diff --git a/tf/actions/activateNewUsersInCIS.js b/tf/actions/activateNewUsersInCIS.js
index 394fcb0..4977ce1 100644
--- a/tf/actions/activateNewUsersInCIS.js
+++ b/tf/actions/activateNewUsersInCIS.js
@@ -15,7 +15,7 @@ exports.onExecutePostLogin = async (event, api) => {
   }
 
   // If you're explicitly flagged as existing in CIS, then we don't need to continue onward
-  if (event.user.user_metadata.existsInCIS) {
+  if (event.user.app_metadata?.existsInCIS) {
     console.log(`${event.user.user_id} existsInCIS is True.  Skip activateNewUsersInCIS`);
     return;
   }
diff --git a/tf/tests/activateNewUsersInCIS.test.js b/tf/tests/activateNewUsersInCIS.test.js
index edc2fdc..bff2a8b 100644
--- a/tf/tests/activateNewUsersInCIS.test.js
+++ b/tf/tests/activateNewUsersInCIS.test.js
@@ -166,7 +166,7 @@ test('When existsInCIS is already set, expect empty logs and workflow to continu
   fetch.mockImplementation(fetchRespCallback);
 
   // Set existsInCIS in user metadata
-  _event.user.user_metadata = { existsInCIS: true };
+  _event.user.app_metadata = { existsInCIS: true };
 
   // Execute onExecutePostLogin
   await onExecutePostLogin(_event, api);