# Workflow - Remove access and disable accounts

**URL:** <https://developer.sailpoint.com/discuss/t/workflow-remove-access-and-disable-accounts/81855>\
**Category:** SHF Discussion and Questions\
**Tags:** identity-security-cloud, workflows\
**Created:** [September 19, 2024, 6:00am UTC](https://developer.sailpoint.com/discuss/t/workflow-remove-access-and-disable-accounts/81855 "2024-09-19T06:00:10Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dharani\_01](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@Dharani\_01](https://developer.sailpoint.com/discuss/u/Dharani_01)\
**Post date:** [September 19, 2024, 6:00am UTC](https://developer.sailpoint.com/discuss/t/workflow-remove-access-and-disable-accounts/81855/1 "2024-09-19T06:00:10Z")

</div>

We are working on a termination workflow in which the user’s account gets disabled along with access removal. We want this termination to remove access only for some specific sources, where we can filter access based on source name or source ID

However, the search query I’m using to filter these applications isn’t producing the expected results.

```auto
{
“query”: {
“query”: “@accounts(source.name:SAP) OR @accounts(source.name:SAP_GRC) OR @accounts(source.name:SAP_HANA)”
},
“sort”: [
“name”
]
}

```

Please let us know if you have a better approach.

---

<div class="post-metadata">

**Author:** ![gourab](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/gourab/32/18650_2.png) [@gourab](https://developer.sailpoint.com/discuss/u/gourab)\
**Post date:** [September 19, 2024, 6:09am UTC](https://developer.sailpoint.com/discuss/t/workflow-remove-access-and-disable-accounts/81855/2 "2024-09-19T06:09:26Z")

</div>

Hi @Dharani_01 ,  
Use get Accounts actions and after that use manage accounts to disable specific sources. use this json path to detect specific sources **$.getAccounts.accounts[?(@.sourceName==‘sourceName’)].id**

---

<div class="post-metadata">

**Author:** ![zeel\_sinojia](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/zeel_sinojia/32/13666_2.png) [@zeel\_sinojia](https://developer.sailpoint.com/discuss/u/zeel_sinojia)\
**Post date:** [September 19, 2024, 8:00am UTC](https://developer.sailpoint.com/discuss/t/workflow-remove-access-and-disable-accounts/81855/3 "2024-09-19T08:00:53Z")

</div>

Hey @Dharani_01,

You are planning to disable the accounts of user using a workflow. Have you tried using [Lifecycle States](https://documentation.sailpoint.com/saas/help/provisioning/lifecycle.html) ?

You could perform disable/delete operation based on the lifecycle user’s identity. If the identity status is updated to **Terminated** , it will automatically disable the accounts in the specified source.

---

<div class="post-metadata">

**Author:** ![adamian](https://avatars.discourse-cdn.com/v4/letter/a/a183cd/32.png) [@adamian](https://developer.sailpoint.com/discuss/u/adamian)\
**Post date:** [September 19, 2024, 8:29am UTC](https://developer.sailpoint.com/discuss/t/workflow-remove-access-and-disable-accounts/81855/4 "2024-09-19T08:29:01Z")

</div>

> [@gourab](#):
>
> **$.getAccounts.accounts[?(@.sourceName==‘sourceName’)].id**

I think that using single quotes in the JSON Path is incorrect, and `"..."` should be used.  
You can see that single quotes don’t work correctly if you have a `)` in your source name.

---

<div class="post-metadata">

**Author:** ![nhassan](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/nhassan/32/5835_2.png) [@nhassan](https://developer.sailpoint.com/discuss/u/nhassan)\
**Post date:** [September 19, 2024, 11:31am UTC](https://developer.sailpoint.com/discuss/t/workflow-remove-access-and-disable-accounts/81855/5 "2024-09-19T11:31:54Z")

</div>

Hi @Dharani_01

Can you try testing this search query to filter the accounts from specific sources?

```auto
{
    "indices": [
        "identities"
    ],
    "query": {
        "query": "@accounts(source.name:'SAP') OR @accounts(source.name:'SAP_GRC') OR @accounts(source.name:'SAP_HANA')"
    },
    "queryResultFilter": {
        "includes": [
            "name", "id"
        
        ]
    }
    }

```

Also, if you want to remove their access profiles from specific sources then you can use this filter in the Loop Input.

```auto
$.hTTPRequest.body[0].access[?((@.type == "ACCESS_PROFILE" && @.source.name == "SAP") || (@.type == "ACCESS_PROFILE" && @.source.name == "SAP_GRC") || (@.type == "ACCESS_PROFILE" && @.source.name == "SAP_HANA")]

```

Hope this would help.

Thanks

---

<div class="post-metadata">

**Author:** ![Dharani\_01](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@Dharani\_01](https://developer.sailpoint.com/discuss/u/Dharani_01)\
**Post date:** [September 19, 2024, 12:33pm UTC](https://developer.sailpoint.com/discuss/t/workflow-remove-access-and-disable-accounts/81855/6 "2024-09-19T12:33:13Z")

</div>

Hi @nhassan ,

thanks, I was looking into the same. Additionally, in that query, can I include filter for specific users? For example, if a particular user has accounts in any of the sources, I need the that particular source name to be included in the query output. Is that possible.

---

<div class="post-metadata">

**Author:** ![nhassan](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/nhassan/32/5835_2.png) [@nhassan](https://developer.sailpoint.com/discuss/u/nhassan)\
**Post date:** [September 25, 2024, 3:44pm UTC](https://developer.sailpoint.com/discuss/t/workflow-remove-access-and-disable-accounts/81855/7 "2024-09-25T15:44:15Z")

</div>

@Dharani_01 Sorry for the late reply.

You can try using these search queries that should give you accounts of a specific user including sources names/Ids and then apply an operator to get/compare the desired results and then proceed with next steps in the workflow.

```auto
{
    "indices": [
        "identities"
    ],
    "query": {
        "query": "id:Id_of_the_Identity"
    },
    "queryResultFilter": {
        "includes": [
            "id", "displayName", "email", "accounts"
                   ]
}
}

```

```Preformatted

```

OR

`"query": "id:{{$.trigger.identity.id}}"`

```auto
OR

"query": "attributes.title: \"IAM Engineer\""

```

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\
**Post date:** [November 24, 2024, 3:44pm UTC](https://developer.sailpoint.com/discuss/t/workflow-remove-access-and-disable-accounts/81855/8 "2024-11-24T15:44:29Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.