
      "oldValue": "Call Center Manager"
    }
  ],
  "entitlementChanges": [
    {
      "removed": [
        {
          "owner": null,
          "name": "AccountsReceivable",
          "id": "d0470502d73d4c2e8c7543c712f518ca",
          "value": "CN=AccountsReceivable,OU=Groups,OU=Demo,DC=seri,DC=sailpointdemo,DC=com"
        }
      ],
      "added": [
        {
          "owner": null,
          "name": "Accounts Payable",
          "id": "2c91808978eb9fab0178fb9482620b71",
          "value": "CN=AccountsPayable,OU=Groups,OU=Demo,DC=seri,DC=sailpointdemo,DC=com"
        }
      ],
      "attributeName": "memberOf"
    }
  ],
  "eventType": "ACCOUNT_UPDATED",
  "source": {
    "owner": {
      "name": "Aaron Andrew",
      "id": "2c9180867a7c46d0017a7ca099d50531",
      "type": "IDENTITY",
      "email": "aaron.andrew@sample_email.com"
    },
    "name": "Active Directory",
    "alias": "Active Directory [source]",
    "id": "2c91808a78efc63e0178fb8624b248c5",
    "type": "SOURCE",
    "governanceGroup": {
      "id": "fd0d1393-35fb-47d8-9809-0e385b73f25e",
      "name": "Active Directory Owners",
      "type": "GOVERNANCE_GROUP"
    }
  },
  "accountChangeTypes": [
    "ATTRIBUTES_CHANGED",
    "ENTITLEMENTS_ADDED",
    "ENTITLEMENTS_REMOVED"
  ],
  "multiValueAttributeChanges": [
    {
      "removedValues": [],
      "addedValues": ["User Account is Disabled"],
      "name": "accountFlags"
    }
  ],
  "account": {
    "name": "Ann.English",
    "id": "2c91808378eb9fa30178fb9481a30afa",
    "type": "ACCOUNT",
    "uuid": "{08ee6c6d-7d02-4978-9417-d92ba6a5ed50}",
    "correlated": true,
    "nativeIdentity": "CN=Ann English,OU=Call Center,OU=AI,OU=Demo,DC=seri,DC=sailpointdemo,DC=com"
  }
}

As you can see, there are a limited amount of attributes sent by the trigger - specifically, no entitlement attributes. Since this is an account change, it’s only going to tell you what attribute changed and the value of that attribute. At the end of the day, the trigger filtering is only a text filter and can only filter based on text it is presented.

If you want to not use hard-coded regex in the filter, you’ll most likely have to

Get the value of the extension attribute on the group. You can get that by using the $.entitlementChanges[ *].added/removed[ *].value where the attributeName is the type of group then take that value and use the HTTP Request action to call the Graph endpoint.

If by chance you are storing this extension attribute on the entitlement within ISC, then you can change the Graph API call to a ISC API call to the /entitlements/:id endpoint.

Once you have that attribute value, you’ll have to use a comparison operator to determine whether it’s true or false. If it’s false, then you just end the workflow. If it’s true, then you perform whatever steps you wish to perform.

As a result of this, you’ll end up with more workflow executions since you’re not filtering on the trigger side, since you can’t. It does, however, get you away from a hard-coded regex value you’d have to periodically update.

1 Like

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.