5.1 Lifecycle Events and Their Workflows

Lifecycle Events and Their Workflows

Objective 2.4 asks you to configure lifecycle events and their associated workflows. A lifecycle event is a rule that watches for a change to an identity, such as a new hire, a new manager, or a status changing to inactive. When the change is detected, it launches a business process that grants, changes, or removes access. This is IdentityIQ's native joiner-mover-leaver engine. Rapid Setup (section 5.4) is a guided layer on top of the same ideas.

Where and When Events Fire

• Configure events on Setup > Lifecycle Events. Each row shows the name, type, attribute (for Attribute Change), owner, and whether it is disabled.
• Events are evaluated by the Identity Refresh task when Process Events is selected. Aggregation stores snapshots that approximate each identity's previous state. Refresh compares that snapshot with the updated identity to decide which events apply.
• Aggregation alone does not launch lifecycle events. The usual schedule is: aggregate the authoritative source, then refresh with Process Events. Many teams use Refresh only identities marked as needing refresh during aggregation to keep this incremental.

The Seven Event Types

A classic leaver is an Attribute Change event on inactive with New Value Filter = true. A classic mover is a Manager Transfer event, or an Attribute Change on department or location. A classic joiner is a Create event.

Common Settings for Every Event

• Name and Description. The name identifies the event but is not shown on the requests it creates.
• Include Identities limits which identities the event applies to: None (only listed identities), All, Match List (identity attributes, application attributes, or permissions), Filter, Script, Rule, or Population. Use it, for example, to run a contractor leaver process only for identities whose type is Contractor.
• Threshold Type and Threshold Value set an identity processing threshold. Fixed needs a whole number greater than 1. Percentage needs a whole number from 1 to 100. If an HR mistake marks a whole department as terminated, the threshold stops the Identity Refresh task before any identity is updated and fails the task result with a message. With partitioned refresh, the count is cumulative across partitions. The refresh option Disable identity processing threshold switches the check off for one task.
• Business Process is the workflow to launch.
• Disabled turns the event off without deleting it.

The Associated Workflows

IdentityIQ ships lifecycle workflows of the Identity Lifecycle type: Lifecycle Event – Joiner, Lifecycle Event – Manager Change, Lifecycle Event – Leaver, and Lifecycle Event – Reinstate. They build provisioning plans (for example, disabling accounts for a leaver or notifying the new manager for a transfer). They reuse the same Identity Request subprocesses as LCM, so approvals, forms, provisioning, and notifications work as they do in section 4.3.

Customizing follows the usual pattern: copy the product workflow, change its variables or steps, and select the copy in the event's Business Process field. The workflow-types documentation adds that workflows with custom types can be triggered only from Lifecycle Events, which can launch a workflow of any type.

Worked Example: A Contractor Leaver

Requirement: when a contractor's inactive flag becomes true, disable their accounts, notify their manager, and never run the process for employees.

1. Event Type: Attribute Change. Attribute: inactive. Previous Value Filter: false. New Value Filter: true.
2. Include Identities: Match List with type = Contractor, so employees are never selected.
3. Threshold: Percentage, 5. If the number of identities triggering the event reaches the threshold (five percent of identities), the refresh stops before updating anyone.
4. Business Process: a copy of Lifecycle Event – Leaver with its notification variables set to include the manager.
5. Schedule: HR delta aggregation, then Identity Refresh with Refresh identity attributes, Process Events, and Provision assignments, limited to identities marked as needing refresh.

Test it by editing a test contractor's inactive value in a non-production HR file. Run the two tasks, check Task Results for the launched workflow, and read the redirected email (section 3.4).

Lifecycle Events vs. Certification Events

A lifecycle event launches a business process. A certification event (Setup > Certifications) uses the same kinds of triggers to launch an access review, for example certifying a mover's access when the manager changes. If a question asks you to "launch a workflow," it is a lifecycle event. If it asks you to "launch a review," it is a certification event (section 6.1).

Troubleshooting Checklist

1. Did aggregation actually change the attribute? Check the identity's attributes and history.
2. Did Identity Refresh run with Process Events selected?
3. Is the event enabled, and do its filters and Include Identities match the identity?
4. Did a threshold stop the refresh? Check the task result message.
5. Did the business process start? Check Task Results or the workflow case, and turn on trace in the workflow if needed.