Audit Logs / Microsoft Entra ID AuditLogs category

Audit Logs: WorkflowManagement

OperationName	Description	Sample	Rule
Add execution conditions	Execution conditions (trigger plus scope) were added to a Lifecycle Workflow, defining when and for whom it runs.	N	N
Add workflow version	Creates a new version of a Lifecycle Workflow (workflow edits produce new versions).	N	N
Create workflow	Creation of an Entra ID Governance Lifecycle Workflow automating joiner/mover/leaver tasks.	N	N
Delete workflow	A Lifecycle Workflows joiner/mover/leaver workflow was deleted.	N	N
Disable workflow	A Lifecycle Workflow was disabled, stopping it from running on schedule or on demand.	N	N
Disable workflow schedule	Scheduled execution for a Lifecycle Workflow was turned off, so it no longer runs automatically.	N	N
Enable workflow	Records a Lifecycle Workflow being enabled, activating its automated joiner/mover/leaver tasks.	N	N
Enable workflow schedule	Records scheduling being enabled for a Lifecycle Workflow so the engine runs it automatically on its trigger schedule.	N	N
Hard delete workflow	Permanent, non-recoverable deletion of a Lifecycle Workflow.	N	N
On-demand workflow execution completed	A manually triggered (on-demand) Lifecycle Workflows execution finished.	N	N
Restore workflow	A soft-deleted Lifecycle Workflow was restored from the deleted-workflows list.	N	N
Schedule workflow execution completed	A scheduled Lifecycle Workflows processing run finished evaluating in-scope users.	N	N
Schedule workflow execution started	A scheduled Lifecycle Workflows processing run began evaluating in-scope users.	N	N
Set workflow for on-demand execution	A Lifecycle Workflow was set to run on demand against selected users (an immediate, non-scheduled run).	N	N
Update execution conditions	A lifecycle workflow's execution conditions (trigger plus user scope) were updated.	N	N
Update tenant settings	A tenant-wide Lifecycle Workflows setting (global joiner/mover/leaver automation config) was changed.	N	N
Update workflow	A Lifecycle Workflow (joiner/mover/leaver automation: tasks, scope, or enabled state) was modified.	N	N

Add execution conditions

Source: Microsoft Entra ID audit log
Audit Category: WorkflowManagement

Description

Execution conditions were added to a Lifecycle Workflow, defining the trigger (when the workflow runs, such as a time-based attribute, attribute change, group-membership change, sign-in activity, or on-demand) and the scope (which users it runs for). These conditions determine which joiner/mover/leaver automation fires and against whom.

References #

Add workflow version

Source: Microsoft Entra ID audit log
Audit Category: WorkflowManagement

Description

Records the creation of a new version of a Lifecycle Workflow. Lifecycle Workflows are versioned, and editing a workflow's configuration produces a new workflow version; this entry captures that a new version was added.

References #

Create workflow

Source: Microsoft Entra ID audit log
Audit Category: WorkflowManagement

Description

Records the creation of a Microsoft Entra ID Governance Lifecycle Workflow that automates joiner, mover, or leaver (JML) tasks, such as enabling or disabling accounts and sending notifications, triggered by user lifecycle events or on a schedule.

References #

Delete workflow

Source: Microsoft Entra ID audit log
Audit Category: WorkflowManagement

Description

Records the deletion of a Lifecycle Workflows workflow in Microsoft Entra ID Governance, an automation that runs joiner, mover, or leaver tasks. Deleting a workflow stops its scheduled and on-demand runs. The reference lists a separate 'Hard delete workflow' and a 'Restore workflow', indicating this 'Delete workflow' is a recoverable soft delete.

References #

Disable workflow

Source: Microsoft Entra ID audit log
Audit Category: WorkflowManagement

Description

A Lifecycle Workflow was disabled, stopping it from running on its schedule or on demand against users that meet its execution conditions.

References #

Disable workflow schedule

Source: Microsoft Entra ID audit log
Audit Category: WorkflowManagement

Description

Scheduled (automatic) execution for a Lifecycle Workflow was turned off, so the workflow no longer runs automatically against users meeting its execution conditions; it can still be run on demand.

References #

Enable workflow

Source: Microsoft Entra ID audit log
Audit Category: WorkflowManagement

Description

Records that a Lifecycle Workflow was enabled, activating its automated joiner, mover, and leaver tasks (such as enabling or disabling user accounts and adding or removing group and license assignments). Enabling a workflow turns on automation that changes account state at scale.

References #

Enable workflow schedule

Source: Microsoft Entra ID audit log
Audit Category: WorkflowManagement

Description

Records that scheduling was enabled for a Lifecycle Workflow, allowing the workflow engine to run it automatically on its configured trigger interval rather than only on demand. Scheduling for a newly created workflow must be turned on explicitly, so this entry marks the transition to automated, time-triggered execution.

References #

Hard delete workflow

Source: Microsoft Entra ID audit log
Audit Category: WorkflowManagement

Description

Records the permanent deletion of a Lifecycle Workflow, either an administrator selecting Delete permanently on a soft-deleted workflow or the automatic purge 30 days after soft deletion. Permanently deleted workflows cannot be restored, removing an automated joiner/mover/leaver identity process.

References #

On-demand workflow execution completed

Source: Microsoft Entra ID audit log
Audit Category: WorkflowManagement

Description

Records that an on-demand (manually triggered) Lifecycle Workflows run finished. Lifecycle Workflows logs an event each time a workflow is processed, under the WorkflowManagement category, which covers events dealing with the workflow itself; this entry marks completion of a workflow that was run on demand rather than on its schedule.

References #

Restore workflow

Source: Microsoft Entra ID audit log
Audit Category: WorkflowManagement

Description

A soft-deleted Lifecycle Workflow was restored from the deleted-workflows list within its 30-day soft-delete window, returning the workflow to active state. Lifecycle Workflows run automated joiner/mover/leaver tasks against users, so restoring one re-enables that automation.

References #

Schedule workflow execution completed

Source: Microsoft Entra ID audit log
Audit Category: WorkflowManagement

Description

Records that a tenant's scheduled Lifecycle Workflows processing run finished. Lifecycle Workflows evaluate their execution conditions against in-scope users on a schedule (every three hours by default, configurable in workflow settings), and this entry marks the completion of one such scheduled cycle.

References #

Schedule workflow execution started

Source: Microsoft Entra ID audit log
Audit Category: WorkflowManagement

Description

Records that a tenant's scheduled Lifecycle Workflows processing run began. On its schedule (every three hours by default, configurable in workflow settings), Lifecycle Workflows begins evaluating its execution conditions against in-scope users, and this entry marks the start of one such cycle.

References #

Set workflow for on-demand execution

Source: Microsoft Entra ID audit log
Audit Category: WorkflowManagement

Description

A Lifecycle Workflow was set to run on demand against a selected set of users, triggering an immediate (non-scheduled) execution. On-demand runs of joiner/mover/leaver workflows can perform account and access changes, so unexpected executions merit review.

References #

Update execution conditions

Source: Microsoft Entra ID audit log
Audit Category: WorkflowManagement

Description

A Microsoft Entra lifecycle workflow's execution conditions were updated. Execution conditions consist of the trigger (when the workflow runs, such as a time-based attribute, an attribute change, a group-membership change, or sign-in activity) and the scope (which users it runs for), so the record reflects a change to when and for whom an automated joiner, mover, or leaver workflow fires.

References #

Update tenant settings

Source: Microsoft Entra ID audit log
Audit Category: WorkflowManagement

Description

A tenant-wide Lifecycle Workflows setting was changed, modifying the global configuration for the Microsoft Entra ID Governance joiner/mover/leaver automation feature. The change is recorded under the WorkflowManagement audit category.

References #

Update workflow

Source: Microsoft Entra ID audit log
Audit Category: WorkflowManagement

Description

A Microsoft Entra Lifecycle Workflow was modified, changing the automated joiner/mover/leaver process (its tasks, execution conditions/scope, or enabled state). Because workflows can disable or delete user accounts and grant or remove access packages, unauthorized changes are relevant to account-lifecycle tampering and deprovisioning evasion.

References #

Rules often query computed field names, not native AuditLogs columns #

Many Entra detection rules pivot on field names that are not columns in this table but KQL projections the rule author computes from two dynamic columns. Searching the field list for those names finds nothing; use the canonical paths instead.

InitiatingUserPrincipalName (and sibling Initiating* names) is not a column. Rules project it from InitiatedBy, for example extend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName). The native paths are InitiatedBy.user.userPrincipalName, InitiatedBy.user.displayName, and InitiatedBy.user.id for user actors, and InitiatedBy.app.displayName / InitiatedBy.app.appId for application or service-principal actors.
What changed lives in TargetResources, a dynamic array. Expand it before filtering on the change: AuditLogs | mv-expand TargetResources | extend props = TargetResources.modifiedProperties, then read props[].displayName, props[].oldValue, and props[].newValue.

Column shapes per the AuditLogs table reference and the Graph directoryAudit resource.