# Track approved access requests that failed during provisioning

**URL:** <https://developer.sailpoint.com/discuss/t/track-approved-access-requests-that-failed-during-provisioning/88584>\
**Category:** SHF Discussion and Questions\
**Tags:** audit, access-requests, identity-security-cloud, search\
**Created:** [November 4, 2024, 2:25pm UTC](https://developer.sailpoint.com/discuss/t/track-approved-access-requests-that-failed-during-provisioning/88584 "2024-11-04T14:25:08Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![khalilgahbiche](https://avatars.discourse-cdn.com/v4/letter/k/6de8d8/32.png) [@khalilgahbiche](https://developer.sailpoint.com/discuss/u/khalilgahbiche)\
**Post date:** [November 4, 2024, 2:25pm UTC](https://developer.sailpoint.com/discuss/t/track-approved-access-requests-that-failed-during-provisioning/88584/1 "2024-11-04T14:25:08Z")

</div>

As part of our internal audit controls, we’d like to track approved access requests that failed during provisioning. We’ve made several search queries, but couldn’t find the one that satisfies our need.

Can anyone help us build this report?

Thanks.

---

<div class="post-metadata">

**Author:** ![shekhardas1825](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/shekhardas1825/32/20889_2.png) [@shekhardas1825](https://developer.sailpoint.com/discuss/u/shekhardas1825)\
**Post date:** [November 4, 2024, 2:58pm UTC](https://developer.sailpoint.com/discuss/t/track-approved-access-requests-that-failed-during-provisioning/88584/2 "2024-11-04T14:58:11Z")

</div>

Hi @khalilgahbiche,

You are correct, we do not have much on the search about access requests which will tell you complete lifecycle in a single query, but you can use below search query to find the request which failed to provision after approval:

```auto
"Access Request" AND status:Failure

```

Please check the below document, will help you build your query as per the event (find with Access\_Request):  
[Audit Events in Cloud Audit - Compass](https://community.sailpoint.com/t5/IdentityNow-Wiki/Audit-Events-in-Cloud-Audit/ta-p/218727)

You can also see the below option:  
[get-historical-identity-events | SailPoint Developer Community](https://developer.sailpoint.com/docs/api/beta/get-historical-identity-events/)

Hope this will help!

---

<div class="post-metadata">

**Author:** ![khalilgahbiche](https://avatars.discourse-cdn.com/v4/letter/k/6de8d8/32.png) [@khalilgahbiche](https://developer.sailpoint.com/discuss/u/khalilgahbiche)\
**Post date:** [November 4, 2024, 3:22pm UTC](https://developer.sailpoint.com/discuss/t/track-approved-access-requests-that-failed-during-provisioning/88584/3 "2024-11-04T15:22:48Z")

</div>

Hi @shekhardas1825 ,  
Thank you for your reply. Do you know how we can filter on a specific source?

---

<div class="post-metadata">

**Author:** ![shekhardas1825](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/shekhardas1825/32/20889_2.png) [@shekhardas1825](https://developer.sailpoint.com/discuss/u/shekhardas1825)\
**Post date:** [November 4, 2024, 3:29pm UTC](https://developer.sailpoint.com/discuss/t/track-approved-access-requests-that-failed-during-provisioning/88584/4 "2024-11-04T15:29:07Z")

</div>

@khalilgahbiche You can use below:

```auto
"Access Request" AND status:Failure AND sources:"Active Directory"

```

Replace with your source name.

---

<div class="post-metadata">

**Author:** ![udayputta](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/udayputta/32/14195_2.png) [@udayputta](https://developer.sailpoint.com/discuss/u/udayputta)\
**Post date:** [November 4, 2024, 5:40pm UTC](https://developer.sailpoint.com/discuss/t/track-approved-access-requests-that-failed-during-provisioning/88584/5 "2024-11-04T17:40:05Z")

</div>

You can also try this if you want to  
`@accountRequests(source.name:"Active Directory") AND status:"Failure" AND action:"Access Request"`

---

<div class="post-metadata">

**Author:** ![khalilgahbiche](https://avatars.discourse-cdn.com/v4/letter/k/6de8d8/32.png) [@khalilgahbiche](https://developer.sailpoint.com/discuss/u/khalilgahbiche)\
**Post date:** [November 5, 2024, 9:43am UTC](https://developer.sailpoint.com/discuss/t/track-approved-access-requests-that-failed-during-provisioning/88584/6 "2024-11-05T09:43:37Z")

</div>

Thank you for your answer.

I added the status “Incomplete” as it also shows errors for the source we need to monitor.

The updated request is the following:

> “Access Request” AND (status:Failure OR status:Incomplete) AND sources:“Active Directory”

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\
**Post date:** [January 4, 2025, 9:44am UTC](https://developer.sailpoint.com/discuss/t/track-approved-access-requests-that-failed-during-provisioning/88584/7 "2025-01-04T09:44:25Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.