# Understanding identityLifecycleEvent vs IdentityStateChange Events

**URL:** <https://developer.sailpoint.com/discuss/t/understanding-identitylifecycleevent-vs-identitystatechange-events/213733>\
**Category:** SHF Discussion and Questions\
**Tags:** search, sailpoint-identity-security\
**Created:** [June 16, 2026, 2:55pm UTC](https://developer.sailpoint.com/discuss/t/understanding-identitylifecycleevent-vs-identitystatechange-events/213733 "2026-06-16T14:55:26Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![nadhikari\_identitynow](https://avatars.discourse-cdn.com/v4/letter/n/958977/32.png) [@nadhikari\_identitynow](https://developer.sailpoint.com/discuss/u/nadhikari_identitynow)\
**Post date:** [June 16, 2026, 2:55pm UTC](https://developer.sailpoint.com/discuss/t/understanding-identitylifecycleevent-vs-identitystatechange-events/213733/1 "2026-06-16T14:55:26Z")

</div>

**Understanding Search Results for Lifecycle Change Events**

Hello Everyone,

I have a search subscription which is basically to monitor all the termination events as part of termination process:

`created:[now-2d TO now] AND name:"Change Identity State%" AND attributes.oldState:"active" AND attributes.newState:"inactive"`

This basically gives all the events in last 2 days where lifecycle status has changed from active to inactive. Or at least that is what we thought.

However, we noticed some identities terminated during that time were not listed who also moved from active to inactive. Looking at the list of events, those identities didn’t have “`Change Identity State%`” events. They had “`Change Identity Lifecycle%`” instead.

Further looking into this, the event types( **IdentityStateChange** vs **identityLifecycleEvent** ) were different and the interface( **Cloud Lifecycle Change** vs **Business Process** ) was different too. Also, actor is different in both cases.

So, I am trying to understand why we have one vs other in the Identities that are terminated on same day and both moved from active to inactive.

In both cases, our regular termination flow were followed and all accounts were disabled.

Any pointer would be highly appreciated.

Thanks,

Nischal

---

<div class="post-metadata">

**Author:** ![UjjwalJain](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/ujjwaljain/32/24704_2.png) [@UjjwalJain](https://developer.sailpoint.com/discuss/u/UjjwalJain)\
**Post date:** [June 16, 2026, 4:41pm UTC](https://developer.sailpoint.com/discuss/t/understanding-identitylifecycleevent-vs-identitystatechange-events/213733/2 "2026-06-16T16:41:27Z")

</div>

Hi @nadhikari_identitynow,

If your requirement is to get all termination events you can frame a similar query as below.

action:“Cloud Automated \<any/terminated LCS name here\>” AND created:[now-2d TO now]

---

<div class="post-metadata">

**Author:** ![nadhikari\_identitynow](https://avatars.discourse-cdn.com/v4/letter/n/958977/32.png) [@nadhikari\_identitynow](https://developer.sailpoint.com/discuss/u/nadhikari_identitynow)\
**Post date:** [June 16, 2026, 4:57pm UTC](https://developer.sailpoint.com/discuss/t/understanding-identitylifecycleevent-vs-identitystatechange-events/213733/3 "2026-06-16T16:57:27Z")

</div>

Hi Ujjwal,

This is helpful. Thank you.

Thanks,  
Nischal

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\
**Post date:** [August 15, 2026, 4:57pm UTC](https://developer.sailpoint.com/discuss/t/understanding-identitylifecycleevent-vs-identitystatechange-events/213733/4 "2026-08-15T16:57:37Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.