Lifecycle Workflows in Entra ID: how it works, what it needs and where it stops

There are four kinds of trigger, plus the option to start a workflow by hand:

The scope is a rule on attributes, just like a dynamic group: department -eq "Zorg" or employeeType -eq "Employee". On every run the workflow checks again who meets the rule; anyone who no longer meets it is skipped. How to build such rules on HR data is covered in dynamic groups based on HR attributes.

Microsoft supplies more than thirty built-in tasks. A workflow can have up to 25. The most important:

The tasks come with conditions you only run into when something goes wrong:

• Adding groups works for Microsoft 365 groups and cloud-only security groups. Mail-enabled groups, distribution lists, dynamic groups and groups from Active Directory fall outside it.
• Assigning licences requires a usageLocation on the user. How that works is in assigning licences.
• The Temporary Access Pass goes to the manager by email. If the manager does not have an account or an email address yet, the code never arrives. More on the TAP in Temporary Access Pass.
• Enabling or disabling an account does not work for users with an Entra administrator role.

Everything beyond that, such as converting a mailbox to a shared mailbox, a ticket at the service desk or an account in an application without SCIM, you handle with a custom task extension. That calls an Azure Logic App, which you build, host and maintain yourself.

Joiners and leavers have a date. A move does not. Microsoft's mover templates therefore run on a changed field or a changed group membership, and their tasks are mainly: informing the manager and removing old access packages.

Which access belongs with the new role is a question the workflow does not answer. You design that separately, usually in access packages or in groups per role. Without that design, someone who changes department only gets an email sent to their manager, and the old access stays until someone cleans it up. How to set up groups so that they match a role is covered in Entra ID groups for role-based access.

1. 1Check that the dates are filled. Retrieve a few users with Get-MgUser -UserId <upn> -Property employeeHireDate,employeeLeaveDateTime and see whether the dates match HR.
2. 2In the Entra admin center, go to Identity Governance → Lifecycle workflows → Create workflow and choose a template, for example "Onboard new-hire employee".
3. 3Set the trigger (for example 0 days on employeeHireDate) and the scope (for example employeeType -eq "Employee").
4. 4Adjust the tasks: which groups, which Teams, which licence.
5. 5Test with Run on demand on a test user and read the result in the workflow history.
6. 6Switch the schedule on. Only then does the workflow run by itself, every three hours by default.

Connect-MgGraph -Scopes "User.Read.All","User-LifeCycleInfo.Read.All"

$vanaf = (Get-Date).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ssZ")
$tot   = (Get-Date).AddDays(7).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ssZ")

Get-MgUser -All -Property displayName,department,employeeHireDate `
  -Filter "employeeHireDate ge $vanaf and employeeHireDate le $tot" `
  -ConsistencyLevel eventual -CountVariable aantal |
  Select-Object DisplayName, Department, EmployeeHireDate

Lifecycle Workflows are a good executor within Entra ID. Three things lie outside the feature:

• The starting signal. The workflows read dates and fields; they do not fetch them from your HR system. For Workday and SAP SuccessFactors Microsoft has its own connector, for other HR systems you build it yourself, for example with API-driven inbound provisioning.
• The roles. Which groups, licences and applications belong with a role is set out in a separate design outside the workflow, and that design has to be updated with every reorganisation.
• Everything outside Entra ID. On-premises Active Directory, the mailbox, the service desk and applications without SCIM each need a Logic App per task.

If Entra ID is your only target, your HR data is already tidy in Entra and you have the Governance licence anyway, Lifecycle Workflows will take you a long way. How Microsoft's route and Joinly relate to each other is in Joinly alongside Entra ID Governance.