Audit Logs / Microsoft Entra ID AuditLogs category

Audit Logs: TaskManagement

OperationName	Description	Sample	Rule
Add task to workflow	Adds a task (a built-in automated action) to a Lifecycle Workflow definition.	N	N
Disable task	A task within a Lifecycle Workflow was disabled, so it no longer runs when the workflow executes.	N	N
Enable task	Records a task within a Lifecycle Workflow being enabled so it runs during workflow execution.	N	N
Remove task from workflow	A task was removed from a lifecycle workflow, changing the automated joiner/mover/leaver actions it performs.	N	N
Update task	A task within a Microsoft Entra Lifecycle Workflow was updated.	N	N

Add task to workflow

Source: Microsoft Entra ID audit log
Audit Category: TaskManagement

Description

Records the addition of a task to a Lifecycle Workflow definition. Tasks are the built-in automated actions a workflow runs against in-scope users, for example sending a welcome email, generating a Temporary Access Pass, or running a custom task extension.

References #

Disable task

Source: Microsoft Entra ID audit log
Audit Category: TaskManagement

Description

A task within a Lifecycle Workflow was disabled, so that task no longer runs when the workflow executes.

References #

Enable task

Source: Microsoft Entra ID audit log
Audit Category: TaskManagement

Description

Records that a task inside a Lifecycle Workflow was enabled so it executes when its parent workflow runs. Lifecycle Workflows automate joiner, mover, and leaver actions against user accounts, so enabling or disabling their tasks alters automated provisioning and deprovisioning behavior.

References #

Remove task from workflow

Source: Microsoft Entra ID audit log
Audit Category: TaskManagement

Description

A task was removed from a Microsoft Entra ID Governance lifecycle workflow, which creates a new version of that workflow without the task. This changes the automated joiner, mover, or leaver actions the workflow runs against its in-scope users.

References #

Update task

Source: Microsoft Entra ID audit log
Audit Category: TaskManagement

Description

A task within a Lifecycle Workflow was updated. Lifecycle Workflows automate joiner/mover/leaver actions through configurable built-in tasks, so changing a task alters the automated identity-governance action that runs for affected users.

References #

Rules often query computed field names, not native AuditLogs columns #

Many Entra detection rules pivot on field names that are not columns in this table but KQL projections the rule author computes from two dynamic columns. Searching the field list for those names finds nothing; use the canonical paths instead.

InitiatingUserPrincipalName (and sibling Initiating* names) is not a column. Rules project it from InitiatedBy, for example extend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName). The native paths are InitiatedBy.user.userPrincipalName, InitiatedBy.user.displayName, and InitiatedBy.user.id for user actors, and InitiatedBy.app.displayName / InitiatedBy.app.appId for application or service-principal actors.
What changed lives in TargetResources, a dynamic array. Expand it before filtering on the change: AuditLogs | mv-expand TargetResources | extend props = TargetResources.modifiedProperties, then read props[].displayName, props[].oldValue, and props[].newValue.

Column shapes per the AuditLogs table reference and the Graph directoryAudit resource.