# Workflow - Can't disable accounts inside a loop

**URL:** <https://developer.sailpoint.com/discuss/t/workflow-cant-disable-accounts-inside-a-loop/64830>\
**Category:** SHF Discussion and Questions\
**Tags:** workflows, identity-security-cloud\
**Created:** [June 10, 2024, 10:47am UTC](https://developer.sailpoint.com/discuss/t/workflow-cant-disable-accounts-inside-a-loop/64830 "2024-06-10T10:47:09Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![rcgalvez](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@rcgalvez](https://developer.sailpoint.com/discuss/u/rcgalvez)\
**Post date:** [June 10, 2024, 10:47am UTC](https://developer.sailpoint.com/discuss/t/workflow-cant-disable-accounts-inside-a-loop/64830/1 "2024-06-10T10:47:09Z")

</div>

We’re trying to do a workflow that finds accounts that belong to a source and searches if they also have an account in AD. If they have an account in AD they must be disabled. But we can’t get the “Manage accounts” to work.

 ![image](https://global.discourse-cdn.com/sailpoint/original/2X/b/b5ebd30a0ef1868410a1af9b216831aac0658b35.png)

---

<div class="post-metadata">

**Author:** ![kavindar\_sharma](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/kavindar_sharma/32/4766_2.png) [@kavindar\_sharma](https://developer.sailpoint.com/discuss/u/kavindar_sharma)\
**Post date:** [June 10, 2024, 11:09am UTC](https://developer.sailpoint.com/discuss/t/workflow-cant-disable-accounts-inside-a-loop/64830/2 "2024-06-10T11:09:43Z")

</div>

Hi @rcgalvez ,

Is there any error message?

---

<div class="post-metadata">

**Author:** ![rcgalvez](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@rcgalvez](https://developer.sailpoint.com/discuss/u/rcgalvez)\
**Post date:** [June 10, 2024, 12:19pm UTC](https://developer.sailpoint.com/discuss/t/workflow-cant-disable-accounts-inside-a-loop/64830/3 "2024-06-10T12:19:12Z")

</div>

No. It’s just sends the mail but doesn’t disable the account.

---

<div class="post-metadata">

**Author:** ![jesvin90](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/jesvin90/32/5301_2.png) [@jesvin90](https://developer.sailpoint.com/discuss/u/jesvin90)\
**Post date:** [June 10, 2024, 1:06pm UTC](https://developer.sailpoint.com/discuss/t/workflow-cant-disable-accounts-inside-a-loop/64830/4 "2024-06-10T13:06:51Z")

</div>

Hi @rcgalvez,

Welcome to the community.

Have you tried something like this in the Manage accounts node to see if it works.?

`$.getAccounts.accounts[*].id`

Or something as below to specifically look for your AD source

`$.getAccounts.accounts[?(@.sourceId=='YOUR AD SOURCE ID')].id`

If you still face issue, it would be helpful if you can upload your whole workflow JSON (removing sensitive info), so that it will be easy to troubleshoot.

---

<div class="post-metadata">

**Author:** ![rcgalvez](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@rcgalvez](https://developer.sailpoint.com/discuss/u/rcgalvez)\
**Post date:** [June 10, 2024, 1:42pm UTC](https://developer.sailpoint.com/discuss/t/workflow-cant-disable-accounts-inside-a-loop/64830/6 "2024-06-10T13:42:16Z")

</div>

Thank you for your answer. I tried both ways and it didn’t help. Here I leave the .json in case anyone can help me.

```auto
{
	"name": "Test 4",
	"description": "No",
	"modified": "2024-06-10T13:32:35.414140146Z",
	"modifiedBy": {
		"type": "IDENTITY",
		"id": "06c1619bb4ad4fa3b793330ced2408fe",
		"name": "rcgalvez"
	},
	"definition": {
		"start": "Get List of Identities",
		"steps": {
			"End Step - Success": {
				"displayName": "",
				"type": "success"
			},
			"Get List of Identities": {
				"actionId": "sp:get-identities",
				"attributes": {
					"inputQuery": "@accounts(source.name:\"Sourcename\")",
					"searchBy": "searchQuery"
				},
				"description": null,
				"displayName": "",
				"nextStep": "Loop",
				"type": "action",
				"versionNumber": 2
			},
			"Loop": {
				"actionId": "sp:loop:iterator",
				"attributes": {
					"context.$": "$",
					"input.$": "$.getListOfIdentities.identities",
					"start": "Get Accounts",
					"steps": {
						"Compare Strings": {
							"choiceList": [
								{
									"comparator": "StringEquals",
									"nextStep": "Manage Accounts",
									"variableA.$": "$.loop.loopInput.source.name",
									"variableB": "Active Directory"
								}
							],
							"defaultStep": "End Step - Failure",
							"displayName": "",
							"type": "choice"
						},
						"End Step - Failure": {
							"description": null,
							"displayName": "",
							"failureName": "fallo",
							"type": "failure"
						},
						"End Step - Success 1": {
							"displayName": "",
							"type": "success"
						},
						"Get Accounts": {
							"actionId": "sp:get-accounts",
							"attributes": {
								"getAccountsBy": "specificIdentity",
								"identity.$": "$.loop.loopInput.source.name"
							},
							"displayName": "",
							"nextStep": "Compare Strings",
							"type": "action",
							"versionNumber": 1
						},
						"Manage Accounts": {
							"actionId": "sp:manage-account",
							"attributes": {
								"accountIds.$": "$.getAccounts.accounts.id",
								"operation": "disable"
							},
							"displayName": "",
							"nextStep": "Send Email",
							"type": "action",
							"versionNumber": 1
						},
						"Send Email": {
							"actionId": "sp:send-email",
							"attributes": {
								"body": "The identity {{$.loop.loopInput.firstName}} {{$.loop.loopInput.lastName}} of the source {{$.loop.loopInput.source.name}}\n {{$.loop.loopInput.passwordLastSet}}\n {{$.identities.accounts.id}}",
								"context": {},
								"recipientEmailList": [
									"test@test.test"
								]
							},
							"displayName": "",
							"nextStep": "End Step - Success 1",
							"type": "action",
							"versionNumber": 2
						}
					}
				},
				"displayName": "",
				"nextStep": "End Step - Success",
				"type": "action",
				"versionNumber": 1
			}
		}
	},
	"creator": {
		"type": "IDENTITY",
		"id": "84a568c1f5024b24b21a25a27379ac66",
		"name": "rcgalvez"
	},
	"trigger": {
		"type": "SCHEDULED",
		"attributes": {
			"cronString": "0 0 * * *",
			"dailyTimes": [
				"0000-00-0000:00:00.000Z"
			],
			"frequency": "daily",
			"timeZone": "Europe/London"
		}
	}
}

```

---

<div class="post-metadata">

**Author:** ![ipobeidi](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/ipobeidi/32/16000_2.png) [@ipobeidi](https://developer.sailpoint.com/discuss/u/ipobeidi)\
**Post date:** [June 10, 2024, 1:50pm UTC](https://developer.sailpoint.com/discuss/t/workflow-cant-disable-accounts-inside-a-loop/64830/7 "2024-06-10T13:50:11Z")

</div>

Raúl, create a external trigger workflow for Disabling the account. and put the HTTP request inside the loop. You iterate on the list callking the external workflow and disabling the accounts .

that would be a more controlled approach in my opinion

---

<div class="post-metadata">

**Author:** ![jesvin90](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/jesvin90/32/5301_2.png) [@jesvin90](https://developer.sailpoint.com/discuss/u/jesvin90)\
**Post date:** [June 10, 2024, 2:27pm UTC](https://developer.sailpoint.com/discuss/t/workflow-cant-disable-accounts-inside-a-loop/64830/8 "2024-06-10T14:27:51Z")

</div>

Hi @rcgalvez,

Here is an approach you can try :

Step 1 → Scheduled trigger

Step 2 → HTTP Action → Here you can call the [Search](https://developer.sailpoint.com/docs/api/v3/search-post) API with a query like `@accounts(source.name:"AD Source") AND @accounts(source.name:"Other Source")`

Step 3 → Initiate the loop with input as `$.hTTPRequest.body` (This is to take the input from the HTTP action’s body which will have all the Identities)

Step 4 → Inside the loop, call HTTP action 2 which is a [GET](https://developer.sailpoint.com/docs/api/v3/list-accounts) call on IDN accounts to get the Identity’s AD account.

`https://{tenant}.api.identitynow.com/v3/accounts?filters=sourceId%20eq%20%22<<replace your AD source ID>>%22%20and%20identityId%20eq%20%22{{$.loop.loopInput.id}}%22`

Step 5 → Manage Accounts Action with operation as disabled using the below account selection criteria:

`$.hTTPRequest2.body[*].id`

The overall WF would look something like this :

![image](https://global.discourse-cdn.com/sailpoint/original/2X/f/f5065ecf3321280e38740cca1e604aa295087602.png)

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\
**Post date:** [August 9, 2024, 2:28pm UTC](https://developer.sailpoint.com/discuss/t/workflow-cant-disable-accounts-inside-a-loop/64830/9 "2024-08-09T14:28:30Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.