Microsoft Entra ID Governance deployment guide for employee lifecycle automation

Deployment scenarios are guidance on how to combine and test Microsoft Security products and services. You can discover how capabilities work together to improve productivity, strengthen security, and more easily meet compliance and regulatory requirements.

The following products and services appear in this guide:

• Microsoft Entra ID Governance
• Lifecycle workflows
• Microsoft Entra
• Microsoft Entra Connect
• Microsoft Entra Cloud Sync
• Azure Logic Apps
• Microsoft Graph

Use this scenario to help determine the need for Microsoft Entra ID Governance to create and grant access for your organization. Learn how you can provision your users effectively, securely, and consistently with employee lifecycle automation.

Timelines

Timelines show approximate delivery stage duration and are based on scenario complexity. Times are estimations and vary depending on the environment.

1. HR provisioning - 3 hours
2. Software-as-a-Service (SaaS) app provisioning - 1 hour
3. Lifecycle workflows - 3 hours

Employee lifecycle automation

To streamline employee identity management, organizations are adopting modern solutions and automation. With identity management systems and technologies, IT staff can overcome limited manual procedures and instead enhance efficiency.

Microsoft Entra ID Governance

With the Microsoft Entra ID Governance solution, organizations improve productivity, strengthen security, and meet compliance and regulatory requirements. Use Microsoft Entra ID Governance to ensure the right people have the right access to the right resources at the right time. Learn more about Microsoft Entra ID Governance use cases and documentation.

HR-driven provisioning

HR-driven provisioning creates digital identities based on a human resources (HR) system, which becomes the source of authority. This juncture is the starting point for numerous provisioning processes.

Cloud HR to Microsoft Entra ID

Users are created in Microsoft Entra ID, and other SaaS apps that support user provisioning. When employee records are updated in cloud HR, the user account is updated in Microsoft Entra ID and supporting SaaS apps.

API-driven provisioning

Identity data in Microsoft Entra ID is kept in sync with workforce data managed in systems of record: an HR app, a payroll app, a spreadsheet, SQL tables in a database on-premises, or in the cloud. With application programming interface (API)-driven inbound provisioning, the Microsoft Entra provisioning service supports integration with systems of record.

Learn more:

• FAQ: API-driven inbound provisioning

API-driven provisioning scenarios

IT teams import data extracts with automation. Independent software vendors (ISVs) integrate with Microsoft Entra ID. System integrators build connectors to systems of record. This process is commonly used for sources like flat files, CSV files, SQL staging tables. Integrate automation tools: PowerShell scripts, Azure Logic Apps, and workflows using HTTP calls.

Configure API-driven provisioning

You can learn to configure API-driven inbound provisioning.

Comparison: Inbound provisioning /bulkUpload API and Microsoft Graph Users API

We recommend noting the differences between the provisioning /bulkUpload API and the Microsoft Graph Users API endpoint: Payload format, operation result, and IT administrators retain control.

In an FAQ, learn how the new inbound provisioning API differs from Graph Users API.

Deploy API-driven inbound provisioning

1. Create an API-driven provisioning app.
2. For Active Directory, configure API-driven inbound provisioning app. For Microsoft Entra ID, configure API-driven inbound provisioning app.
3. Grant access to inbound provisioning API
4. Customize user provisioning attribute mappings
5. Sync custom attributes

To learn more, see the following Quickstart guides about API-driven inbound provisioning with:

• cURL
• PowerShell
• Azure Logic Apps

Outbound app provisioning

You can provision to Software-as-a-Service (SaaS) apps, using a System for Cross-Domain Identity Management (SCIM).

Discover more about SCIM synchronization with Microsoft Entra ID.

Configure provisioning with a SCIM endpoint

SCIM 2.0 is a standardized definition of two endpoints /Users and /Groups.

See more details in the tutorial, develop, and plan provisioning for a SCIM endpoint in Microsoft Entra ID.

Lifecycle workflows custom extensions

Use custom extensions to create workflows using tools like Azure Logic Apps. For workflows, you can enable custom task extensions to call out to external systems. For example, a Joiner workflow with a custom task extension assigns a Microsoft Teams number. Or, when a user becomes a Leaver, a separate workflow grants access to an email account for their manager. You can learn to trigger Logic Apps based on custom task extensions.

To learn more, see the App Service Environment overview and Azure Logic Apps documentation.

Deploy lifecycle workflows

4. Automate onboarding new employees
5. Automate post-onboarding
6. Real-time employee change
7. Employee group membership changes
8. Employee job profile change
9. Automate preoffboarding
10. Automate post-affboarding
11. Trigger Logic Apps with custom extensions

Supported tasks and workflows

The table lists tasks and workflow according to Joiner, Mover, Leaver status.

Next steps

• Introduction to Microsoft Entra ID Governance deployment guide
• Scenario 1: Employee lifecycle automation
• Scenario 2: Assign employee access to resources
• Scenario 3: Govern guest and partner access
• Scenario 4: Govern privileged identities and their access