Looking for assistance with configuring an event trigger filter for Entra ID account provisioning

Lifecycle & Governance
1

I’m trying to configure an Event Trigger that only fires for account creation events specifically for the “Microsoft EntraID - Cloud Only Accounts” source.

So far, I’m facing issues filtering the data as expected. Here’s what I’ve tried in the Event Trigger filter field:

  • $.accountRequests[?(@.accountOperation=="Create")]
     This works, but it includes all sources — I still have to filter by source name in my downstream logic.
  • :cross_mark: $.accountRequests[?(@.provisioningTarget=="Microsoft EntraID - Cloud Only Accounts")]
     This doesn’t trigger the event at all.
  • :cross_mark: $.accountRequests[?(@.source.name=="Microsoft EntraID - Cloud Only Accounts")]
     Also not triggering.
  • :cross_mark: $.accountRequests[?(@.accountOperation=="Create" && @.source.name=="Microsoft EntraID - Cloud Only Accounts")]
     This combined filter also fails to trigger.

Any insights on how to get this working via the filter expression itself?

Here is the Body, i would like to get Create operations event details directly from event trigger:

{“_metadata”: {“invocationId”: “ec700989080”,“triggerId”: “idn:post-provisioning”,“triggerType”: “fireAndForget”},“accountRequests”: [{“accountId”: “1123899”,“accountOperation”: “Modify”,“attributeRequests”: [{“attributeName”: “detectedRoles”,“attributeValue”: “MEID - APP - DirectoryABC”,“operation”: “Add”}],“provisioningResult”: “IdentityNow Task”,“provisioningTarget”: “IdentityNow”,“source”: {“id”: “IdentityNow”,“name”: “IdentityNow”,“type”: “SOURCE”},“ticketId”: null},{“accountId”: “abc”,“accountOperation”: “Create”,“attributeRequests”: [{“attributeName”: “azureADEligibleRoles”,“attributeValue”: “xyz”,“operation”: “Add”},{“attributeName”: “accountType”,“attributeValue”: “User”,“operation”: “Add”},{“attributeName”: “userPrincipalName”,“attributeValue”: “xyz@abc.onmicrosoft.com”,“operation”: “Add”},{“attributeName”: “password”,“attributeValue”: null,“operation”: “Add”},{“attributeName”: “displayName”,“attributeValue”: “xyz”,“operation”: “Add”},{“attributeName”: “mailNickname”,“attributeValue”: “xyz”,“operation”: “Add”},{“attributeName”: “accountEnabled”,“attributeValue”: “true”,“operation”: “Add”},{“attributeName”: “givenName”,“attributeValue”: “xyz”,“operation”: “Add”},{“attributeName”: “surname”,“attributeValue”: “xyz”,“operation”: “Add”},{“attributeName”: “usageLocation”,“attributeValue”: “IN”,“operation”: “Add”},{“attributeName”: “forceChangePasswordNextSignIn”,“attributeValue”: “true”,“operation”: “Add”}],“provisioningResult”: “committed”,“provisioningTarget”: “Microsoft EntraID - Cloud Only Accounts”,“source”: {“id”: “axr”,“name”: “Microsoft EntraID - Cloud Only Accounts”,“type”: “SOURCE”},“ticketId”: null}],“action”: “Access Request”,“errors”: [],“recipient”: {“id”: “7899”,“name”: “xyz”,“type”: “IDENTITY”},“requester”: {“id”: “xyz”,“name”: “1116727”,“type”: “IDENTITY”},“sources”: “Microsoft EntraID - Cloud Only Accounts, IdentityNow”,“trackingNumber”: “xyz”,“warnings”: []}

2

Have you explored the JSONPath Evaluator tool on the developer page? There’s also some additional documentation on JSONPath syntax here.
Hope this helps!

3

hmm Strange..provisioningTarget / source.name should work..just a thought as it causes issue in rules..was the source name changed after the initial creation?

4

Hi @SwathiPrasanna ,

I use an event trigger that kicks off whenever an account has been created in Entra ID (which works), I’ve edited it to try and match what you’re using, give this a whirl :slightly_smiling_face:

$.accountRequests[?(@.accountOperation == “Create” && @.provisioningTarget == “Microsoft EntraID - Cloud Only Accounts” && @.provisioningResult== “committed”)]

5

Thank you  @SeanK-W  , It’s strange, it worked after adding @.provisioningResult== “committed”.

6

Hello  @SeanK-W  ,
When access is granted based on a birthright role, the user account may be provisioned to multiple sources. In such cases, how can I filter events for a specific source using an event trigger?

I think : $.accountRequests[?(@.source.name contains “Microsoft EntraID”)].attributeRequests[?(@.attributeName == “azureADEligibleRoles” && @.operation == “Add”)].attributeValue -- I think this should work.

More details:
https://community.sailpoint.com/t5/Identity-Security-Cloud-Forum/Seeking-help-in-filtering-the-SailPoint-event-trigger-to-capture/m-p/269755#M17258

7

Hi Swathi, to be honest I’ve never tried filtering for events for a specific set of sources & then filtering account requests that ALSO factor in the contains logic… I am not so sure if event triggers can cater for this. The problem I can see here is the provisioning target would also need to factor in the ‘contains’ logic too…  :slightly_smiling_face:

If you did want to attempt something like this, I’d expect the trigger to start with something akin to:

$[?($.sourceName contains “Microsoft EntraID”)]

If it’s only two sources, could you have two duplicate workflows with the only difference being the trigger targeting each source? At least gets you up and running & then you could investigate how you can consolidate later down the line.

Might be one for the ISC architects to help out with!