Hello,Would anybody know if a Function Evaluator can write into a Request parameter while the workflow is executing?I just see one request parameter: CreatedDate. How do I add a parameter which I am expecting when the workflow kicks in? Also it seems like the FunctionEvaluator supports only parameters on WorkflowData and Target objects. Is that so? If it is, then why would "Add Workflow Parameter Lookup" window list other objects like: Request, Requestor, Delta & RequestParameter.I am sure I am missing something here. Will really appreciate some help in understanding it. Thanks & Regards, Jameel Syed Principal Consultant, fimGuru - Your window into simplified identities jameel.syed@fimguru.com - http://www.fimguru.com

You are not missing anything. The function activity is very limited in what it can do. Its main purpose is to be used in the action phase to calculate additional attributes, e.g. DisplayName by concatenate firstname and lastname.It can read values from other objects, but it is only designed to update //Target and //WorkflowData./AndreasThis posting is provided "AS IS" with no warranties, and confers no rights. Use of included script samples are subject to the terms specified at http://www.microsoft.com/info/copyright.htm

Andreas, Thanks for your reply. I was looking to use the Function Evaluator to set the MembershipAddWorkflow and the MembershipLocked attributes for a group. Initially, I had hardcoded "Owner Approval"---> MembershipAddWorkflow and "false"--->MembershipLocked in the inbound sync rules for the ADMA.This works great for all the existing groups which FIM pulls in from AD. However, for all the groups created/modified in FIM, these attributes gets overwritten after every full sync between all the datastores as the ADMA sync rules is setup with more precedance than FIM.I was looking to use the Function Evaluator to determine if these attributes are already set on the target, if they are then the value provided by the sync rule will be ignore. Better yet, it would have been perfect if the Function Evaluator could overwrite the Request parameters during the execution of the sync workflow.Any ideas how this could be accomplished given the limited capability of the Function Evaluator?Thanks & Regards, Jameel Syed Principal Consultant, fimGuru - Your window into simplified identities jameel.syed@fimguru.com - http://www.fimguru.com

This can be solved in a slightly different way. Your problem is that you only want some attributes to be authoritative for a short period of time.Ideas can be found in the Migration guide (http://technet.microsoft.com/en-us/library/ff608268(WS.10).aspx) .This is how we did it here at Microsoft. We created an OU named MigratedGroups in AD (and one ToBeMigrated). We then created a Sync Rule setting those attributes but added a filter to it so the SR will not be applied when a group is located in this OU. We finally created an outbound SR with an attribute flow for the dn moving the group to the MigratedGroups ou.Now, when we move a group in AD to the ToBeMigrated ou it will fall in scope for a SR and its flows will apply. We use an MPR which will add the SR mentioned above to change the dn, and when we move the group, the SR which added those attributes is not in scope anymore and will not apply them again.We had to use the dn attribute since we have other apps using our AD, but you can use an extensionAttribute or any other unused attribute./AndreasThis posting is provided "AS IS" with no warranties, and confers no rights. Use of included script samples are subject to the terms specified at http://www.microsoft.com/info/copyright.htm