AdamH.05926 (Customer) asked a question.
Vendor account lifecycle audit
Previously we had active directory accounts for all of our vendors, but we are now starting to have situations where the user could exist only in Okta. Our process for these users currently is that in Active Directory we set an expiration date, then there is a powershell script that emails the vendors manager to verify if the account is still needed.
We need to setup something similar to this inside of Okta, possibly using workflows, that follows this same process. Has anyone setup a workflow that triggers an email to the manager of a vendor prior to an expiration date for a user?
@AdamH.05926 (Customer) -- As long as you have a searchable attribute on the user's profile indicating their "endDate" Workflows can fairly easily achieve your use case. The main recommendation is for the date specified to be in ISO 8601 format (at least yyyy-MM-DD the time portion isn't required) as it will provide consistency.
Here is a helpful article discussing utilizing "List Users with Search" with custom search criteria to give you an idea on how you can go about it.
https://support.okta.com/help/s/article/search-for-users-using-custom-search-criteria-in-workflows?language=en_US
This built-in Okta card/action is calling the Users API endpoint. For more details on what the endpoint supports you can review the API documentation here:
https://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#tag/User/operation/listUsers
Essentially you would create a "Scheduled" flow that runs daily that search for an endDate matching todays date OR if you want an early notification you could perform Date math to take for example (Today's date & Add X days). All found results will be returned and each can be streamed to a Helper flow for individual processing (Such as gathering other attributes like Manager's email) and sending out your notifications or taking actions against the account.