I am trying to use Okta Workflows to take action on users who are inactive. I have a delegated & a helper workflow. I want to cut down the number of runs my helper workflow has to perform, but can’t figure out how to add last login date criteria to the delegated workflow.
Currently I am using a List Users with Search card, with this custom criteria:
status lt "SUSPENDED" and (profile.userType eq "Employee" or profile.userType eq "Contractor")
Status is not suspended or deprovisioned
User type is employee or contractor
This way of doing it does not allow me to check for last login date, so is there another way to query users with their last login date & push the users to my helper flow? I have seen examples of querying system logs, but I am looking to return a user to the helper workflow.
The user object returned by the List Users With Search card includes the Last Login field. That field stores the last time the user signed in to the Okta Dashboard.
You would need to make a small update to the search in the template; you need to search for user.session.start (IdP login) or user.authentication.sso (SP-initiated)
Thank you! I suspect I will be using this forum often.
I understand that I can verify last login date in the helper workflow called by List Users with Search, but my goal is to do so in the first flow if it is possible.
As of now, the helper workflow is running 20,000 times every time List Users with Search is called. I hope to reduce that number.
How do you want to verify the date? You can compare it against another date. Is that what you want to do? If you need to do other date calculations, you would need to be in the helper flow.
I want to make sure the last login date is older than 6 months from the current date. Before I realized I could not query lastLogin, I tried to add something like this in my query -
You likely can’t set the dynamic date directly in the query, but try to calculate the date earlier in the flow, put the whole search query in a text, and pass it to the search card.
