Joiners, movers and leavers are where identity mistakes happen. A new hire waits two days for access, a promoted manager keeps their old finance permissions, a leaver’s account stays enabled for a week. Entra lifecycle workflows automate these steps from the data you already hold about each user, so the right actions happen on the right day without someone remembering a checklist.
What lifecycle workflows do
Lifecycle workflows are part of Microsoft Entra ID Governance. A workflow is a set of tasks that runs automatically for a defined group of users, triggered by a date or an attribute change. Typical tasks include:
Generating a Temporary Access Pass and emailing it to the new hire’s manager
Sending a welcome email or onboarding reminder
Adding the user to groups and Teams, or removing them
Assigning or removing licenses
Requesting or removing access package assignments
Enabling, disabling or deleting the account
Sending offboarding emails to the manager before, on or after the last day
Calling a Logic App through a custom task extension for anything the built-in tasks do not cover
Lifecycle workflows complement HR-driven provisioning. Provisioning creates accounts and keeps attributes in sync from your HR system. Workflows handle the follow-on tasks that happen around those changes.
Licensing and prerequisites
This is the first question to settle, because lifecycle workflows are not part of Business Premium or Microsoft 365 E3 on their own. Microsoft states the feature requires Microsoft Entra ID Governance or Microsoft Entra Suite licenses. Check Microsoft’s ID Governance licensing fundamentals page for the current rules before you plan a rollout.
Beyond licensing, you need:
An admin with at least the Lifecycle Workflows Administrator role.
Reliable user attributes. Workflows trigger on values like employeeHireDate and employeeLeaveDateTime, and scope on attributes like department or job title. If those fields are empty or wrong, the workflow will be too.
A source for those attributes: HR-driven provisioning, Microsoft Entra Connect from Active Directory, or a process that sets them in Entra ID.
In the tenants I review, attribute quality is the real project. The workflow itself takes an afternoon. Getting hire dates and departments populated correctly for every user takes longer.
Templates for joiner, mover and leaver
Microsoft provides templates for each stage of the lifecycle. Start from these rather than a blank workflow.
Department or title change: swap groups and access packages
Pre-offboarding of an employee
Leaver
Before last day: remove sensitive access, notify manager
Offboard an employee
Leaver
Last day: disable account, remove groups and Teams
Real-time employee termination
Leaver
Immediate termination, run on demand
Post-offboarding of an employee
Leaver
After last day: remove licenses, delete account
Building your first leaver workflow
Leavers carry the most risk, so I usually start there. The steps below use the admin center.
Go to ID Governance > Lifecycle workflows > Create a workflow.
Choose the Offboard an employee template.
Set the trigger to the leave date attribute, with an offset of 0 days to run on the last day.
Set the scope with a rule, for example all members where userType is Member and companyName matches your company, so contractors from another entity are handled separately.
Review the tasks. Keep “Disable user account”, “Remove user from all groups” and “Remove user from all Teams”. Add “Send email on user’s last day” to the manager.
Save the workflow without enabling the schedule.
Run it on demand for a test account and review the workflow history for each task’s result.
When you are confident, enable the schedule.
Pair it with a post-offboarding workflow that removes licenses and deletes the account after your retention period, for example 30 days later. That gives you a window to recover the mailbox or OneDrive if a manager needs files.
Movers: the stage most businesses ignore
Joiners get attention because someone is waiting. Leavers get attention because auditors ask about them. Movers quietly accumulate access. A user who moves from finance to sales often keeps finance group memberships for years.
A mover workflow triggered by a department attribute change can remove the old department’s groups and access packages and request the new ones. If you already use Microsoft 365 groups for access, this is a straightforward way to keep memberships aligned with the job the person actually does today.
Tips that save trouble later
Some tasks have limits. For example, “Add user to groups” supports Microsoft 365 and cloud-only security groups, not dynamic, mail-enabled, distribution or role-assignable groups.
For on-premises AD group access, you need group writeback configured.
Keep emergency access and service accounts out of scope.
Review workflow run history weekly at first, then monthly.
Use the inactivity trigger to disable accounts that have not signed in for a set number of days.
Measuring whether it works
Automation is only useful if you can prove it ran. Each workflow keeps a history of runs, users processed and the result of every task. Once a month, compare that history against your HR leaver list. Any leaver who does not appear in the workflow history, or who appears with a failed task, points to a missing attribute or a scope rule that is too narrow. Fixing those gaps early is far easier than explaining them to an auditor or a cyber insurer later.
It is also worth agreeing ownership up front. HR owns the dates and the job data. IT owns the workflows and the tasks. Managers own the requests for extra access. When everyone knows which part they own, the automation stays accurate instead of slowly drifting away from reality.
Where lifecycle workflows fit with other controls
Workflows decide when access changes. Other controls decide what access is. Dynamic groups and access packages define the access each role should have. Conditional Access and Intune compliance decide how that access is used. Continuous access evaluation makes sure a disabled account loses its sessions quickly. Put together, a leaver’s account is disabled on the right day and their open sessions end within minutes.
Can I use lifecycle workflows without an HR system integration?
Yes. Workflows only need the trigger attributes, such as hire date and leave date, to be populated in Entra ID. You can set them from Active Directory through Entra Connect, through a script, or manually as part of your HR process.
Are lifecycle workflows included in Microsoft 365 Business Premium?
No. Business Premium includes Entra ID P1. Lifecycle workflows require Microsoft Entra ID Governance or Microsoft Entra Suite licensing on top.
Can a workflow run immediately for a sudden termination?
Yes. Use the real-time employee termination template, or run any workflow on demand for selected users. Combine it with a session revocation so the user loses access to open apps straight away.
Still offboarding from a spreadsheet? Book a free Microsoft 365 security assessment and we will show you which accounts and permissions your current process is leaving behind.
Joiners, movers and leavers are where identity mistakes happen. A new hire waits two days for access, a promoted manager keeps their old finance permissions, a leaver’s account stays enabled for a week. Entra lifecycle workflows automate these steps from the data you already hold about each user, so the right actions happen on the right day without someone remembering a checklist.
What lifecycle workflows do
Lifecycle workflows are part of Microsoft Entra ID Governance. A workflow is a set of tasks that runs automatically for a defined group of users, triggered by a date or an attribute change. Typical tasks include:
Lifecycle workflows complement HR-driven provisioning. Provisioning creates accounts and keeps attributes in sync from your HR system. Workflows handle the follow-on tasks that happen around those changes.
Licensing and prerequisites
This is the first question to settle, because lifecycle workflows are not part of Business Premium or Microsoft 365 E3 on their own. Microsoft states the feature requires Microsoft Entra ID Governance or Microsoft Entra Suite licenses. Check Microsoft’s ID Governance licensing fundamentals page for the current rules before you plan a rollout.
Beyond licensing, you need:
employeeHireDateandemployeeLeaveDateTime, and scope on attributes like department or job title. If those fields are empty or wrong, the workflow will be too.In the tenants I review, attribute quality is the real project. The workflow itself takes an afternoon. Getting hire dates and departments populated correctly for every user takes longer.
Templates for joiner, mover and leaver
Microsoft provides templates for each stage of the lifecycle. Start from these rather than a blank workflow.
Building your first leaver workflow
Leavers carry the most risk, so I usually start there. The steps below use the admin center.
ID Governance > Lifecycle workflows > Create a workflow.userTypeis Member andcompanyNamematches your company, so contractors from another entity are handled separately.Pair it with a post-offboarding workflow that removes licenses and deletes the account after your retention period, for example 30 days later. That gives you a window to recover the mailbox or OneDrive if a manager needs files.
Movers: the stage most businesses ignore
Joiners get attention because someone is waiting. Leavers get attention because auditors ask about them. Movers quietly accumulate access. A user who moves from finance to sales often keeps finance group memberships for years.
A mover workflow triggered by a department attribute change can remove the old department’s groups and access packages and request the new ones. If you already use Microsoft 365 groups for access, this is a straightforward way to keep memberships aligned with the job the person actually does today.
Tips that save trouble later
Measuring whether it works
Automation is only useful if you can prove it ran. Each workflow keeps a history of runs, users processed and the result of every task. Once a month, compare that history against your HR leaver list. Any leaver who does not appear in the workflow history, or who appears with a failed task, points to a missing attribute or a scope rule that is too narrow. Fixing those gaps early is far easier than explaining them to an auditor or a cyber insurer later.
It is also worth agreeing ownership up front. HR owns the dates and the job data. IT owns the workflows and the tasks. Managers own the requests for extra access. When everyone knows which part they own, the automation stays accurate instead of slowly drifting away from reality.
Where lifecycle workflows fit with other controls
Workflows decide when access changes. Other controls decide what access is. Dynamic groups and access packages define the access each role should have. Conditional Access and Intune compliance decide how that access is used. Continuous access evaluation makes sure a disabled account loses its sessions quickly. Put together, a leaver’s account is disabled on the right day and their open sessions end within minutes.
Microsoft’s lifecycle workflows overview lists every task and trigger. If you want help mapping your HR process to workflows, our Microsoft 365 managed service includes identity lifecycle design, and the Microsoft 365 security assessment flags stale and over-privileged accounts left behind by manual processes.
Frequently asked questions
Can I use lifecycle workflows without an HR system integration?
Yes. Workflows only need the trigger attributes, such as hire date and leave date, to be populated in Entra ID. You can set them from Active Directory through Entra Connect, through a script, or manually as part of your HR process.
Are lifecycle workflows included in Microsoft 365 Business Premium?
No. Business Premium includes Entra ID P1. Lifecycle workflows require Microsoft Entra ID Governance or Microsoft Entra Suite licensing on top.
Can a workflow run immediately for a sudden termination?
Yes. Use the real-time employee termination template, or run any workflow on demand for selected users. Combine it with a session revocation so the user loses access to open apps straight away.
Still offboarding from a spreadsheet? Book a free Microsoft 365 security assessment and we will show you which accounts and permissions your current process is leaving behind.