Lesson 11 — Lifecycle Workflows in Microsoft Entra
Identity administration becomes difficult when onboarding, role changes and departures depend on manual checklists.
Microsoft Entra Lifecycle Workflows automate repeatable joiner, mover and leaver tasks using user attributes, schedules, built-in workflow templates and task extensions.
This lesson explains workflow design, triggers, tasks, execution history, monitoring and the investigation process when an identity lifecycle action does not occur as expected.
What you will learn
This lesson explains how Microsoft Entra automates identity lifecycle tasks and how to investigate failed workflow execution.
Learning objectives
After completing this lesson, you should be able to design, monitor and investigate Microsoft Entra Lifecycle Workflows.
- Explain joiner, mover and leaver automation.
- Identify suitable workflow triggers and user attributes.
- Describe built-in tasks, templates and task extensions.
- Understand workflow execution history and failure monitoring.
- Investigate identities that were not processed correctly.
The problem this solves
Manual identity processes are vulnerable to delay, inconsistency and forgotten steps.
A new starter may wait for access, a transferred employee may retain old privileges, or a departed employee may remain enabled because one checklist item was missed.
What are Lifecycle Workflows?
Microsoft Entra Lifecycle Workflows are an Identity Governance capability that automates user lifecycle tasks based on identity attributes and time-based conditions.
Identity lifecycle automation is only reliable when the trigger data, workflow permissions and execution results are all monitored.
Joiner workflows
Joiner workflows prepare an identity before or when employment begins.
Typical tasks include enabling the account, adding group membership, assigning access and sending onboarding notifications.
Mover workflows
Mover workflows respond when an employee changes department, location, manager or job function.
The objective is not only to add new access, but also to remove permissions that no longer match the employee's responsibilities.
Joiner, mover and leaver compared
| Lifecycle stage | Typical trigger | Example actions |
|---|---|---|
| Joiner | Hire date or account creation. | Enable account, add groups, assign access, notify manager. |
| Mover | Department, manager or role attribute changes. | Add new access, remove old access, update ownership and review privileged assignments. |
| Leaver | Employee leave date or termination status. | Disable account, remove groups, revoke access, notify stakeholders and begin retention steps. |
Leaver workflows
Leaver workflows reduce the risk created when a former employee or contractor remains able to sign in.
Actions should be coordinated with legal, HR, records-management and operational requirements.
Source data matters
Workflow automation depends on accurate user attributes such as employeeHireDate, employeeLeaveDateTime, department and manager.
If the required data is empty, incorrectly formatted or updated too late, the workflow may never trigger.
Workflow triggers and schedules
| Trigger type | How it works | Security consideration |
|---|---|---|
| Time-based trigger | Runs relative to a date attribute such as hire or leave date. | The source date must be accurate and populated before the processing window. |
| Attribute-based scope | Includes users that match defined identity conditions. | Incorrect scope may omit users or process the wrong population. |
| Scheduled evaluation | Microsoft Entra periodically evaluates eligible users. | A workflow may not run immediately after an attribute changes. |
| On-demand execution | An administrator runs a workflow manually for selected users. | Useful for testing and recovery, but should not replace reliable automation. |
Built-in workflow templates
Microsoft Entra provides templates for common pre-hire, onboarding and offboarding scenarios.
Templates accelerate deployment, but each task, scope and timing condition still needs to be reviewed for the organisation.
Workflow tasks
Tasks are the actions performed when the workflow runs.
Examples include enabling or disabling accounts, removing users from groups, requesting an access package assignment, sending email and invoking a custom task extension.
Designing a workflow
Task sequence
Task order matters. A notification may need to occur before an account is disabled, while access removal may need to happen before licences are reclaimed.
Design the workflow as an operational process rather than a collection of unrelated actions.
Task extensions
Task extensions allow Lifecycle Workflows to call external systems through Logic Apps and custom integrations.
This can coordinate identity actions with service desks, HR systems, physical access systems or application-specific deprovisioning.
Workflow execution and monitoring
Every workflow should be monitored through workflow history, user processing results and task-level status.
| Evidence | What to check | Possible finding |
|---|---|---|
| Workflow history | Whether the workflow ran at the expected time. | The workflow was disabled or no eligible users were found. |
| User processing result | Whether the identity entered the workflow. | The user did not match the scope or trigger condition. |
| Task result | Which individual action succeeded or failed. | A permission, dependency or external integration failed. |
| Audit logs | Who changed workflow configuration or user attributes. | A trigger attribute was modified after the expected processing window. |
Testing safely
Test new workflows with dedicated identities before enabling broad production scope.
Confirm both successful execution and failure handling, including what happens when an attribute is missing or an external task extension is unavailable.
Exceptions and recovery
Automation needs an exception process for urgent hires, delayed departures, legal holds and failed tasks.
Administrators should know how to rerun a workflow, execute it on demand or complete a security-critical action manually.
Lifecycle Workflow investigation process
Did the identity remain active because the source data was wrong, the workflow never selected the user, or an individual task failed after execution began?
Real-world scenario: the employee left two weeks ago
Investigate the identity data
Validate the user's employment attributes, manager, department and lifecycle dates against the authoritative source.
A workflow cannot correct a lifecycle event it was never told about.
Investigate the security impact
For a failed leaver workflow, review sign-in activity, active sessions, group membership, application access, privileged roles and licences.
Do not wait for workflow troubleshooting before completing urgent containment.
Common mistakes
| Mistake | Why it creates risk | Better practice |
|---|---|---|
| Required lifecycle attributes are missing | Eligible users are never selected for processing. | Validate HR synchronisation and monitor attribute completeness. |
| Scope is too broad | Unexpected identities may be processed. | Test precise scope conditions with dedicated accounts. |
| Workflow is enabled without testing | Production users may receive incorrect access changes. | Use controlled test identities and verify every task result. |
| Task failures are not monitored | The workflow appears to run while critical actions remain incomplete. | Review task-level history and configure operational alerts. |
| Offboarding relies only on licence removal | The account may still sign in or retain application access. | Disable access, revoke sessions and remove permissions in a coordinated sequence. |
| No exception process exists | Urgent or unusual lifecycle events fall outside automation. | Document manual containment, recovery and escalation procedures. |
Key takeaways
- Lifecycle Workflows automate repeatable joiner, mover and leaver tasks.
- Reliable automation depends on accurate and timely identity attributes.
- Workflow scope, triggers, schedules and task order must be deliberately designed.
- Templates provide a starting point but still require organisational review.
- Task extensions connect Microsoft Entra to external business and security processes.
- Workflow history and task results must be monitored continuously.
- Security-critical failures require immediate manual containment while the automation problem is corrected.
Related Agent Foskett resources
Continue learning
Microsoft Entra Lifecycle Workflows
Microsoft Entra Lifecycle Workflows automate joiner, mover and leaver identity tasks using user attributes, schedules, built-in workflow templates and task extensions.
Microsoft Entra Academy Lesson 11 — Lifecycle Workflows in Microsoft Entra
This Agent Foskett lesson explains lifecycle workflow triggers, tasks, execution history, monitoring, troubleshooting and investigation workflows.
