Active Roles change workflow, that triggers on a user logon event outside active roles

Hi ssim 

The below linked KB will get you started, as it's showing how you can "Handle changes from DirSync control" (aka changes made in native active directory). In this example it is triggering a script in an Administrative Policy via the onPostCreate event handler, the script is setting a VA to be true.

Organizational Units created outside of Active Roles do not get a value in edsvaAzureOffice365Enabled even when edsvaAzureOffice365EnabledIncludeChildOUs is set (4336742)

So if were to say write a script onPostUpdate, where the object being modified is of type user, and the attribute being modified is logonCount, and logonCount is 1 (adding these so we can jump out of the script as soon as possible, if a) its not a user, b) logonCount hasn't been changed, and c) any logon count not being 1, will terminate the process.

The us some none stored VA to trigger your workflow, or call an add to group with temporal membership values.]

Hope that helps.

Hi ssim 

The below linked KB will get you started, as it's showing how you can "Handle changes from DirSync control" (aka changes made in native active directory). In this example it is triggering a script in an Administrative Policy via the onPostCreate event handler, the script is setting a VA to be true.

Organizational Units created outside of Active Roles do not get a value in edsvaAzureOffice365Enabled even when edsvaAzureOffice365EnabledIncludeChildOUs is set (4336742)

So if were to say write a script onPostUpdate, where the object being modified is of type user, and the attribute being modified is logonCount, and logonCount is 1 (adding these so we can jump out of the script as soon as possible, if a) its not a user, b) logonCount hasn't been changed, and c) any logon count not being 1, will terminate the process.

The us some none stored VA to trigger your workflow, or call an add to group with temporal membership values.]

Hope that helps.

hey, 

we did indeed end up looking into the DirSync road, we tied a script to a policy object, which is attached to the OU which holds the users needed for this task. 

it works a treat. we ended up adding the temporal work into the script, so like you said, if object is User, then if logon count is = to 1 it moves to adding the user into the group for 48 hours. 

thank you. 

Andrew.