QARS Workflow/Policy Script to capture onPostModify of the mail attribute for a user and then write user's employeeID and mail attribute to a CSV file for export to our Workday HR system

You would setup a "change workflow" where the start conditions of the workflow trigger on User, properties change...for the mail attribute.  Into it you would insert a script "activity" containing the PoSh code you mention above.

The Posh code itself has to be setup as a "script module" of type "Policy script".

 The only other thing to note is that you need to setup the PoSh code as a Function so:

Function ExportMailAndUpload ($Request)

{

# PoSh code goes here

# Note, here's a good way to grab the newly changed mail attribute (assuming the change was made through Active Roles)

$NewMail = $Request.Get("mail")

}

Then, in the script activity you insert into the workflow, reference the above named Function.

Hope this helps.

Hi Johnny,

When you say a "chage request", if I configure the workflow 'Operation' to 'Modify...' filtered on 'mail, then will it also capture the 'mail' attribute being set upon the creation of a new user? Or do I need to have two workflows, one for 'Create' and one for 'Modify'?

Also, presumably, in my PoSh script, when I Get-QADUser, I would do something like this (I only need to send mail and employeeID to the HR system):

Get-QADUser -Proxy -Identity $Request.DN -IncludedProperties mail,employeeID -DontUseDefaultIncludedProperties

I suppose that $Request would send other -Identity attributes attributes such as GUID, samAccountName, UPN, mail etc?

It is this part of the workflow, passing the $Request from the onPostModify is the bit that I am least familiar with.

You would have to test it but I believe that setting the mail attribute upon user create is a separate "change" so you would only need the one workflow.

Yes, your code for obtaining the new mail contents and the employeeID is correct - to be "cleaner", you could add '| select mail,employeeID' to the end.  That way you have less properties in the returned data.

You would have to test it but I believe that setting the mail attribute upon user create is a separate "change" so you would only need the one workflow.

Yes, your code for obtaining the new mail contents and the employeeID is correct - to be "cleaner", you could add '| select mail,employeeID' to the end.  That way you have less properties in the returned data.