Audit Logs / Microsoft Entra ID AuditLogs category

Audit Logs: WorkflowManagement

OperationName	Description	Sample	Rule
Add execution conditions	Execution conditions (trigger plus scope) were added to a Lifecycle Workflow, defining when and for whom it runs.	N	N
Add workflow version	Creates a new version of a Lifecycle Workflow (workflow edits produce new versions).	N	N
Create workflow	Creation of an Entra ID Governance Lifecycle Workflow automating joiner/mover/leaver tasks.	N	N
Delete workflow	A Lifecycle Workflows joiner/mover/leaver workflow was deleted.	N	N
Disable workflow	A Lifecycle Workflow was disabled, stopping it from running on schedule or on demand.	N	N
Disable workflow schedule	Scheduled execution for a Lifecycle Workflow was turned off, so it no longer runs automatically.	N	N
Enable workflow	Records a Lifecycle Workflow being enabled, activating its automated joiner/mover/leaver tasks.	N	N
Enable workflow schedule	Records scheduling being enabled for a Lifecycle Workflow so the engine runs it automatically on its trigger schedule.	N	N
Hard delete workflow	Permanent, non-recoverable deletion of a Lifecycle Workflow.	N	N
On-demand workflow execution completed	A manually triggered (on-demand) Lifecycle Workflows execution finished.	N	N
Restore workflow	A soft-deleted Lifecycle Workflow was restored from the deleted-workflows list.	N	N
Schedule workflow execution completed	A scheduled Lifecycle Workflows processing run finished evaluating in-scope users.	N	N
Schedule workflow execution started	A scheduled Lifecycle Workflows processing run began evaluating in-scope users.	N	N
Set workflow for on-demand execution	A Lifecycle Workflow was set to run on demand against selected users (an immediate, non-scheduled run).	N	N
Update execution conditions	A lifecycle workflow's execution conditions (trigger plus user scope) were updated.	N	N
Update tenant settings	A tenant-wide Lifecycle Workflows setting (global joiner/mover/leaver automation config) was changed.	N	N
Update workflow	A Lifecycle Workflow (joiner/mover/leaver automation: tasks, scope, or enabled state) was modified.	N	N

Add execution conditions

Source: Microsoft Entra ID audit log
Audit Category: WorkflowManagement

Description

Execution conditions were added to a Lifecycle Workflow, defining the trigger (when the workflow runs, such as a time-based attribute, attribute change, group-membership change, sign-in activity, or on-demand) and the scope (which users it runs for). These conditions determine which joiner/mover/leaver automation fires and against whom.

References #

Add workflow version

Source: Microsoft Entra ID audit log
Audit Category: WorkflowManagement

Description

Records the creation of a new version of a Lifecycle Workflow. Lifecycle Workflows are versioned, and editing a workflow's configuration produces a new workflow version; this entry captures that a new version was added.

References #

Create workflow

Source: Microsoft Entra ID audit log
Audit Category: WorkflowManagement

Description

Records the creation of a Microsoft Entra ID Governance Lifecycle Workflow that automates joiner, mover, or leaver (JML) tasks, such as enabling or disabling accounts and sending notifications, triggered by user lifecycle events or on a schedule.

References #

Delete workflow

Source: Microsoft Entra ID audit log
Audit Category: WorkflowManagement

Description

Records the deletion of a Lifecycle Workflows workflow in Microsoft Entra ID Governance, an automation that runs joiner, mover, or leaver tasks. Deleting a workflow stops its scheduled and on-demand runs. The reference lists a separate 'Hard delete workflow' and a 'Restore workflow', indicating this 'Delete workflow' is a recoverable soft delete.

References #

Disable workflow

Source: Microsoft Entra ID audit log
Audit Category: WorkflowManagement

Description

A Lifecycle Workflow was disabled, stopping it from running on its schedule or on demand against users that meet its execution conditions.

References #

Disable workflow schedule

Source: Microsoft Entra ID audit log
Audit Category: WorkflowManagement

Description

Scheduled (automatic) execution for a Lifecycle Workflow was turned off, so the workflow no longer runs automatically against users meeting its execution conditions; it can still be run on demand.

References #

Enable workflow

Source: Microsoft Entra ID audit log
Audit Category: WorkflowManagement

Description

Records that a Lifecycle Workflow was enabled, activating its automated joiner, mover, and leaver tasks (such as enabling or disabling user accounts and adding or removing group and license assignments). Enabling a workflow turns on automation that changes account state at scale.

References #

Enable workflow schedule

Source: Microsoft Entra ID audit log
Audit Category: WorkflowManagement

Description

Records that scheduling was enabled for a Lifecycle Workflow, allowing the workflow engine to run it automatically on its configured trigger interval rather than only on demand. Scheduling for a newly created workflow must be turned on explicitly, so this entry marks the transition to automated, time-triggered execution.

References #

Hard delete workflow

Source: Microsoft Entra ID audit log
Audit Category: WorkflowManagement

Description

Records the permanent deletion of a Lifecycle Workflow, either an administrator selecting Delete permanently on a soft-deleted workflow or the automatic purge 30 days after soft deletion. Permanently deleted workflows cannot be restored, removing an automated joiner/mover/leaver identity process.

References #

On-demand workflow execution completed

Source: Microsoft Entra ID audit log
Audit Category: WorkflowManagement

Description

Records that an on-demand (manually triggered) Lifecycle Workflows run finished. Lifecycle Workflows logs an event each time a workflow is processed, under the WorkflowManagement category, which covers events dealing with the workflow itself; this entry marks completion of a workflow that was run on demand rather than on its schedule.

References #

Restore workflow

Source: Microsoft Entra ID audit log
Audit Category: WorkflowManagement

Description

A soft-deleted Lifecycle Workflow was restored from the deleted-workflows list within its 30-day soft-delete window, returning the workflow to active state. Lifecycle Workflows run automated joiner/mover/leaver tasks against users, so restoring one re-enables that automation.

References #

Schedule workflow execution completed

Source: Microsoft Entra ID audit log
Audit Category: WorkflowManagement

Description

Records that a tenant's scheduled Lifecycle Workflows processing run finished. Lifecycle Workflows evaluate their execution conditions against in-scope users on a schedule (every three hours by default, configurable in workflow settings), and this entry marks the completion of one such scheduled cycle.

References #

Schedule workflow execution started

Source: Microsoft Entra ID audit log
Audit Category: WorkflowManagement

Description

Records that a tenant's scheduled Lifecycle Workflows processing run began. On its schedule (every three hours by default, configurable in workflow settings), Lifecycle Workflows begins evaluating its execution conditions against in-scope users, and this entry marks the start of one such cycle.

References #

Set workflow for on-demand execution

Source: Microsoft Entra ID audit log
Audit Category: WorkflowManagement

Description

A Lifecycle Workflow was set to run on demand against a selected set of users, triggering an immediate (non-scheduled) execution. On-demand runs of joiner/mover/leaver workflows can perform account and access changes, so unexpected executions merit review.

References #

Update execution conditions

Source: Microsoft Entra ID audit log
Audit Category: WorkflowManagement

Description

A Microsoft Entra lifecycle workflow's execution conditions were updated. Execution conditions consist of the trigger (when the workflow runs, such as a time-based attribute, an attribute change, a group-membership change, or sign-in activity) and the scope (which users it runs for), so the record reflects a change to when and for whom an automated joiner, mover, or leaver workflow fires.

References #

Update tenant settings

Source: Microsoft Entra ID audit log
Audit Category: WorkflowManagement

Description

A tenant-wide Lifecycle Workflows setting was changed, modifying the global configuration for the Microsoft Entra ID Governance joiner/mover/leaver automation feature. The change is recorded under the WorkflowManagement audit category.

References #

Update workflow

Source: Microsoft Entra ID audit log
Audit Category: WorkflowManagement

Description

A Microsoft Entra Lifecycle Workflow was modified, changing the automated joiner/mover/leaver process (its tasks, execution conditions/scope, or enabled state). Because workflows can disable or delete user accounts and grant or remove access packages, unauthorized changes are relevant to account-lifecycle tampering and deprovisioning evasion.

References #

Computed Fields in AuditLogs #

Some rules create fields that are not native AuditLogs columns. Use these source paths when searching the schema.

Initiating* values come from InitiatedBy: InitiatedBy.user.userPrincipalName, InitiatedBy.user.displayName, or InitiatedBy.user.id; application actors use InitiatedBy.app.displayName or InitiatedBy.app.appId.
Change details come from TargetResources[].modifiedProperties. Expand TargetResources before using displayName, oldValue, or newValue.

Sources: the AuditLogs table reference and Graph directoryAudit resource.