Audit Logs / Microsoft Entra ID AuditLogs category

Audit Logs: TaskManagement

OperationName	Description	Sample	Rule
Add task to workflow	Adds a task (a built-in automated action) to a Lifecycle Workflow definition.	N	N
Disable task	A task within a Lifecycle Workflow was disabled, so it no longer runs when the workflow executes.	N	N
Enable task	Records a task within a Lifecycle Workflow being enabled so it runs during workflow execution.	N	N
Remove task from workflow	A task was removed from a lifecycle workflow, changing the automated joiner/mover/leaver actions it performs.	N	N
Update task	A task within a Microsoft Entra Lifecycle Workflow was updated.	N	N

Add task to workflow

Source: Microsoft Entra ID audit log
Audit Category: TaskManagement

Description

Records the addition of a task to a Lifecycle Workflow definition. Tasks are the built-in automated actions a workflow runs against in-scope users, for example sending a welcome email, generating a Temporary Access Pass, or running a custom task extension.

References #

Disable task

Source: Microsoft Entra ID audit log
Audit Category: TaskManagement

Description

A task within a Lifecycle Workflow was disabled, so that task no longer runs when the workflow executes.

References #

Enable task

Source: Microsoft Entra ID audit log
Audit Category: TaskManagement

Description

Records that a task inside a Lifecycle Workflow was enabled so it executes when its parent workflow runs. Lifecycle Workflows automate joiner, mover, and leaver actions against user accounts, so enabling or disabling their tasks alters automated provisioning and deprovisioning behavior.

References #

Remove task from workflow

Source: Microsoft Entra ID audit log
Audit Category: TaskManagement

Description

A task was removed from a Microsoft Entra ID Governance lifecycle workflow, which creates a new version of that workflow without the task. This changes the automated joiner, mover, or leaver actions the workflow runs against its in-scope users.

References #

Update task

Source: Microsoft Entra ID audit log
Audit Category: TaskManagement

Description

A task within a Lifecycle Workflow was updated. Lifecycle Workflows automate joiner/mover/leaver actions through configurable built-in tasks, so changing a task alters the automated identity-governance action that runs for affected users.

References #

Computed Fields in AuditLogs #

Some rules create fields that are not native AuditLogs columns. Use these source paths when searching the schema.

Initiating* values come from InitiatedBy: InitiatedBy.user.userPrincipalName, InitiatedBy.user.displayName, or InitiatedBy.user.id; application actors use InitiatedBy.app.displayName or InitiatedBy.app.appId.
Change details come from TargetResources[].modifiedProperties. Expand TargetResources before using displayName, oldValue, or newValue.

Sources: the AuditLogs table reference and Graph directoryAudit resource.