Search for accounts with inactive lifecycle state but active in Source

Identity Security Cloud (ISC) ISC Discussion and Questions
1

I am looking for some Search assistance. I am trying to write a search query that will return identities who are in the inactive lifecycle states but, remain active in a source. I’ve attempted a few different iterations but the results are not what I’m reaching for.

Example: Employee has been disabled in active directory but, has become enabled manually after the event has taken place. I would like to know that their cloud lifecycle state is inactive but, there is an account within the active directory source enabled.

Search Query: attributes.cloudLifecycleState:INACTIVE AND source.name:“WakeMedAD” AND accounts.source.name:“WakeMedAD” AND accounts.disabled:false

2

attributes.cloudLifecycleState:INACTIVE AND @accounts(source.name:“Active Directory” AND disabled:false)

1 Like
3

Hi @jackeeturner

Please check the below search query.

attributes.cloudLifecycleState:INACTIVE AND @accounts(source.name:“WakeMedAD” AND disabled:false)

the below search works fine in my tenant where source name is: Active Directory

attributes.cloudLifecycleState:INACTIVE AND @accounts(source.name:“Active Directory” AND disabled:false)

1 Like
4

Thank you so much! This worked perfectly :slight_smile:

5

Thank you so much! I really appreciate your response to this.

6

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.