Lifecycle Workflows Lifecycle Workflows

Joiner-, Mover- und Leaver-Automatisierung mit Triggern, Built-in Tasks, Custom Extensions, Monitoring und Graph/PowerShell-Referenz. Joiner, mover, and leaver automation with triggers, built-in tasks, custom extensions, monitoring, and Graph/PowerShell reference.

Joiner, Mover, Leaver Joiner, mover, leaver

Lifecycle Workflows orchestrieren standardisierte Identity-Governance-Abläufe ohne manuelle Einzelschritte. Lifecycle workflows orchestrate standardized identity-governance flows without manual one-off steps.

Zeit- und Ereignistrigger Time and event triggers

Workflows können auf employeeHireDate, employeeLeaveDateTime, Attributänderungen oder On-Demand-Läufe reagieren. Workflows can react to employeeHireDate, employeeLeaveDateTime, attribute changes, or on-demand runs.

Custom Extensions Custom extensions

Logic Apps und Azure Functions erweitern den Standardtaskkatalog für Drittsysteme und Spezialprozesse. Logic Apps and Azure Functions extend the built-in task catalog for third-party systems and special processes.

Task-Level Monitoring Task-level monitoring

Jede Ausführung ist mit Workflow-, Ausführungs- und Taskstatus nachvollziehbar. Every execution is traceable with workflow, run, and task status.

Überblick, Architektur und Trigger Overview, architecture, and triggers

Baustein Building block	Beschreibung Description	Praxis Practice
Workflow Template Workflow template	Vordefinierter oder eigener Workflow mit Trigger, Scope und Tasks. Predefined or custom workflow with trigger, scope, and tasks.	Templates beschleunigen Joiner/Mover/Leaver-Szenarien. Templates accelerate joiner/mover/leaver scenarios.
Execution Conditions Execution conditions	Regelbasierte Scope-Definition für betroffene Benutzer. Rule-based scope definition for affected users.	Mit HR-Attributen und Abteilungsdaten kombinieren. Combine with HR attributes and department data.
Time-based Trigger Time-based trigger	Reagiert auf employeeHireDate oder employeeLeaveDateTime relativ zu einem Datum. Reacts to employeeHireDate or employeeLeaveDateTime relative to a date.	Für Vorab-Lizenzierung oder spätere Löschung ideal. Ideal for pre-licensing or delayed deletion.
Attribute-change Trigger Attribute-change trigger	Startet bei Änderungen an definierten Profilattributen. Starts when defined profile attributes change.	Typisch für Mover-Szenarien. Typical for mover scenarios.
On-demand On-demand	Manuell angestoßener Workflow für Ausnahmefälle. Manually triggered workflow for exception cases.	Hilfreich für Nacharbeiten und Sonderfälle. Helpful for rework and exceptions.

Built-in Tasks mit Parametern Built-in tasks with parameters

Task Task	Wichtige Parameter Key parameters	Wirkung Effect
Generate TAP Generate TAP	lifetimeInMinutes, isUsableOnce lifetimeInMinutes, isUsableOnce	Erzeugt Temporary Access Pass für Bootstrap oder Recovery. Generates a Temporary Access Pass for bootstrap or recovery.
Send welcome email Send welcome email	recipient, template, language recipient, template, language	Informiert neue Mitarbeiter oder Manager. Informs new employees or managers.
Add to group Add to group	groupId groupId	Nimmt Benutzer in Sicherheits- oder M365-Gruppen auf. Adds users to security or M365 groups.
Add to team Add to team	teamId, role teamId, role	Bindet Benutzer in operative Teams ein. Places users into operational teams.
Assign license Assign license	skuId, disabledPlans skuId, disabledPlans	Weist Lizenzen während Joiner-Prozessen zu. Assigns licenses during joiner processes.
Enable account Enable account	none none	Schaltet das Konto frei. Enables the account.
Run custom extension Run custom extension	endpoint, timeout, retry endpoint, timeout, retry	Ruft Logic Apps oder Azure Functions an. Calls Logic Apps or Azure Functions.
Remove from group Remove from group	groupId groupId	Entfernt Gruppenmitgliedschaften. Removes group membership.
Remove from team Remove from team	teamId teamId	Entfernt Benutzer aus Teams. Removes users from Teams.
Disable account Disable account	none none	Sperrt Anmeldung beim Leaver-Prozess. Blocks sign-in during leaver workflow.
Remove all licenses Remove all licenses	none none	Entzieht alle Lizenzzuweisungen. Removes all license assignments.
Revoke sign-in sessions Revoke sign-in sessions	none none	Beendet aktive Sitzungen und Refresh Tokens. Ends active sessions and refresh tokens.
Transfer ownership Transfer ownership	managerId or targetUserId managerId or targetUserId	Überträgt Gruppen- oder App-Ownership. Transfers group or app ownership.
Remove access Remove access	scope settings scope settings	Sammelt mehrere Offboarding-Schritte. Collects several offboarding actions.
Delete user Delete user	delay or direct delete delay or direct delete	Löscht das Konto nach Retention-Fenstern. Deletes the account after retention windows.
Send offboarding email Send offboarding email	recipient, template recipient, template	Informiert Manager und Stakeholder über Offboarding. Informs managers and stakeholders about offboarding.

Custom Task Extensions, Versionierung und Monitoring Custom task extensions, versioning, and monitoring

Thema Topic	Beschreibung Description	Empfehlung Recommendation
Logic Apps Integration Logic Apps integration	Nutzt HTTP-basierte Custom Extensions für lineare oder zustandsbehaftete Prozesse. Uses HTTP-based custom extensions for linear or stateful processes.	Ideal für ServiceNow, HR-Systeme und E-Mail-Workflows. Ideal for ServiceNow, HR systems, and email workflows.
Azure Functions Azure Functions	Leichtgewichtige Erweiterung für Berechnung, Lookup oder proprietäre APIs. Lightweight extension for calculations, lookups, or proprietary APIs.	Mit Managed Identity absichern. Secure with managed identity.
Versioning Versioning	Workflow-Versionen erlauben kontrollierte Änderungen ohne Blindflug. Workflow versions allow controlled changes without flying blind.	Vor Produktivwechsel immer Staging und Simulation nutzen. Use staging and simulation before production cutover.
History History	Run-Historie mit Taskstatus, Dauer und Fehlerdetails. Run history with task status, duration, and error details.	Nützlich für Audit und SLA-Messung. Useful for audit and SLA measurement.
Insights Insights	Workflow Insights zeigen Erfolgsquote, Latenz und Fehlermuster. Workflow insights show success rate, latency, and failure patterns.	Mit KQL und Workbook ergänzen. Augment with KQL and workbooks.

JSON JSON

{
  "category": "joiner",
  "displayName": "Joiner - Standard Employee",
  "isEnabled": true,
  "executionConditions": {
    "scope": {
      "rule": "user.department -in ["Sales","Marketing"]"
    },
    "trigger": {
      "type": "timeBased",
      "timeBasedAttribute": "employeeHireDate",
      "offsetInDays": -2
    }
  }
}

Graph API, PowerShell und reale Szenarien Graph API, PowerShell, and real scenarios

API / Cmdlet API / cmdlet	Zweck Purpose	Hinweis Note
GET /identityGovernance/lifecycleWorkflows/workflows GET /identityGovernance/lifecycleWorkflows/workflows	Listet Workflows und Konfiguration. Lists workflows and configuration.	Für Inventur und Backup des Governance-Designs. For inventory and backup of governance design.
POST /identityGovernance/lifecycleWorkflows/workflows POST /identityGovernance/lifecycleWorkflows/workflows	Erstellt einen Workflow. Creates a workflow.	Beta/Versionen der API je nach Featurestand prüfen. Validate beta/version behavior per feature set.
GET /identityGovernance/lifecycleWorkflows/workflows/{id}/runs GET /identityGovernance/lifecycleWorkflows/workflows/{id}/runs	Liest Ausführungen und Fehler. Reads executions and failures.	Zentrale Quelle für Betrieb und Audit. Central source for operations and audit.
Invoke-MgGraphRequest Invoke-MgGraphRequest	Graph PowerShell für Konfiguration und Monitoring. Graph PowerShell for configuration and monitoring.	Pragmatischer Weg bis dedizierte Cmdlets alle Features abdecken. Pragmatic route until dedicated cmdlets cover all features.

PowerShell PowerShell

Connect-MgGraph -Scopes "LifecycleWorkflows.ReadWrite.All"
Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/beta/identityGovernance/lifecycleWorkflows/workflows"

JSON JSON

{
  "scenario": "Leaver",
  "steps": [
    "Disable account on leave date",
    "Revoke sign-in sessions",
    "Remove from privileged groups",
    "Transfer ownership to manager",
    "Remove licenses after 7 days",
    "Delete user after retention window"
  ]
}

Betriebscheckliste Operational checklist

Checkpunkt Checkpoint	Erwarteter Zustand Expected state	Bewertung Assessment
HR-Attribute gepflegt HR attributes maintained	employeeHireDate, employeeLeaveDateTime und Manager stimmen. employeeHireDate, employeeLeaveDateTime, and manager are correct.	Ja/Nein Yes/No
Joiner Pilot Joiner pilot	Lizenzierung, Gruppen und TAP getestet. Licensing, groups, and TAP tested.	Ja/Nein Yes/No
Mover Trigger Mover trigger	Abteilungs- oder Standortwechsel erzeugen erwartete Tasks. Department or location changes create expected tasks.	Ja/Nein Yes/No
Leaver Delay Leaver delay	Disable, revoke, remove license und delete zeitlich abgestimmt. Disable, revoke, remove license, and delete are time-aligned.	Ja/Nein Yes/No
Custom Extensions abgesichert Custom extensions secured	Logic App/Function nutzt Managed Identity und Input Validation. Logic App/Function uses managed identity and input validation.	Ja/Nein Yes/No
Run-History überwacht Run history monitored	Fehler und Retries landen im Operations-Board. Failures and retries reach the operations board.	Ja/Nein Yes/No
Versionierung genutzt Versioning used	Änderungen nicht direkt ungeprüft in Produktion. Changes are not pushed untested directly to production.	Ja/Nein Yes/No
Rollback definiert Rollback defined	Fehlgeschlagene Joiner/Leaver-Schritte haben Gegenmaßnahmen. Failed joiner/leaver steps have corrective actions.	Ja/Nein Yes/No

Glossar & Schnellreferenz Glossary & quick reference

Begriff Term	Definition Definition
Joiner Joiner	Workflow für Neueintritt. Workflow for onboarding.
Mover Mover	Workflow für Rollen- oder Bereichswechsel. Workflow for role or department changes.
Leaver Leaver	Workflow für Offboarding. Workflow for offboarding.
Execution Conditions Execution Conditions	Scope und Triggerdefinition. Scope and trigger definition.
Custom Extension Custom Extension	Extern aufgerufene Logik. Externally invoked logic.
Run History Run History	Historie einzelner Ausführungen. History of individual executions.
Task Processing Result Task Processing Result	Status einer einzelnen Task. Status of a single task.
On-demand On-demand	Manuell gestarteter Workflow. Manually started workflow.