# Workflow - get the date of AD account disabling in a workflow **URL:** \ **Category:** SHF Discussion and Questions\ **Tags:** workflows, sailpoint-identity-security\ **Created:** [May 30, 2025, 9:04pm UTC](https://developer.sailpoint.com/discuss/t/workflow-get-the-date-of-ad-account-disabling-in-a-workflow/139870 "2025-05-30T21:04:55Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![papie66](https://avatars.discourse-cdn.com/v4/letter/p/7ba0ec/32.png) [@papie66](https://developer.sailpoint.com/discuss/u/papie66)\ **Post date:** [May 30, 2025, 9:04pm UTC](https://developer.sailpoint.com/discuss/t/workflow-get-the-date-of-ad-account-disabling-in-a-workflow/139870/1 "2025-05-30T21:04:55Z")
Hi Guys, Is it possible to get the date when a AD account is disabled and to compare it with the date when lifecycle is changed? ---
**Author:** ![ManvithaNalabolu06](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/manvithanalabolu06/32/26315_2.png) [@ManvithaNalabolu06](https://developer.sailpoint.com/discuss/u/ManvithaNalabolu06)\ **Post date:** [May 31, 2025, 5:03am UTC](https://developer.sailpoint.com/discuss/t/workflow-get-the-date-of-ad-account-disabling-in-a-workflow/139870/2 "2025-05-31T05:03:59Z")
> [@papie66](#): > > Is it possible to get the date when a AD account is disabled and to compare it with the date when lifecycle is changed? Yes, it’s possible if the AD source is configured to bring in the whenChanged or similar timestamp attribute tied to the account being disabled. You can map this attribute in the account schema and pull it during aggregation. Then, store it as an account attribute or use it in a transform to expose it to the identity. You can compare this timestamp with the lifecycle state change date (if tracked via identity attribute or identity history). A rule or report can help automate this comparison for auditing or workflow triggers. ---
**Author:** ![papie66](https://avatars.discourse-cdn.com/v4/letter/p/7ba0ec/32.png) [@papie66](https://developer.sailpoint.com/discuss/u/papie66)\ **Post date:** [May 31, 2025, 7:57am UTC](https://developer.sailpoint.com/discuss/t/workflow-get-the-date-of-ad-account-disabling-in-a-workflow/139870/3 "2025-05-31T07:57:18Z")
Is it not possible to get it from the disabled event that isc logs? What i thought was to get the date of the disable event of the AD account and compare it with the lifecycledate. But i dont know how to get the disable event and the date of it. ---
**Author:** ![hkhandale](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/hkhandale/32/23833_2.png) [@hkhandale](https://developer.sailpoint.com/discuss/u/hkhandale)\ **Post date:** [May 31, 2025, 9:34am UTC](https://developer.sailpoint.com/discuss/t/workflow-get-the-date-of-ad-account-disabling-in-a-workflow/139870/4 "2025-05-31T09:34:29Z")
Once account will get Disable your AD account attribute “Enabled” value will get change from true to false, now you can enable native change to detect for this attribute and then build workflow in that user Trigger Update Native change detect then you can build next process in workflow according to your requirement. ---
**Author:** ![papie66](https://avatars.discourse-cdn.com/v4/letter/p/7ba0ec/32.png) [@papie66](https://developer.sailpoint.com/discuss/u/papie66)\ **Post date:** [May 31, 2025, 10:28am UTC](https://developer.sailpoint.com/discuss/t/workflow-get-the-date-of-ad-account-disabling-in-a-workflow/139870/5 "2025-05-31T10:28:16Z")
I want to minimize te complexity of the workflow etc. Native change detection is also disabled on our tenant and for now we dont want to use it. Is there any other possibility with the events log? ---
**Author:** ![hkhandale](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/hkhandale/32/23833_2.png) [@hkhandale](https://developer.sailpoint.com/discuss/u/hkhandale)\ **Post date:** [May 31, 2025, 10:45am UTC](https://developer.sailpoint.com/discuss/t/workflow-get-the-date-of-ad-account-disabling-in-a-workflow/139870/6 "2025-05-31T10:45:46Z")
You can try Source Update Trigger ![{AE0B2EDE-5B2A-4F64-8F8B-9527E0384D54}](https://global.discourse-cdn.com/sailpoint/original/3X/b/d/bd91179bc114ee072bab99137b8f03e4faf8efe4.png) ---
**Author:** ![papie66](https://avatars.discourse-cdn.com/v4/letter/p/7ba0ec/32.png) [@papie66](https://developer.sailpoint.com/discuss/u/papie66)\ **Post date:** [June 1, 2025, 7:34pm UTC](https://developer.sailpoint.com/discuss/t/workflow-get-the-date-of-ad-account-disabling-in-a-workflow/139870/7 "2025-06-01T19:34:22Z")
I am using already another trigger in my workflow. It strange that there is no simple solution to get the event filtered out with the event date ---
**Author:** ![hkhandale](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/hkhandale/32/23833_2.png) [@hkhandale](https://developer.sailpoint.com/discuss/u/hkhandale)\ **Post date:** [June 2, 2025, 5:23am UTC](https://developer.sailpoint.com/discuss/t/workflow-get-the-date-of-ad-account-disabling-in-a-workflow/139870/8 "2025-06-02T05:23:58Z")
Let me check and will update you if it is possible ---
**Author:** ![papie66](https://avatars.discourse-cdn.com/v4/letter/p/7ba0ec/32.png) [@papie66](https://developer.sailpoint.com/discuss/u/papie66)\ **Post date:** [June 3, 2025, 10:56am UTC](https://developer.sailpoint.com/discuss/t/workflow-get-the-date-of-ad-account-disabling-in-a-workflow/139870/9 "2025-06-03T10:56:14Z")
Ok i will wait for your update ---
**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\ **Post date:** [August 2, 2025, 10:56am UTC](https://developer.sailpoint.com/discuss/t/workflow-get-the-date-of-ad-account-disabling-in-a-workflow/139870/10 "2025-08-02T10:56:35Z")
Closed on August 2, 2025, 10:56am UTC This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.