You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/governance/lifecycle-workflow-tasks.md
+29-26Lines changed: 29 additions & 26 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -24,13 +24,13 @@ Lifecycle Workflows currently support the following tasks:
24
24
|Task |taskDefinitionID |
25
25
|---------|---------|
26
26
|[Send welcome email to new hire](lifecycle-workflow-tasks.md#send-welcome-email-to-new-hire)| 70b29d51-b59a-4773-9280-8841dfd3f2ea |
27
-
|[Generate Temporary Access Password and send via email to user's manager](lifecycle-workflow-tasks.md#generate-temporary-access-password-and-send-via-email-to-users-manager)| 1b555e50-7f65-41d5-b514-5894a026d10d |
28
-
|[Add user to group](lifecycle-workflow-tasks.md#add-user-to-group)| 22085229-5809-45e8-97fd-270d28d66910 |
29
-
|[Add user to team](lifecycle-workflow-tasks.md#add-user-to-team)| e440ed8d-25a1-4618-84ce-091ed5be5594 |
27
+
|[Generate Temporary Access Pass and send via email to user's manager](lifecycle-workflow-tasks.md#generate-temporary-access-pass-and-send-via-email-to-users-manager)| 1b555e50-7f65-41d5-b514-5894a026d10d |
28
+
|[Add user to groups](lifecycle-workflow-tasks.md#add-user-to-groups)| 22085229-5809-45e8-97fd-270d28d66910 |
29
+
|[Add user to teams](lifecycle-workflow-tasks.md#add-user-to-teams)| e440ed8d-25a1-4618-84ce-091ed5be5594 |
30
30
|[Enable user account](lifecycle-workflow-tasks.md#enable-user-account)| 6fc52c9d-398b-4305-9763-15f42c1676fc |
31
31
|[Run a custom task extension](lifecycle-workflow-tasks.md#run-a-custom-task-extension)| 4262b724-8dba-4fad-afc3-43fcbb497a0e |
32
32
|[Disable user account](lifecycle-workflow-tasks.md#disable-user-account)| 1dfdfcc7-52fa-4c2e-bf3a-e3919cc12950 |
33
-
|[Remove user from group](lifecycle-workflow-tasks.md#remove-user-from-groups)| 1953a66c-751c-45e5-8bfe-01462c70da3c |
33
+
|[Remove user from selected group](lifecycle-workflow-tasks.md#remove-user-from-selected-groups)| 1953a66c-751c-45e5-8bfe-01462c70da3c |
34
34
|[Remove users from all groups](lifecycle-workflow-tasks.md#remove-users-from-all-groups)| b3a31406-2a15-4c9a-b25b-a658fa5f07fc |
35
35
|[Remove user from teams](lifecycle-workflow-tasks.md#remove-user-from-teams)| 06aa7acb-01af-4824-8899-b14e5ed788d6 |
36
36
|[Remove user from all teams](lifecycle-workflow-tasks.md#remove-users-from-all-teams)| 81f7b200-2816-4b3b-8c5d-dc556f07b024 |
@@ -46,16 +46,19 @@ Lifecycle Workflows currently support the following tasks:
46
46
Common task parameters are the non-unique parameters contained in every task. When adding tasks to a new workflow, or a workflow template, you can customize and configure these parameters so that they match your requirements.
47
47
48
48
49
+
> [!NOTE]
50
+
> The user's employee hire date is used as the start time for the Temporary Access Pass. Please make sure that the TAP lifetime task setting and the [time portion of your user's hire date](how-to-lifecycle-workflow-sync-attributes.md#importance-of-time) are set appropriately so that the TAP is still valid when the user starts their first day.
51
+
49
52
|Parameter |Definition |
50
53
|---------|---------|
51
54
|category | A read-only string that identifies the category or categories of the task. Automatically determined when the taskDefinitionID is chosen. |
52
55
|taskDefinitionId | A string referencing a taskDefinition which determines which task to run. |
53
56
|isEnabled | A boolean value that denotes whether the task is set to run or not. If set to “true" then the task will run. Defaults to true. |
54
57
|displayName | A unique string that identifies the task. |
55
58
|description | A string that describes the purpose of the task for administrative use. (Optional) |
56
-
|executionSequence | An integer that is read-only which states in what order the task will run in a workflow. For more information about executionSequence and workflow order, see: [Execution conditions](understanding-lifecycle-workflows.md#parts-of-a-workflow). |
59
+
|executionSequence | An integer that is read-only which states in what order the task will run in a workflow. For more information about executionSequence and workflow order, see: [Configure Scope](understanding-lifecycle-workflows.md#configure-scope). |
57
60
|continueOnError | A boolean value that determines if the failure of this task stops the subsequent workflows from running. |
58
-
|arguments | Contains unique parameters relevant for the given task |
61
+
|arguments | Contains unique parameters relevant for the given task.|
59
62
60
63
61
64
@@ -100,9 +103,9 @@ For Microsoft Graph the parameters for the **Send welcome email to new hire** ta
100
103
101
104
```
102
105
103
-
### Generate Temporary Access Password and send via email to user's manager
106
+
### Generate Temporary Access Pass and send via email to user's manager
104
107
105
-
When a compatible user joins your organization, Lifecycle Workflows allow you to automatically generate a Temporary Access Password(TAP) and have it sent to the new user's manager.
108
+
When a compatible user joins your organization, Lifecycle Workflows allow you to automatically generate a Temporary Access Pass(TAP) and have it sent to the new user's manager.
106
109
107
110
With this task in the Azure portal, you're able to give the task a name and description. You must also set the following:
108
111
@@ -111,31 +114,31 @@ With this task in the Azure portal, you're able to give the task a name and desc
111
114
:::image type="content" source="media/lifecycle-workflow-task/tap-task.png" alt-text="Screenshot of Workflows task: TAP task.":::
112
115
113
116
114
-
The Azure AD prerequisites to run the **Generate Temporary Access Password and send via email to user's manager** task are:
117
+
The Azure AD prerequisites to run the **Generate Temporary Access Pass and send via email to user's manager** task are:
115
118
116
119
- A populated manager attribute for the user.
117
120
- A populated manager's mail attribute for the user.
118
121
- An enabled TAP tenant policy. For more information, see [Enable the Temporary Access Pass policy](../authentication/howto-authentication-temporary-access-pass.md#enable-the-temporary-access-pass-policy)
119
122
120
123
121
124
> [!IMPORTANT]
122
-
> A user having this task run for them in a workflow must also not have any other authentication methods, signins, or AAD role assignments for this task to work for them.
125
+
> A user having this task run for them in a workflow must also not have any other authentication methods, sign-ins, or AAD role assignments for this task to work for them.
123
126
124
-
For Microsoft Graph the parameters for the **Generate Temporary Access Password and send via email to user's manager** task are as follows:
127
+
For Microsoft Graph the parameters for the **Generate Temporary Access Pass and send via email to user's manager** task are as follows:
125
128
126
129
|Parameter |Definition |
127
130
|---------|---------|
128
131
|category | joiner |
129
132
|displayName | GenerateTAPAndSendEmail (Customizable by user) |
130
-
|description | Generate Temporary Access Password and send via email to user's manager (Customizable by user) |
133
+
|description | Generate Temporary Access Pass and send via email to user's manager (Customizable by user) |
|arguments | Argument contains the name parameter "tapLifetimeInMinutes", which is the lifetime of the temporaryAccessPass in minutes starting at startDateTime. Minimum 10, Maximum 43200 (equivalent to 30 days). The argument also contains the tapIsUsableOnce parameter, which determines whether the password is limited to a one time use. If true, the pass can be used once; if false, the pass can be used multiple times within the temporaryAccessPass lifetime. |
133
136
134
137
135
138
```Example for usage within the workflow
136
139
{
137
140
"category": "joiner",
138
-
"description": "Generate Temporary Access Password and send via email to user's manager",
141
+
"description": "Generate Temporary Access Pass and send via email to user's manager",
139
142
"displayName": "GenerateTAPAndSendEmail",
140
143
"isEnabled": true,
141
144
"continueOnError": true,
@@ -158,29 +161,29 @@ For Microsoft Graph the parameters for the **Generate Temporary Access Password
158
161
> The employee hire date is the same as the startDateTime used for the tapLifetimeInMinutes parameter.
159
162
160
163
161
-
### Add user to group
164
+
### Add user to groups
162
165
163
-
Allows users to be added to a cloud-only group. To control access to on-premises applications and resources, you need to enable group writeback. For more information, see [Azure AD Connect group writeback](../hybrid/how-to-connect-group-writeback-v2.md).
166
+
Allows users to be added to cloud-only groups. To control access to on-premises applications and resources, you need to enable group writeback. For more information, see [Azure AD Connect group writeback](../hybrid/how-to-connect-group-writeback-v2.md).
164
167
165
168
You're able to customize the task name and description for this task.
166
169
:::image type="content" source="media/lifecycle-workflow-task/add-group-task.png" alt-text="Screenshot of Workflows task: Add user to group task.":::
167
170
168
171
169
-
For Microsoft Graph the parameters for the **Add user to group** task are as follows:
172
+
For Microsoft Graph the parameters for the **Add user to groups** task are as follows:
170
173
171
174
|Parameter |Definition |
172
175
|---------|---------|
173
176
|category | joiner,leaver |
174
177
|displayName | AddUserToGroup (Customizable by user) |
175
-
|description | Add user to group (Customizable by user) |
178
+
|description | Add user to groups (Customizable by user) |
|arguments | Argument contains a name parameter that is the "groupID", and a value parameter which is the group ID of the group you are adding the user to. |
178
181
179
182
180
183
```Example for usage within the workflow
181
184
{
182
185
"category": "joiner,leaver",
183
-
"description": "Add user to group",
186
+
"description": "Add user to groups",
184
187
"displayName": "AddUserToGroup",
185
188
"isEnabled": true,
186
189
"continueOnError": true,
@@ -196,19 +199,19 @@ For Microsoft Graph the parameters for the **Add user to group** task are as fol
196
199
```
197
200
198
201
199
-
### Add user to team
202
+
### Add user to teams
200
203
201
204
You're able to add a user to an existing static team. You're able to customize the task name and description for this task.
202
205
:::image type="content" source="media/lifecycle-workflow-task/add-team-task.png" alt-text="Screenshot of Workflows task: add user to team.":::
203
206
204
207
205
-
For Microsoft Graph the parameters for the **Add user to team** task are as follows:
208
+
For Microsoft Graph the parameters for the **Add user to teams** task are as follows:
206
209
207
210
|Parameter |Definition |
208
211
|---------|---------|
209
212
|category | joiner,leaver |
210
213
|displayName | AddUserToTeam (Customizable by user) |
211
-
|description | Add user to team (Customizable by user) |
214
+
|description | Add user to teams (Customizable by user) |
|argument | Argument contains a name parameter that is the "teamID", and a value parameter which is the team ID of the existing team you are adding a user to. |
214
217
@@ -336,16 +339,16 @@ For Microsoft Graph the parameters for the **Disable user account** task are as
336
339
337
340
```
338
341
339
-
### Remove user from groups
342
+
### Remove user from selected groups
340
343
341
-
Allows you to remove a user from cloud-only groups. To control access to on-premises applications and resources, you need to enable group writeback. For more information, see [Azure AD Connect group writeback](../hybrid/how-to-connect-group-writeback-v2.md).
344
+
Allows you to remove a user from cloud-only groups. Dynamic and Privileged Access Groups not supported. To control access to on-premises applications and resources, you need to enable group writeback. For more information, see [Azure AD Connect group writeback](../hybrid/how-to-connect-group-writeback-v2.md).
342
345
343
346
You're able to customize the task name and description for this task in the Azure portal.
344
347
:::image type="content" source="media/lifecycle-workflow-task/remove-group-task.png" alt-text="Screenshot of Workflows task: Remove user from select groups.":::
345
348
346
349
347
350
348
-
For Microsoft Graph the parameters for the **Remove user from groups** task are as follows:
351
+
For Microsoft Graph the parameters for the **Remove user from selected groups** task are as follows:
349
352
350
353
|Parameter |Definition |
351
354
|---------|---------|
@@ -378,7 +381,7 @@ For Microsoft Graph the parameters for the **Remove user from groups** task are
378
381
379
382
### Remove users from all groups
380
383
381
-
Allows users to be removed from every cloud-only group they are a member of. To control access to on-premises applications and resources, you need to enable group writeback. For more information, see [Azure AD Connect group writeback](../hybrid/how-to-connect-group-writeback-v2.md).
384
+
Allows users to be removed from every cloud-only group they are a member of. Dynamic and Privileged Access Groups not supported. To control access to on-premises applications and resources, you need to enable group writeback. For more information, see [Azure AD Connect group writeback](../hybrid/how-to-connect-group-writeback-v2.md).
382
385
383
386
384
387
You're able to customize the task name and description for this task in the Azure portal.
@@ -643,4 +646,4 @@ For Microsoft Graph the parameters for the **Send offboarding email to users man
Copy file name to clipboardExpand all lines: articles/active-directory/governance/lifecycle-workflows-developer-reference.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -64,7 +64,7 @@ Lets examine the tasks section of a sample workflow.
64
64
```
65
65
66
66
67
-
This task uses 1b555e50-7f65-41d5-b514-5894a026d10d, which is the taskDefinitionID for [Generate Temporary Access Password and send via email to user's manager](lifecycle-workflow-tasks.md#generate-temporary-access-password-and-send-via-email-to-users-manager). This is a pre-defined task created by Microsoft and will send a user's manager an email that contains a temporary access pass. This task requires the following more arguments.
67
+
This task uses 1b555e50-7f65-41d5-b514-5894a026d10d, which is the taskDefinitionID for [Generate Temporary Access Pass and send via email to user's manager](lifecycle-workflow-tasks.md#generate-temporary-access-pass-and-send-via-email-to-users-manager). This is a pre-defined task created by Microsoft and will send a user's manager an email that contains a temporary access pass. This task requires the following more arguments.
0 commit comments