Microsoft Entra Lifecycle Workflows: Automating Joiners, Movers, and Leavers

Every time someone joins, changes roles, or leaves, IT has a list of things to do. Send the manager a first-day credential. Add the new hire to the right groups and Teams. Strip the old role’s access from a mover. Disable a leaver’s account on their last day and delete it a few weeks later.

Microsoft Entra ID, formerly called Azure Active Directory (Azure AD), can run that list for you with Lifecycle Workflows. They’re part of Microsoft Entra ID Governance, and they run tasks automatically as people move through the joiner, mover, and leaver (JML) process.

This guide explains what Lifecycle Workflows do and what they don’t, how a workflow is built from templates, triggers, scope, and tasks, what you need to license, and how to set one up. It also covers how they fit with the rest of Entra ID Governance when you manage the whole employee lifecycle in Entra ID.

TL;DR

• Lifecycle Workflows run tasks for Microsoft Entra users at each JML stage, such as emailing a manager, adding groups, assigning licenses, disabling an account, or deleting it.
• They don’t create accounts. HR-driven or API-driven provisioning creates and updates the user, and Lifecycle Workflows act on that user.
• A workflow has tasks and execution conditions. The trigger says when it runs (a date, an attribute change, a group change, or sign-in inactivity) and the scope says for whom.
• Microsoft provides built-in templates for pre-hire, first day, post-onboarding, job changes, pre-offboarding, last day, post-offboarding, and inactive users.
• You need Microsoft Entra ID Governance or the Microsoft Entra Suite, on top of Entra ID P1 or P2, for every member user in scope.

What Are Lifecycle Workflows?

Lifecycle Workflows are an identity governance feature in Microsoft Entra ID. Microsoft describes them as a way to manage Entra users across the three phases of their time with an organization:

• Joiner: someone enters the scope of needing access, such as a new employee.
• Mover: someone moves between boundaries inside the organization, such as from marketing to sales, and may need different access.
• Leaver: someone leaves the scope of needing access, such as an employee who retires or is terminated.

A workflow is a set of tasks plus the conditions under which they run. Microsoft’s own example is a workflow that sends a manager an email seven days before a new employee’s hire date. The task is “send email.” The scope is new employees. The trigger is seven days before the employeeHireDate attribute.

What Lifecycle Workflows Don’t Do

Lifecycle Workflows act on users who already exist in Microsoft Entra ID. They don’t create them, and they don’t keep their job title or department in sync with HR.

That job belongs to the Microsoft Entra provisioning service. Its HR-driven provisioning reads workers from Workday or SAP SuccessFactors, and its API-driven provisioning accepts records from any other system of record. Either one creates the user in Entra ID or on-premises Active Directory and keeps their attributes current. Microsoft puts it plainly: HR provisioning manages the creation and attribute updates of user accounts, and Lifecycle Workflows add automation of the tasks around them.

So a full Entra setup has two layers. Provisioning keeps the identity accurate, and Lifecycle Workflows act on the changes. Without a reliable hire date, leave date, and department on each user, the workflows have nothing to trigger on.

ezOnboard connects your HR system to Active Directory and Entra ID, so every user’s account, attributes, and groups follow the HR record. Book a demo to see it with your own data!

Managing the Employee Lifecycle in Entra ID

Lifecycle Workflows are one part of a larger toolkit. Here’s how the pieces of Microsoft Entra fit each stage of the employee lifecycle, and where Lifecycle Workflows come in. For the process itself, step by step, see our guide to the JML process.

Joiners

1. Create the identity from HR. HR-driven or API-driven provisioning creates the user, with a hire date, department, job title, and manager. In a hybrid environment it can create the account in on-premises Active Directory first.
2. Prepare day one. A pre-hire workflow can generate a Temporary Access Pass and email it to the manager, so the new hire can sign in and set up passwordless or multifactor sign-in on their first day.
3. Grant birthright access. Group-based access does most of the work. Dynamic groups add users by attribute, and a Lifecycle Workflow can add them to static groups, Teams, and licenses, or request an access package in entitlement management.
4. Apply security from the start. Conditional Access policies and multifactor authentication should cover every new account from its first sign-in.

Movers

1. Pick up the change. When HR changes someone’s department or job title, provisioning updates the user in Entra ID.
2. Adjust access. Dynamic groups recalculate on their own. A mover workflow can notify the manager, remove access packages and groups from the old role, and request the new role’s access package.
3. Review it. Access reviews in Entra ID Governance ask managers or resource owners to confirm that people still need what they have.

Leavers

1. Cut access on time. Provisioning disables the account in Entra ID or Active Directory when HR records the termination, and the deprovisioning flows on to connected apps. A leaver workflow can disable the account, revoke refresh tokens, and remove the user from groups and Teams on their last day, or straight away when you run it on demand.
2. Hand over data. Before an account is deleted, move ownership of files and mailboxes, and apply your retention policies.
3. Clean up. A post-offboarding workflow can remove licenses and delete the account a set number of days after the leave date.

Identity data underpins all of it. Our guide to identity lifecycle management covers which system should own each attribute and how it flows between them.

How a Lifecycle Workflow Is Built

Every workflow has three parts: basic information (a name and description), tasks, and execution conditions. In the Microsoft Entra admin center, every new workflow starts from a template or from a copy of an existing workflow. To build one from scratch, you use Microsoft Graph.

Templates

Templates give you a starting trigger, scope, and task list for a common scenario. Microsoft lists these for employees:

Two more templates move agent sponsorships to a manager when a sponsor leaves or changes roles. They need a Microsoft Agent 365 license.

Every default can be changed. Tasks can be added, removed, enabled, or disabled, and most timings can be adjusted.

Triggers

The trigger decides when a scheduled workflow runs. There are four kinds:

• Time based attribute: a number of days before, on, or after a date on the user. The usual dates are employeeHireDate, employeeLeaveDateTime, and createdDateTime.
• Attribute changes: a change to an attribute you choose, such as department or job title.
• Group membership change: the user is added to or removed from a specific group.
• Sign-in inactivity: the user hasn’t signed in for a set number of days.

A workflow can also be run on demand for chosen users. That’s how the real-time templates work, and it’s how you test a workflow. Note that an on-demand run applies the tasks whether or not the user meets the workflow’s execution conditions.

Scope

The scope decides for whom the workflow runs. For time-based, attribute, and inactivity triggers, the scope is a rule on user properties, such as department eq 'Sales' or an employee type. You build it with a property, an operator, and a value, or paste it in as rule syntax. For group membership triggers, the scope is the group.

Tasks

Tasks are the built-in actions a workflow takes, and each one belongs to one or more categories. The most useful ones include:

• Joiner: send a welcome email, send an onboarding reminder to the manager, and generate a Temporary Access Pass and send it to the manager.
• Joiner and mover: assign licenses and request an access package assignment.
• Any stage: add or remove groups and Teams, update user attributes, and run a custom task extension.
• Mover and leaver: remove access package assignments, remove selected licenses, and revoke all refresh tokens.
• Leaver: disable or delete the account, remove the user from all groups and Teams, remove all licenses, cancel pending access package requests, and email the manager before, on, or after the user’s last day.

Emails can be customized, with the user’s name, hire date, department, or manager in the subject and body.

Custom Task Extensions

When the built-in tasks aren’t enough, a custom task extension calls an Azure Logic App. That lets a workflow reach systems outside Entra ID, such as opening a ticket to collect a laptop when someone leaves, or telling payroll that a new hire has started. Microsoft allows up to 100 custom task extensions per tenant.

Scheduling, History, and Versions

Creating a workflow doesn’t schedule it. You turn scheduling on when you create the workflow or later, which leaves time to test it on a few users first. Once scheduled, the workflow is evaluated on an interval you set in the workflow settings, every three hours by default.

For time-based triggers, the user needs the right attributes before the trigger date. If HR is late and a user’s hire date lands after the intended run, Lifecycle Workflows will still process them if the details are set within three days of that run.

Each workflow keeps a history by user, by run, and by task, so you can see who was processed, what ran, and what failed. The Entra audit logs record changes too. When you change a workflow’s tasks or scope, Entra ID saves a new version, so the logs show which version processed each user.

Users Synced From On-Premises Active Directory

Lifecycle Workflows work for users synchronized from Active Directory Domain Services as well as cloud-only users. There are a few things to plan for:

• Attributes have to sync first. employeeHireDate and employeeLeaveDateTime must be synchronized to Entra ID before time-based triggers can use them, and changes in Active Directory only reach a workflow after Entra Connect Sync or Cloud Sync has run.
• Account tasks need the provisioning agent. To enable, disable, or delete accounts in Active Directory, install the Microsoft Entra provisioning agent and give its service account the right permissions. Deleting accounts also needs the Active Directory Recycle Bin.
• Group tasks work on cloud groups. Workflows can add users to Microsoft 365 groups and cloud security groups, not to groups synchronized from Active Directory. To reach Active Directory group-based apps, use cloud groups with group writeback.

If most of your access still lives in Active Directory groups, plan that part of the design before you build workflows.

Licensing and Roles

Lifecycle Workflows need Microsoft Entra ID Governance or the Microsoft Entra Suite. Entra ID Governance is an add-on that needs Entra ID P1 or P2 in the tenant, through a standalone plan or a bundle such as Microsoft 365 E3, E5, or Business Premium. Microsoft lists Entra ID Governance at $7 per user per month and the Entra Suite at $12, both paid yearly.

Licenses don’t have to be assigned to individual users, but you need enough of them to cover every member user in scope of a workflow, plus the admins who configure it. Guests are billed separately, per monthly active user, through an Azure subscription.

HR-driven and API-driven provisioning only need Entra ID P1 or P2, so you can provision from HR without Entra ID Governance and add Lifecycle Workflows later.

To create and manage workflows, an admin needs at least the Lifecycle Workflows Administrator role.

How to Create a Lifecycle Workflow

Here’s how to create a workflow from a template in the Microsoft Entra admin center.

1. Check the Prerequisites

Confirm your licenses, and make sure the users you want to target have the attributes the workflow depends on. For a joiner workflow, that means employeeHireDate. For a leaver workflow, it means employeeLeaveDateTime. The easiest way to set them is to map them from your HR system through provisioning. You can also set them with a script through Microsoft Graph, as our guide to automating Entra ID updates shows.

2. Choose a Template

Sign in to the Microsoft Entra admin center as at least a Lifecycle Workflows Administrator. Browse to ID Governance > Lifecycle workflows > Create a workflow, and choose the template that matches your scenario, such as Onboard pre-hire employee for employee preboarding.

3. Fill In the Basics

On the Basics tab, enter a unique display name and a description, and choose an administrative scope if you delegate workflow management.

4. Set the Trigger and Scope

On the Configure scope tab, choose the trigger type and its details, such as seven days before the hire date. Under Rule, enter a property, an operator, and a value, such as department equals Sales. Select View rule syntax to see or paste the full rule.

5. Review the Tasks

On the Review tasks tab, add, enable, disable, or remove tasks, and customize any emails.

6. Create, Test, Then Schedule

On the Review and create tab, check the settings and select Create. Leave the schedule off at first. Run the workflow on demand for a few test users, check the workflow history, and then turn on the schedule.

Best Practices for Lifecycle Workflows

• Fix the data first. Workflows are only as good as the hire dates, leave dates, departments, and managers on each user. Source those attributes from HR, not from manual edits.
• Keep role access in groups and access packages. Use dynamic groups and entitlement management for access that follows a role, and use workflows for the time-based steps around it. Workflows can manage static group membership, run on dates that dynamic groups can’t, and act on the group itself.
• Start small. Begin with one joiner and one leaver workflow for a single department, and widen the scope once the history looks right.
• Separate disable from delete. Disable on the last day, and delete only after data has been handed over and your retention period has passed.
• Watch for failures. Check the workflow history after each run, and treat a failed disable task as urgent.
• Review access anyway. Workflows apply the rules you give them. Regular access reviews catch access granted outside those rules.

Automate Joiners, Movers, and Leavers With ezOnboard

Lifecycle Workflows assume your users already exist in Entra ID with accurate attributes. ezOnboard is how many teams get there. It connects your HR system, such as BambooHR or Paylocity, to on-premises Active Directory and Entra ID.

Your HR system

HR records

Sync

Active Directoryand Entra ID

Accounts

New hires get their account and groups from the HR record. When people change roles, ezOnboard updates their attributes and group memberships to match. When they leave, their accounts are disabled on schedule. Because ezOnboard keeps hire dates, departments, and managers current, it also gives Lifecycle Workflows reliable data to trigger on, if you use them.

ezOnboard reduces manual work, closes the gaps that leave access open, and records every change for audit.

Schedule a demo today, or check this ROI calculator to see how much money you can save with ezOnboard.

FAQs About Microsoft Entra Lifecycle Workflows

What are Lifecycle Workflows in Microsoft Entra ID?

Lifecycle Workflows are a Microsoft Entra ID Governance feature that runs tasks automatically as users join, move within, or leave an organization. Each workflow combines tasks, such as sending an email or disabling an account, with execution conditions that say when it runs and for whom.

Do Lifecycle Workflows create user accounts?

No. Accounts are created by HR-driven or API-driven provisioning, by synchronization from Active Directory, or by an admin. Lifecycle Workflows run tasks for users who already exist, using attributes such as the hire date and leave date.

What license do Lifecycle Workflows need?

Microsoft Entra ID Governance or the Microsoft Entra Suite, alongside Entra ID P1 or P2. You need enough licenses for every member user in scope of a workflow.

Can Lifecycle Workflows manage on-premises Active Directory users?

Yes, for users synchronized to Entra ID. Enabling, disabling, and deleting their Active Directory accounts needs the Microsoft Entra provisioning agent. Group tasks work on cloud groups, which you can write back to Active Directory.

What is the difference between Lifecycle Workflows and dynamic groups?

A dynamic group adds and removes members automatically from a rule on user attributes. Lifecycle Workflows run a sequence of tasks at a point in time, such as seven days before a hire date. They can manage static groups and act on more than group membership. Many organizations use both.

Can I schedule automatic account deletion?

Yes. The Post-Offboarding of an employee template deletes the account a set number of days after the user’s leave date. Deleted users stay in the Entra ID recycle bin for 30 days before they’re removed for good.