---
id: account-attribute
title: Account Attribute
pagination_label: Account Attribute
sidebar_label: Account Attribute
sidebar_class_name: accountAttribute
keywords: ["transforms", "operations", "account", "attribute"]
description: Look up an account for a particular source on an identity.
slug: /docs/transforms/operations/account-attribute
tags: ["Transforms", "Transform Operations"]
---

## Overview

Use the account attribute transform to look up an account for a particular
source on an identity and return a specific attribute value from that account.

:::note Other Considerations

- If there are multiple accounts, then IdentityNow by default takes the value
  from the oldest account (based on the account created date). You can configure
  this behavior by specifying `accountSortAttribute` and `accountSortDescending`
  attributes.
- If there are multiple accounts and the oldest account has a null attribute
  value, by default IdentityNow moves to the next account that can have a value
  (if there are any). You can override this behavior with the
  `accountReturnFirstLink` property.
- You can filter the multiple accounts returned based on the data they contain
  so that you can target specific accounts. This is often used to target
  accounts that are "active" instead of those that are not.

:::

## Transform Structure

The account attribute transform's configuration can take several attributes as
inputs. The following example shows a fully configured transform with all
required and optional attributes.

```json
{
  "attributes": {
    "sourceName": "Workday",
    "attributeName": "DEPARTMENT",
    "accountSortAttribute": "created",
    "accountSortDescending": true,
    "accountReturnFirstLink": true,
    "accountPropertyFilter": "(DEPARTMENT == \"Engineering\")",
    "accountFilter": "!(nativeIdentity.startsWith(\"*DELETED*\"))"
  },
  "type": "accountAttribute",
  "name": "Account Attribute Transform"
}
```

## Attributes

- **Required Attributes**
  - **type** - This must always be set to `accountAttribute`.
  - **name** - This is a required attribute for all transforms. It represents
    the name of the transform as it will appear in the UI's dropdown menus.
  - **sourceName** - This is a reference to the source to search for accounts.
    - This is a reference by a source's display name attribute (e.g., Active
      Directory). If the display name is updated, this reference must also be
      updated.
    - As an alternative, you can provide an `applicationId` or `applicationName`
      instead.
      - `applicationId` - This is a reference by a source's external GUID/ID
        attribute (e.g., "ff8081815a8b3925015a8b6adac901ff").
      - `applicationName` - This is a reference by a source's immutable name
        attribute (e.g., "Active Directory \[source\]").
  - **attributeName** - The name of the attribute on the account to return. This
    matches the name of the account attribute name visible in the user interface
    or on the source schema.
- **Optional Attributes**
  - **requiresPeriodicRefresh** - This is a `true` or `false` value indicating
    whether the transform logic must be reevaluated every evening as part of the
    identity refresh process.
  - **accountSortAttribute** - This configuration's value is a string name of
    the attribute to use when determining the ordering of returned accounts when
    there are multiple entries.
    - Accounts can be sorted by any schema attribute.
    - If no sort attribute is defined, the transform will default to "created"
      (ascending sort on created date - oldest object wins).
  - **accountSortDescending** - This configuration's value is a boolean
    (true/false). It controls the sort order when there are multiple accounts.
    - If not defined, the transform will default to false (ascending order)
  - **accountReturnFirstLink** - This configuration's value is a boolean
    (true/false). It controls which account to source a value from for an
    attribute. If this flag is set to true, the transform returns the value from
    the first account in the list, even if it is null. If this flag is set to
    false, the transform returns the first non-null value.
    - If the configuration's value is not defined, the transform will default to
      the false setting.
  - **accountFilter** - This expression queries the database to narrow search
    results. This configuration's value is a `sailpoint.object.Filter`
    expression for searching against the database. The default filter always
    includes the source and identity, and any subsequent expressions are
    combined in an AND operation with the existing search criteria.
    - Only certain searchable attributes are available:
      - `nativeIdentity` - This is the account ID.
      - `displayName` - This is the account name.
      - `entitlements` - This boolean value determine whether the account has
        entitlements.
  - **accountPropertyFilter** - Use this expression to search and filter
    accounts in memory. This configuration's value is a
    `sailpoint.object.Filter` expression for searching against the returned
    resultset.
    - All account attributes are available for filtering because this operation
      is performed in memory.
    - Examples:
      - `(status != "terminated")`
      - `(department == "Engineering")`
      - `(groups.containsAll({"Admin"}) || location == "Austin")`
  - **input** - This is an optional attribute that can explicitly define the
    input data passed into the transform logic. If no input is provided, the
    transform takes its input from the source and attribute combination
    configured with the UI.

## Examples

HR systems can have multiple HR records for a person, especially in rehire and
conversion scenarios. In order to get the correct identity data, you must get
data from only the latest active accounts.

- `sourceName` is "Corporate HR" because that is the name of the authoritative
  source.

- `attributeName` is "HIREDATE" because that is the attribute you want from the
  authoritative source.

- `accountSortAttribute` is "created" because you want to sort on created dates
  in case there are multiple accounts.

- `accountSortDescending` is true because you want to sort based on the newest
  or latest account from the HR system.

- `accountReturnFirstLink` is true because you want to return the value of
  HIREDATE, event if it is null.

- `accountPropertyFilter` is filtering the accounts to look at only active
  accounts. Terminated accounts will not appear (assuming there are no data
  issues).

:::info

You cannot use `accountFilter` here because WORKER_STATUS\_\_c is not a
searchable attribute, but `accountPropertyFilter` works instead.

:::

**Transform Request Body**:

```json
{
  "attributes": {
    "attributeName": "HIREDATE",
    "sourceName": "Corporate HR",
    "accountSortAttribute": "created",
    "accountSortDescending": true,
    "accountReturnFirstLink": true,
    "accountPropertyFilter": "(WORKER_STATUS__c == \"active\")"
  },
  "type": "accountAttribute",
  "name": "Account Attribute Transform"
}
```

---

<p>&nbsp;</p>

When you are mapping values like a username, focus on primary accounts from a
particular source or accounts that are not service accounts.

- `sourceName` is "Active Directory" because that is the source this data is
  coming from.
- `attributeName` is "sAMAccountName" because you are mapping the username of
  the user.
- `accountFilter` is an expression filtering the accounts to make sure they are
  not service accounts.

:::info

`accountPropertyFilter` also would have worked here.

:::

**Transform Request Body**:

```json
{
  "attributes": {
    "attributeName": "sAMAccountName",
    "sourceName": "Active Directory",
    "accountFilter": "!(displayName.startsWith(\"SVC-\"))"
  },
  "type": "accountAttribute",
  "name": "Account Attribute Transform"
}
```
