Namespace: microsoft.graph.identityGovernance
Wichtig
Die APIs unter der /beta Version in Microsoft Graph können sich ändern. Die Verwendung dieser APIs in Produktionsanwendungen wird nicht unterstützt. Um festzustellen, ob eine API in v1.0 verfügbar ist, verwenden Sie die Version Selektor.
Erstellen Sie ein neues Workflow-Objekt . Sie können bis zu 100 Workflows in einem Mandanten erstellen.
Diese API ist in den folgenden nationalen Cloudbereitstellungen verfügbar.
| Weltweiter Service |
US Government L4 |
US Government L5 (DOD) |
China, betrieben von 21Vianet |
| ✅ |
✅ |
✅ |
✅ |
Berechtigungen
Wählen Sie die Berechtigungen aus, die für diese API als am wenigsten privilegiert markiert sind. Verwenden Sie eine höhere Berechtigung oder Berechtigungen nur, wenn Ihre App dies erfordert. Ausführliche Informationen zu delegierten Berechtigungen und Anwendungsberechtigungen finden Sie unter Berechtigungstypen. Weitere Informationen zu diesen Berechtigungen finden Sie in der Berechtigungsreferenz.
| Berechtigungstyp |
Berechtigungen mit den geringsten Berechtigungen |
Berechtigungen mit höheren Berechtigungen |
| Delegiert (Geschäfts-, Schul- oder Unikonto) |
LifecycleWorkflows-Workflow.ReadWrite.All |
LifecycleWorkflows.ReadWrite.All |
| Delegiert (persönliches Microsoft-Konto) |
Nicht unterstützt |
Nicht unterstützt |
| Application |
LifecycleWorkflows-Workflow.ReadWrite.All |
LifecycleWorkflows.ReadWrite.All |
Wichtig
Für den delegierten Zugriff mit Geschäfts-, Schul- oder Unikonten muss dem angemeldeten Benutzer eine unterstützte Microsoft Entra-Rolle oder eine benutzerdefinierte Rolle zugewiesen werden, die die für diesen Vorgang erforderlichen Berechtigungen gewährt.
Lebenszyklusworkflows Die Rolle "Administrator " mit den geringsten Berechtigungen wird für diesen Vorgang unterstützt.
HTTP-Anforderung
POST /identityGovernance/lifecycleWorkflows/workflows
Anforderungstext
Geben Sie im Anforderungstext eine JSON-Darstellung des Workflowobjekts an.
Sie können die folgenden Eigenschaften beim Erstellen eines Workflows festlegen.
| Eigenschaft |
Typ |
Beschreibung |
| category |
microsoft.graph.identityGovernance.lifecycleWorkflowCategory |
Die Kategorie des Workflows. Die möglichen Werte sind: joiner, leaver, unknownFutureValue. Es kann sich nur um einen Wert handeln. Erforderlich. |
| description |
Zeichenfolge |
Eine Zeichenfolge, die den Zweck des Workflows für die administrative Verwendung beschreibt. |
| displayName |
Zeichenfolge |
Eine eindeutige Zeichenfolge, die den Workflow identifiziert. Erforderlich. |
| executionConditions |
microsoft.graph.identityGovernance.workflowExecutionConditions |
Definiert, für wen und wann ein Workflow ausgeführt wird. Erforderlich. |
| id |
Zeichenfolge |
Bezeichner für die individuelle Adressierung eines bestimmten Workflows. |
| isEnabled |
Boolescher Wert |
Ein boolescher Wert, der angibt, ob der Workflow auf Ausführung festgelegt ist oder nicht. |
| isSchedulingEnabled |
Boolean |
Ein boolescher Wert, der angibt, ob die Planung aktiviert ist oder nicht. |
| tasks |
microsoft.graph.identityGovernance.task-Sammlung |
Stellt die konfigurierten auszuführenden Aufgaben und deren Ausführungsreihenfolge innerhalb des Workflows dar. Erforderlich. |
Antwort
Bei erfolgreicher Ausführung gibt diese Methode einen 201 Created Antwortcode und ein microsoft.graph.identityGovernance.workflow-Objekt im Antworttext zurück.
Beispiele
Beispiel 1: Erstellen Sie einen Joiner-Workflow mit dem zeitbasierten Trigger
Anforderung
Das folgende Beispiel zeigt eine Anforderung, die einen Workflow mit der folgenden Konfiguration erstellt:
- Es handelt sich um einen "Joiner"-Workflow, der für die Ausführung geplant ist.
- Sie wird für neue Benutzer mit Sitz in Australien auf ihrem employeeHireDate mithilfe des zeitbasierten Attributtriggers ausgeführt.
- Bei der Ausführung des Workflows werden zwei Aufgaben ausgeführt: Das Konto des Benutzers wird aktiviert, und eine "Willkommens"-E-Mail wird an den Benutzer gesendet.
POST https://graph.microsoft.com/beta/identityGovernance/lifecycleWorkflows/workflows
Content-Type: application/json
{
"category": "joiner",
"description": "Configure new hire tasks for onboarding employees on their first day",
"displayName": "Australia Onboard new hire employee",
"isEnabled": true,
"isSchedulingEnabled": true,
"executionConditions": {
"@odata.type": "#microsoft.graph.identityGovernance.triggerAndScopeBasedConditions",
"scope": {
"@odata.type": "#microsoft.graph.identityGovernance.ruleBasedSubjectSet",
"rule": "(country eq 'Australia')"
},
"trigger": {
"@odata.type": "#microsoft.graph.identityGovernance.timeBasedAttributeTrigger",
"timeBasedAttribute": "employeeHireDate",
"offsetInDays": 0
}
},
"tasks": [
{
"continueOnError": false,
"description": "Enable user account in the directory",
"displayName": "Enable User Account",
"isEnabled": true,
"taskDefinitionId": "6fc52c9d-398b-4305-9763-15f42c1676fc",
"arguments": []
},
{
"continueOnError": false,
"description": "Send welcome email to new hire",
"displayName": "Send Welcome Email",
"isEnabled": true,
"taskDefinitionId": "70b29d51-b59a-4773-9280-8841dfd3f2ea",
"arguments": []
}
]
}
// Code snippets are only available for the latest version. Current version is 5.x
// Dependencies
using Microsoft.Graph.Beta.Models.IdentityGovernance;
using Microsoft.Graph.Beta.Models;
var requestBody = new Workflow
{
Category = LifecycleWorkflowCategory.Joiner,
Description = "Configure new hire tasks for onboarding employees on their first day",
DisplayName = "Australia Onboard new hire employee",
IsEnabled = true,
IsSchedulingEnabled = true,
ExecutionConditions = new TriggerAndScopeBasedConditions
{
OdataType = "#microsoft.graph.identityGovernance.triggerAndScopeBasedConditions",
Scope = new RuleBasedSubjectSet
{
OdataType = "#microsoft.graph.identityGovernance.ruleBasedSubjectSet",
Rule = "(country eq 'Australia')",
},
Trigger = new TimeBasedAttributeTrigger
{
OdataType = "#microsoft.graph.identityGovernance.timeBasedAttributeTrigger",
TimeBasedAttribute = WorkflowTriggerTimeBasedAttribute.EmployeeHireDate,
OffsetInDays = 0,
},
},
Tasks = new List<TaskObject>
{
new TaskObject
{
ContinueOnError = false,
Description = "Enable user account in the directory",
DisplayName = "Enable User Account",
IsEnabled = true,
TaskDefinitionId = "6fc52c9d-398b-4305-9763-15f42c1676fc",
Arguments = new List<KeyValuePair>
{
},
},
new TaskObject
{
ContinueOnError = false,
Description = "Send welcome email to new hire",
DisplayName = "Send Welcome Email",
IsEnabled = true,
TaskDefinitionId = "70b29d51-b59a-4773-9280-8841dfd3f2ea",
Arguments = new List<KeyValuePair>
{
},
},
},
};
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.IdentityGovernance.LifecycleWorkflows.Workflows.PostAsync(requestBody);
// Code snippets are only available for the latest major version. Current major version is $v0.*
// Dependencies
import (
"context"
msgraphsdk "github.com/microsoftgraph/msgraph-beta-sdk-go"
graphmodelsidentitygovernance "github.com/microsoftgraph/msgraph-beta-sdk-go/models/identitygovernance"
graphmodels "github.com/microsoftgraph/msgraph-beta-sdk-go/models"
//other-imports
)
requestBody := graphmodelsidentitygovernance.NewWorkflow()
category := graphmodels.JOINER_LIFECYCLEWORKFLOWCATEGORY
requestBody.SetCategory(&category)
description := "Configure new hire tasks for onboarding employees on their first day"
requestBody.SetDescription(&description)
displayName := "Australia Onboard new hire employee"
requestBody.SetDisplayName(&displayName)
isEnabled := true
requestBody.SetIsEnabled(&isEnabled)
isSchedulingEnabled := true
requestBody.SetIsSchedulingEnabled(&isSchedulingEnabled)
executionConditions := graphmodelsidentitygovernance.NewTriggerAndScopeBasedConditions()
scope := graphmodelsidentitygovernance.NewRuleBasedSubjectSet()
rule := "(country eq 'Australia')"
scope.SetRule(&rule)
executionConditions.SetScope(scope)
trigger := graphmodelsidentitygovernance.NewTimeBasedAttributeTrigger()
timeBasedAttribute := graphmodels.EMPLOYEEHIREDATE_WORKFLOWTRIGGERTIMEBASEDATTRIBUTE
trigger.SetTimeBasedAttribute(&timeBasedAttribute)
offsetInDays := int32(0)
trigger.SetOffsetInDays(&offsetInDays)
executionConditions.SetTrigger(trigger)
requestBody.SetExecutionConditions(executionConditions)
task := graphmodelsidentitygovernance.NewTask()
continueOnError := false
task.SetContinueOnError(&continueOnError)
description := "Enable user account in the directory"
task.SetDescription(&description)
displayName := "Enable User Account"
task.SetDisplayName(&displayName)
isEnabled := true
task.SetIsEnabled(&isEnabled)
taskDefinitionId := "6fc52c9d-398b-4305-9763-15f42c1676fc"
task.SetTaskDefinitionId(&taskDefinitionId)
arguments := []graphmodels.KeyValuePairable {
}
task.SetArguments(arguments)
task1 := graphmodelsidentitygovernance.NewTask()
continueOnError := false
task1.SetContinueOnError(&continueOnError)
description := "Send welcome email to new hire"
task1.SetDescription(&description)
displayName := "Send Welcome Email"
task1.SetDisplayName(&displayName)
isEnabled := true
task1.SetIsEnabled(&isEnabled)
taskDefinitionId := "70b29d51-b59a-4773-9280-8841dfd3f2ea"
task1.SetTaskDefinitionId(&taskDefinitionId)
arguments := []graphmodels.KeyValuePairable {
}
task1.SetArguments(arguments)
tasks := []graphmodelsidentitygovernance.Taskable {
task,
task1,
}
requestBody.SetTasks(tasks)
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
workflows, err := graphClient.IdentityGovernance().LifecycleWorkflows().Workflows().Post(context.Background(), requestBody, nil)
// Code snippets are only available for the latest version. Current version is 6.x
GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);
com.microsoft.graph.beta.models.identitygovernance.Workflow workflow = new com.microsoft.graph.beta.models.identitygovernance.Workflow();
workflow.setCategory(com.microsoft.graph.beta.models.identitygovernance.LifecycleWorkflowCategory.Joiner);
workflow.setDescription("Configure new hire tasks for onboarding employees on their first day");
workflow.setDisplayName("Australia Onboard new hire employee");
workflow.setIsEnabled(true);
workflow.setIsSchedulingEnabled(true);
com.microsoft.graph.beta.models.identitygovernance.TriggerAndScopeBasedConditions executionConditions = new com.microsoft.graph.beta.models.identitygovernance.TriggerAndScopeBasedConditions();
executionConditions.setOdataType("#microsoft.graph.identityGovernance.triggerAndScopeBasedConditions");
com.microsoft.graph.beta.models.identitygovernance.RuleBasedSubjectSet scope = new com.microsoft.graph.beta.models.identitygovernance.RuleBasedSubjectSet();
scope.setOdataType("#microsoft.graph.identityGovernance.ruleBasedSubjectSet");
scope.setRule("(country eq 'Australia')");
executionConditions.setScope(scope);
com.microsoft.graph.beta.models.identitygovernance.TimeBasedAttributeTrigger trigger = new com.microsoft.graph.beta.models.identitygovernance.TimeBasedAttributeTrigger();
trigger.setOdataType("#microsoft.graph.identityGovernance.timeBasedAttributeTrigger");
trigger.setTimeBasedAttribute(com.microsoft.graph.beta.models.identitygovernance.WorkflowTriggerTimeBasedAttribute.EmployeeHireDate);
trigger.setOffsetInDays(0);
executionConditions.setTrigger(trigger);
workflow.setExecutionConditions(executionConditions);
LinkedList<com.microsoft.graph.beta.models.identitygovernance.Task> tasks = new LinkedList<com.microsoft.graph.beta.models.identitygovernance.Task>();
com.microsoft.graph.beta.models.identitygovernance.Task task = new com.microsoft.graph.beta.models.identitygovernance.Task();
task.setContinueOnError(false);
task.setDescription("Enable user account in the directory");
task.setDisplayName("Enable User Account");
task.setIsEnabled(true);
task.setTaskDefinitionId("6fc52c9d-398b-4305-9763-15f42c1676fc");
LinkedList<KeyValuePair> arguments = new LinkedList<KeyValuePair>();
task.setArguments(arguments);
tasks.add(task);
com.microsoft.graph.beta.models.identitygovernance.Task task1 = new com.microsoft.graph.beta.models.identitygovernance.Task();
task1.setContinueOnError(false);
task1.setDescription("Send welcome email to new hire");
task1.setDisplayName("Send Welcome Email");
task1.setIsEnabled(true);
task1.setTaskDefinitionId("70b29d51-b59a-4773-9280-8841dfd3f2ea");
LinkedList<KeyValuePair> arguments1 = new LinkedList<KeyValuePair>();
task1.setArguments(arguments1);
tasks.add(task1);
workflow.setTasks(tasks);
com.microsoft.graph.models.identitygovernance.Workflow result = graphClient.identityGovernance().lifecycleWorkflows().workflows().post(workflow);
const options = {
authProvider,
};
const client = Client.init(options);
const workflow = {
category: 'joiner',
description: 'Configure new hire tasks for onboarding employees on their first day',
displayName: 'Australia Onboard new hire employee',
isEnabled: true,
isSchedulingEnabled: true,
executionConditions: {
'@odata.type': '#microsoft.graph.identityGovernance.triggerAndScopeBasedConditions',
scope: {
'@odata.type': '#microsoft.graph.identityGovernance.ruleBasedSubjectSet',
rule: '(country eq \'Australia\')'
},
trigger: {
'@odata.type': '#microsoft.graph.identityGovernance.timeBasedAttributeTrigger',
timeBasedAttribute: 'employeeHireDate',
offsetInDays: 0
}
},
tasks: [
{
continueOnError: false,
description: 'Enable user account in the directory',
displayName: 'Enable User Account',
isEnabled: true,
taskDefinitionId: '6fc52c9d-398b-4305-9763-15f42c1676fc',
arguments: []
},
{
continueOnError: false,
description: 'Send welcome email to new hire',
displayName: 'Send Welcome Email',
isEnabled: true,
taskDefinitionId: '70b29d51-b59a-4773-9280-8841dfd3f2ea',
arguments: []
}
]
};
await client.api('/identityGovernance/lifecycleWorkflows/workflows')
.version('beta')
.post(workflow);
<?php
use Microsoft\Graph\Beta\GraphServiceClient;
use Microsoft\Graph\Beta\Generated\Models\IdentityGovernance\Workflow;
use Microsoft\Graph\Beta\Generated\Models\IdentityGovernance\LifecycleWorkflowCategory;
use Microsoft\Graph\Beta\Generated\Models\IdentityGovernance\TriggerAndScopeBasedConditions;
use Microsoft\Graph\Beta\Generated\Models\IdentityGovernance\RuleBasedSubjectSet;
use Microsoft\Graph\Beta\Generated\Models\IdentityGovernance\TimeBasedAttributeTrigger;
use Microsoft\Graph\Beta\Generated\Models\IdentityGovernance\WorkflowTriggerTimeBasedAttribute;
use Microsoft\Graph\Beta\Generated\Models\IdentityGovernance\Task;
use Microsoft\Graph\Beta\Generated\Models\KeyValuePair;
$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);
$requestBody = new Workflow();
$requestBody->setCategory(new LifecycleWorkflowCategory('joiner'));
$requestBody->setDescription('Configure new hire tasks for onboarding employees on their first day');
$requestBody->setDisplayName('Australia Onboard new hire employee');
$requestBody->setIsEnabled(true);
$requestBody->setIsSchedulingEnabled(true);
$executionConditions = new TriggerAndScopeBasedConditions();
$executionConditions->setOdataType('#microsoft.graph.identityGovernance.triggerAndScopeBasedConditions');
$executionConditionsScope = new RuleBasedSubjectSet();
$executionConditionsScope->setOdataType('#microsoft.graph.identityGovernance.ruleBasedSubjectSet');
$executionConditionsScope->setRule('(country eq \'Australia\')');
$executionConditions->setScope($executionConditionsScope);
$executionConditionsTrigger = new TimeBasedAttributeTrigger();
$executionConditionsTrigger->setOdataType('#microsoft.graph.identityGovernance.timeBasedAttributeTrigger');
$executionConditionsTrigger->setTimeBasedAttribute(new WorkflowTriggerTimeBasedAttribute('employeeHireDate'));
$executionConditionsTrigger->setOffsetInDays(0);
$executionConditions->setTrigger($executionConditionsTrigger);
$requestBody->setExecutionConditions($executionConditions);
$tasksTask1 = new Task();
$tasksTask1->setContinueOnError(false);
$tasksTask1->setDescription('Enable user account in the directory');
$tasksTask1->setDisplayName('Enable User Account');
$tasksTask1->setIsEnabled(true);
$tasksTask1->setTaskDefinitionId('6fc52c9d-398b-4305-9763-15f42c1676fc');
$tasksTask1->setArguments([ ]);
$tasksArray []= $tasksTask1;
$tasksTask2 = new Task();
$tasksTask2->setContinueOnError(false);
$tasksTask2->setDescription('Send welcome email to new hire');
$tasksTask2->setDisplayName('Send Welcome Email');
$tasksTask2->setIsEnabled(true);
$tasksTask2->setTaskDefinitionId('70b29d51-b59a-4773-9280-8841dfd3f2ea');
$tasksTask2->setArguments([ ]);
$tasksArray []= $tasksTask2;
$requestBody->setTasks($tasksArray);
$result = $graphServiceClient->identityGovernance()->lifecycleWorkflows()->workflows()->post($requestBody)->wait();
Import-Module Microsoft.Graph.Beta.Identity.Governance
$params = @{
category = "joiner"
description = "Configure new hire tasks for onboarding employees on their first day"
displayName = "Australia Onboard new hire employee"
isEnabled = $true
isSchedulingEnabled = $true
executionConditions = @{
"@odata.type" = "#microsoft.graph.identityGovernance.triggerAndScopeBasedConditions"
scope = @{
"@odata.type" = "#microsoft.graph.identityGovernance.ruleBasedSubjectSet"
rule = "(country eq 'Australia')"
}
trigger = @{
"@odata.type" = "#microsoft.graph.identityGovernance.timeBasedAttributeTrigger"
timeBasedAttribute = "employeeHireDate"
offsetInDays =
}
}
tasks = @(
@{
continueOnError = $false
description = "Enable user account in the directory"
displayName = "Enable User Account"
isEnabled = $true
taskDefinitionId = "6fc52c9d-398b-4305-9763-15f42c1676fc"
arguments = @(
)
}
@{
continueOnError = $false
description = "Send welcome email to new hire"
displayName = "Send Welcome Email"
isEnabled = $true
taskDefinitionId = "70b29d51-b59a-4773-9280-8841dfd3f2ea"
arguments = @(
)
}
)
}
New-MgBetaIdentityGovernanceLifecycleWorkflow -BodyParameter $params
# Code snippets are only available for the latest version. Current version is 1.x
from msgraph_beta import GraphServiceClient
from msgraph_beta.generated.models.identity_governance.workflow import Workflow
from msgraph_beta.generated.models.lifecycle_workflow_category import LifecycleWorkflowCategory
from msgraph_beta.generated.models.identity_governance.trigger_and_scope_based_conditions import TriggerAndScopeBasedConditions
from msgraph_beta.generated.models.identity_governance.rule_based_subject_set import RuleBasedSubjectSet
from msgraph_beta.generated.models.identity_governance.time_based_attribute_trigger import TimeBasedAttributeTrigger
from msgraph_beta.generated.models.workflow_trigger_time_based_attribute import WorkflowTriggerTimeBasedAttribute
from msgraph_beta.generated.models.identity_governance.task import Task
from msgraph_beta.generated.models.key_value_pair import KeyValuePair
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
request_body = Workflow(
category = LifecycleWorkflowCategory.Joiner,
description = "Configure new hire tasks for onboarding employees on their first day",
display_name = "Australia Onboard new hire employee",
is_enabled = True,
is_scheduling_enabled = True,
execution_conditions = TriggerAndScopeBasedConditions(
odata_type = "#microsoft.graph.identityGovernance.triggerAndScopeBasedConditions",
scope = RuleBasedSubjectSet(
odata_type = "#microsoft.graph.identityGovernance.ruleBasedSubjectSet",
rule = "(country eq 'Australia')",
),
trigger = TimeBasedAttributeTrigger(
odata_type = "#microsoft.graph.identityGovernance.timeBasedAttributeTrigger",
time_based_attribute = WorkflowTriggerTimeBasedAttribute.EmployeeHireDate,
offset_in_days = 0,
),
),
tasks = [
Task(
continue_on_error = False,
description = "Enable user account in the directory",
display_name = "Enable User Account",
is_enabled = True,
task_definition_id = "6fc52c9d-398b-4305-9763-15f42c1676fc",
arguments = [
],
),
Task(
continue_on_error = False,
description = "Send welcome email to new hire",
display_name = "Send Welcome Email",
is_enabled = True,
task_definition_id = "70b29d51-b59a-4773-9280-8841dfd3f2ea",
arguments = [
],
),
],
)
result = await graph_client.identity_governance.lifecycle_workflows.workflows.post(request_body)
Antwort
Das folgende Beispiel zeigt die Antwort.
Hinweis: Das hier gezeigte Antwortobjekt kann zur besseren Lesbarkeit gekürzt werden.
HTTP/1.1 201 Created
Content-Type: application/json
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#identityGovernance/lifecycleWorkflows/workflows/$entity",
"category": "joiner",
"description": "Configure new hire tasks for onboarding employees on their first day",
"displayName": "New Zealand new hire",
"lastModifiedDateTime": "2022-08-26T04:51:27.521792Z",
"createdDateTime": "2022-08-26T04:51:27.5217824Z",
"deletedDateTime": null,
"id": "818cd47f-138c-4a83-b3f5-afa92bfcf391",
"isEnabled": true,
"isSchedulingEnabled": false,
"nextScheduleRunDateTime": null,
"version": 1,
"executionConditions": {
"@odata.type": "#microsoft.graph.identityGovernance.triggerAndScopeBasedConditions",
"scope": {
"@odata.type": "#microsoft.graph.identityGovernance.ruleBasedSubjectSet",
"rule": "(country eq 'New Zealand')"
},
"trigger": {
"@odata.type": "#microsoft.graph.identityGovernance.timeBasedAttributeTrigger",
"timeBasedAttribute": "employeeHireDate",
"offsetInDays": 0
}
}
}
Beispiel 2: Erstellen eines Mover-Workflows mit dem Trigger für Attributänderungen
Anforderung
Das folgende Beispiel zeigt eine Anforderung, die einen Workflow mit der folgenden Konfiguration erstellt:
- Es handelt sich um einen "Mover"-Workflow, der für die Ausführung geplant ist.
- Es wird für bestehende Benutzer ausgeführt, die der Abteilung "Vertrieb" über den Trigger für Attributänderungen hinzugefügt wurden.
- Eine Aufgabe wird ausgeführt, nämlich eine E-Mail zu senden, um den Manager des Benutzers über den Umzug zu informieren.
POST https://graph.microsoft.com/beta/identityGovernance/lifecycleWorkflows/workflows
Content-Type: application/json
Content-length: 631
{
"category": "mover",
"description": "Configure mover tasks for a user when their job profile changes",
"displayName": "Sales contractor moves to full-time employee",
"isEnabled": true,
"isSchedulingEnabled": true,
"executionConditions": {
"@odata.type": "#microsoft.graph.identityGovernance.triggerAndScopeBasedConditions",
"scope": {
"@odata.type": "#microsoft.graph.identityGovernance.ruleBasedSubjectSet",
"rule": "(department eq 'Sales')"
},
"trigger": {
"@odata.type": "#microsoft.graph.identityGovernance.attributeChangeTrigger",
"triggerAttributes": [
{
"name": "department"
}
]
}
},
"tasks": [
{
"continueOnError": false,
"description": "Send email to moving employee's manager",
"displayName": "Notify manager of move",
"isEnabled": true,
"taskDefinitionId": "aab41899-9972-422a-9d97-f626014578b7",
"arguments": []
}
]
}
// Code snippets are only available for the latest version. Current version is 5.x
// Dependencies
using Microsoft.Graph.Beta.Models.IdentityGovernance;
using Microsoft.Graph.Beta.Models;
var requestBody = new Workflow
{
Category = LifecycleWorkflowCategory.Mover,
Description = "Configure mover tasks for a user when their job profile changes",
DisplayName = "Sales contractor moves to full-time employee",
IsEnabled = true,
IsSchedulingEnabled = true,
ExecutionConditions = new TriggerAndScopeBasedConditions
{
OdataType = "#microsoft.graph.identityGovernance.triggerAndScopeBasedConditions",
Scope = new RuleBasedSubjectSet
{
OdataType = "#microsoft.graph.identityGovernance.ruleBasedSubjectSet",
Rule = "(department eq 'Sales')",
},
Trigger = new AttributeChangeTrigger
{
OdataType = "#microsoft.graph.identityGovernance.attributeChangeTrigger",
TriggerAttributes = new List<TriggerAttribute>
{
new TriggerAttribute
{
Name = "department",
},
},
},
},
Tasks = new List<TaskObject>
{
new TaskObject
{
ContinueOnError = false,
Description = "Send email to moving employee's manager",
DisplayName = "Notify manager of move",
IsEnabled = true,
TaskDefinitionId = "aab41899-9972-422a-9d97-f626014578b7",
Arguments = new List<KeyValuePair>
{
},
},
},
};
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.IdentityGovernance.LifecycleWorkflows.Workflows.PostAsync(requestBody);
// Code snippets are only available for the latest major version. Current major version is $v0.*
// Dependencies
import (
"context"
msgraphsdk "github.com/microsoftgraph/msgraph-beta-sdk-go"
graphmodelsidentitygovernance "github.com/microsoftgraph/msgraph-beta-sdk-go/models/identitygovernance"
graphmodels "github.com/microsoftgraph/msgraph-beta-sdk-go/models"
//other-imports
)
requestBody := graphmodelsidentitygovernance.NewWorkflow()
category := graphmodels.MOVER_LIFECYCLEWORKFLOWCATEGORY
requestBody.SetCategory(&category)
description := "Configure mover tasks for a user when their job profile changes"
requestBody.SetDescription(&description)
displayName := "Sales contractor moves to full-time employee"
requestBody.SetDisplayName(&displayName)
isEnabled := true
requestBody.SetIsEnabled(&isEnabled)
isSchedulingEnabled := true
requestBody.SetIsSchedulingEnabled(&isSchedulingEnabled)
executionConditions := graphmodelsidentitygovernance.NewTriggerAndScopeBasedConditions()
scope := graphmodelsidentitygovernance.NewRuleBasedSubjectSet()
rule := "(department eq 'Sales')"
scope.SetRule(&rule)
executionConditions.SetScope(scope)
trigger := graphmodelsidentitygovernance.NewAttributeChangeTrigger()
triggerAttribute := graphmodelsidentitygovernance.NewTriggerAttribute()
name := "department"
triggerAttribute.SetName(&name)
triggerAttributes := []graphmodelsidentitygovernance.TriggerAttributeable {
triggerAttribute,
}
trigger.SetTriggerAttributes(triggerAttributes)
executionConditions.SetTrigger(trigger)
requestBody.SetExecutionConditions(executionConditions)
task := graphmodelsidentitygovernance.NewTask()
continueOnError := false
task.SetContinueOnError(&continueOnError)
description := "Send email to moving employee's manager"
task.SetDescription(&description)
displayName := "Notify manager of move"
task.SetDisplayName(&displayName)
isEnabled := true
task.SetIsEnabled(&isEnabled)
taskDefinitionId := "aab41899-9972-422a-9d97-f626014578b7"
task.SetTaskDefinitionId(&taskDefinitionId)
arguments := []graphmodels.KeyValuePairable {
}
task.SetArguments(arguments)
tasks := []graphmodelsidentitygovernance.Taskable {
task,
}
requestBody.SetTasks(tasks)
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
workflows, err := graphClient.IdentityGovernance().LifecycleWorkflows().Workflows().Post(context.Background(), requestBody, nil)
// Code snippets are only available for the latest version. Current version is 6.x
GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);
com.microsoft.graph.beta.models.identitygovernance.Workflow workflow = new com.microsoft.graph.beta.models.identitygovernance.Workflow();
workflow.setCategory(com.microsoft.graph.beta.models.identitygovernance.LifecycleWorkflowCategory.Mover);
workflow.setDescription("Configure mover tasks for a user when their job profile changes");
workflow.setDisplayName("Sales contractor moves to full-time employee");
workflow.setIsEnabled(true);
workflow.setIsSchedulingEnabled(true);
com.microsoft.graph.beta.models.identitygovernance.TriggerAndScopeBasedConditions executionConditions = new com.microsoft.graph.beta.models.identitygovernance.TriggerAndScopeBasedConditions();
executionConditions.setOdataType("#microsoft.graph.identityGovernance.triggerAndScopeBasedConditions");
com.microsoft.graph.beta.models.identitygovernance.RuleBasedSubjectSet scope = new com.microsoft.graph.beta.models.identitygovernance.RuleBasedSubjectSet();
scope.setOdataType("#microsoft.graph.identityGovernance.ruleBasedSubjectSet");
scope.setRule("(department eq 'Sales')");
executionConditions.setScope(scope);
com.microsoft.graph.beta.models.identitygovernance.AttributeChangeTrigger trigger = new com.microsoft.graph.beta.models.identitygovernance.AttributeChangeTrigger();
trigger.setOdataType("#microsoft.graph.identityGovernance.attributeChangeTrigger");
LinkedList<com.microsoft.graph.beta.models.identitygovernance.TriggerAttribute> triggerAttributes = new LinkedList<com.microsoft.graph.beta.models.identitygovernance.TriggerAttribute>();
com.microsoft.graph.beta.models.identitygovernance.TriggerAttribute triggerAttribute = new com.microsoft.graph.beta.models.identitygovernance.TriggerAttribute();
triggerAttribute.setName("department");
triggerAttributes.add(triggerAttribute);
trigger.setTriggerAttributes(triggerAttributes);
executionConditions.setTrigger(trigger);
workflow.setExecutionConditions(executionConditions);
LinkedList<com.microsoft.graph.beta.models.identitygovernance.Task> tasks = new LinkedList<com.microsoft.graph.beta.models.identitygovernance.Task>();
com.microsoft.graph.beta.models.identitygovernance.Task task = new com.microsoft.graph.beta.models.identitygovernance.Task();
task.setContinueOnError(false);
task.setDescription("Send email to moving employee's manager");
task.setDisplayName("Notify manager of move");
task.setIsEnabled(true);
task.setTaskDefinitionId("aab41899-9972-422a-9d97-f626014578b7");
LinkedList<KeyValuePair> arguments = new LinkedList<KeyValuePair>();
task.setArguments(arguments);
tasks.add(task);
workflow.setTasks(tasks);
com.microsoft.graph.models.identitygovernance.Workflow result = graphClient.identityGovernance().lifecycleWorkflows().workflows().post(workflow);
const options = {
authProvider,
};
const client = Client.init(options);
const workflow = {
category: 'mover',
description: 'Configure mover tasks for a user when their job profile changes',
displayName: 'Sales contractor moves to full-time employee',
isEnabled: true,
isSchedulingEnabled: true,
executionConditions: {
'@odata.type': '#microsoft.graph.identityGovernance.triggerAndScopeBasedConditions',
scope: {
'@odata.type': '#microsoft.graph.identityGovernance.ruleBasedSubjectSet',
rule: '(department eq \'Sales\')'
},
trigger: {
'@odata.type': '#microsoft.graph.identityGovernance.attributeChangeTrigger',
triggerAttributes: [
{
name: 'department'
}
]
}
},
tasks: [
{
continueOnError: false,
description: 'Send email to moving employee\'s manager',
displayName: 'Notify manager of move',
isEnabled: true,
taskDefinitionId: 'aab41899-9972-422a-9d97-f626014578b7',
arguments: []
}
]
};
await client.api('/identityGovernance/lifecycleWorkflows/workflows')
.version('beta')
.post(workflow);
<?php
use Microsoft\Graph\Beta\GraphServiceClient;
use Microsoft\Graph\Beta\Generated\Models\IdentityGovernance\Workflow;
use Microsoft\Graph\Beta\Generated\Models\IdentityGovernance\LifecycleWorkflowCategory;
use Microsoft\Graph\Beta\Generated\Models\IdentityGovernance\TriggerAndScopeBasedConditions;
use Microsoft\Graph\Beta\Generated\Models\IdentityGovernance\RuleBasedSubjectSet;
use Microsoft\Graph\Beta\Generated\Models\IdentityGovernance\AttributeChangeTrigger;
use Microsoft\Graph\Beta\Generated\Models\IdentityGovernance\TriggerAttribute;
use Microsoft\Graph\Beta\Generated\Models\IdentityGovernance\Task;
use Microsoft\Graph\Beta\Generated\Models\KeyValuePair;
$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);
$requestBody = new Workflow();
$requestBody->setCategory(new LifecycleWorkflowCategory('mover'));
$requestBody->setDescription('Configure mover tasks for a user when their job profile changes');
$requestBody->setDisplayName('Sales contractor moves to full-time employee');
$requestBody->setIsEnabled(true);
$requestBody->setIsSchedulingEnabled(true);
$executionConditions = new TriggerAndScopeBasedConditions();
$executionConditions->setOdataType('#microsoft.graph.identityGovernance.triggerAndScopeBasedConditions');
$executionConditionsScope = new RuleBasedSubjectSet();
$executionConditionsScope->setOdataType('#microsoft.graph.identityGovernance.ruleBasedSubjectSet');
$executionConditionsScope->setRule('(department eq \'Sales\')');
$executionConditions->setScope($executionConditionsScope);
$executionConditionsTrigger = new AttributeChangeTrigger();
$executionConditionsTrigger->setOdataType('#microsoft.graph.identityGovernance.attributeChangeTrigger');
$triggerAttributesTriggerAttribute1 = new TriggerAttribute();
$triggerAttributesTriggerAttribute1->setName('department');
$triggerAttributesArray []= $triggerAttributesTriggerAttribute1;
$executionConditionsTrigger->setTriggerAttributes($triggerAttributesArray);
$executionConditions->setTrigger($executionConditionsTrigger);
$requestBody->setExecutionConditions($executionConditions);
$tasksTask1 = new Task();
$tasksTask1->setContinueOnError(false);
$tasksTask1->setDescription('Send email to moving employee\'s manager');
$tasksTask1->setDisplayName('Notify manager of move');
$tasksTask1->setIsEnabled(true);
$tasksTask1->setTaskDefinitionId('aab41899-9972-422a-9d97-f626014578b7');
$tasksTask1->setArguments([]);
$tasksArray []= $tasksTask1;
$requestBody->setTasks($tasksArray);
$result = $graphServiceClient->identityGovernance()->lifecycleWorkflows()->workflows()->post($requestBody)->wait();
Import-Module Microsoft.Graph.Beta.Identity.Governance
$params = @{
category = "mover"
description = "Configure mover tasks for a user when their job profile changes"
displayName = "Sales contractor moves to full-time employee"
isEnabled = $true
isSchedulingEnabled = $true
executionConditions = @{
"@odata.type" = "#microsoft.graph.identityGovernance.triggerAndScopeBasedConditions"
scope = @{
"@odata.type" = "#microsoft.graph.identityGovernance.ruleBasedSubjectSet"
rule = "(department eq 'Sales')"
}
trigger = @{
"@odata.type" = "#microsoft.graph.identityGovernance.attributeChangeTrigger"
triggerAttributes = @(
@{
name = "department"
}
)
}
}
tasks = @(
@{
continueOnError = $false
description = "Send email to moving employee's manager"
displayName = "Notify manager of move"
isEnabled = $true
taskDefinitionId = "aab41899-9972-422a-9d97-f626014578b7"
arguments = @(
)
}
)
}
New-MgBetaIdentityGovernanceLifecycleWorkflow -BodyParameter $params
# Code snippets are only available for the latest version. Current version is 1.x
from msgraph_beta import GraphServiceClient
from msgraph_beta.generated.models.identity_governance.workflow import Workflow
from msgraph_beta.generated.models.lifecycle_workflow_category import LifecycleWorkflowCategory
from msgraph_beta.generated.models.identity_governance.trigger_and_scope_based_conditions import TriggerAndScopeBasedConditions
from msgraph_beta.generated.models.identity_governance.rule_based_subject_set import RuleBasedSubjectSet
from msgraph_beta.generated.models.identity_governance.attribute_change_trigger import AttributeChangeTrigger
from msgraph_beta.generated.models.identity_governance.trigger_attribute import TriggerAttribute
from msgraph_beta.generated.models.identity_governance.task import Task
from msgraph_beta.generated.models.key_value_pair import KeyValuePair
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
request_body = Workflow(
category = LifecycleWorkflowCategory.Mover,
description = "Configure mover tasks for a user when their job profile changes",
display_name = "Sales contractor moves to full-time employee",
is_enabled = True,
is_scheduling_enabled = True,
execution_conditions = TriggerAndScopeBasedConditions(
odata_type = "#microsoft.graph.identityGovernance.triggerAndScopeBasedConditions",
scope = RuleBasedSubjectSet(
odata_type = "#microsoft.graph.identityGovernance.ruleBasedSubjectSet",
rule = "(department eq 'Sales')",
),
trigger = AttributeChangeTrigger(
odata_type = "#microsoft.graph.identityGovernance.attributeChangeTrigger",
trigger_attributes = [
TriggerAttribute(
name = "department",
),
],
),
),
tasks = [
Task(
continue_on_error = False,
description = "Send email to moving employee's manager",
display_name = "Notify manager of move",
is_enabled = True,
task_definition_id = "aab41899-9972-422a-9d97-f626014578b7",
arguments = [
],
),
],
)
result = await graph_client.identity_governance.lifecycle_workflows.workflows.post(request_body)
Antwort
Das folgende Beispiel zeigt die Antwort.
Hinweis: Das hier gezeigte Antwortobjekt kann zur besseren Lesbarkeit gekürzt werden.
HTTP/1.1 200 OK
Content-Type: application/json
{
"category": "mover",
"description": "Configure mover tasks for a user when their job profile changes",
"displayName": "Sales contractor moves to full time employee",
"isEnabled": true,
"isSchedulingEnabled": true,
"executionConditions": {
"@odata.type": "#microsoft.graph.identityGovernance.triggerAndScopeBasedConditions",
"scope": {
"@odata.type": "#microsoft.graph.identityGovernance.ruleBasedSubjectSet",
"rule": "(department eq 'Sales')"
},
"trigger": {
"@odata.type": "#microsoft.graph.identityGovernance.attributeChangeTrigger",
"triggerAttributes": [
{
"name": "department"
}
]
}
},
"tasks": [
{
"continueOnError": false,
"description": "Send email to moving employee's manager",
"displayName": "Notify manager of move",
"isEnabled": true,
"taskDefinitionId": "aab41899-9972-422a-9d97-f626014578b7",
"arguments": []
}
]
}
Beispiel 3: Erstellen eines Austrittsworkflows mithilfe des gruppenbasierten Triggers
Anforderung
Das folgende Beispiel zeigt eine Anforderung, die einen Workflow mit der folgenden Konfiguration erstellt:
- Es handelt sich um einen "Leaver"-Workflow, der aktiviert und zur Ausführung geplant ist.
- Sie wird für Benutzer ausgeführt, die mithilfe des gruppenbasierten Triggers aus der Vertriebsgruppe entfernt werden.
- Bei der Ausführung des Workflows werden zwei Aufgaben ausgeführt: Benutzer aus allen Teams entfernen, Benutzer aus allen Gruppen entfernen.
POST https://graph.microsoft.com/beta/identityGovernance/lifecycleWorkflows/workflows
Content-Type: application/json
{
"category": "leaver",
"description": "Configure offboarding tasks for employees on their last day of work",
"displayName": "Offboard an employee",
"isEnabled": true,
"isSchedulingEnabled": true,
"executionConditions": {
"@odata.type": "#microsoft.graph.identityGovernance.triggerAndScopeBasedConditions",
"scope": {
"@odata.type": "#microsoft.graph.identityGovernance.groupBasedSubjectSet",
"groups": [
{
"id": "668e7540-7f8e-4ca4-a207-b7dffbb6d038"
}
]
},
"trigger": {
"@odata.type": "#microsoft.graph.identityGovernance.membershipChangeTrigger",
"changeType": "remove"
}
},
"tasks": [
{
"category": "leaver",
"continueOnError": false,
"description": "Remove user from all Teams memberships",
"displayName": "Remove user from all Teams",
"isEnabled": true,
"taskDefinitionId": "81f7b200-2816-4b3b-8c5d-dc556f07b024",
"arguments": []
},
{
"category": "leaver",
"continueOnError": false,
"description": "Remove user from all Azure AD groups memberships",
"displayName": "Remove user from all groups",
"isEnabled": true,
"taskDefinitionId": "b3a31406-2a15-4c9a-b25b-a658fa5f07fc",
"arguments": []
}
]
}
// Code snippets are only available for the latest version. Current version is 5.x
// Dependencies
using Microsoft.Graph.Beta.Models.IdentityGovernance;
using Microsoft.Graph.Beta.Models;
var requestBody = new Workflow
{
Category = LifecycleWorkflowCategory.Leaver,
Description = "Configure offboarding tasks for employees on their last day of work",
DisplayName = "Offboard an employee",
IsEnabled = true,
IsSchedulingEnabled = true,
ExecutionConditions = new TriggerAndScopeBasedConditions
{
OdataType = "#microsoft.graph.identityGovernance.triggerAndScopeBasedConditions",
Scope = new GroupBasedSubjectSet
{
OdataType = "#microsoft.graph.identityGovernance.groupBasedSubjectSet",
Groups = new List<Group>
{
new Group
{
Id = "668e7540-7f8e-4ca4-a207-b7dffbb6d038",
},
},
},
Trigger = new MembershipChangeTrigger
{
OdataType = "#microsoft.graph.identityGovernance.membershipChangeTrigger",
ChangeType = MembershipChangeType.Remove,
},
},
Tasks = new List<TaskObject>
{
new TaskObject
{
Category = LifecycleTaskCategory.Leaver,
ContinueOnError = false,
Description = "Remove user from all Teams memberships",
DisplayName = "Remove user from all Teams",
IsEnabled = true,
TaskDefinitionId = "81f7b200-2816-4b3b-8c5d-dc556f07b024",
Arguments = new List<KeyValuePair>
{
},
},
new TaskObject
{
Category = LifecycleTaskCategory.Leaver,
ContinueOnError = false,
Description = "Remove user from all Azure AD groups memberships",
DisplayName = "Remove user from all groups",
IsEnabled = true,
TaskDefinitionId = "b3a31406-2a15-4c9a-b25b-a658fa5f07fc",
Arguments = new List<KeyValuePair>
{
},
},
},
};
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.IdentityGovernance.LifecycleWorkflows.Workflows.PostAsync(requestBody);
// Code snippets are only available for the latest major version. Current major version is $v0.*
// Dependencies
import (
"context"
msgraphsdk "github.com/microsoftgraph/msgraph-beta-sdk-go"
graphmodelsidentitygovernance "github.com/microsoftgraph/msgraph-beta-sdk-go/models/identitygovernance"
graphmodels "github.com/microsoftgraph/msgraph-beta-sdk-go/models"
//other-imports
)
requestBody := graphmodelsidentitygovernance.NewWorkflow()
category := graphmodels.LEAVER_LIFECYCLEWORKFLOWCATEGORY
requestBody.SetCategory(&category)
description := "Configure offboarding tasks for employees on their last day of work"
requestBody.SetDescription(&description)
displayName := "Offboard an employee"
requestBody.SetDisplayName(&displayName)
isEnabled := true
requestBody.SetIsEnabled(&isEnabled)
isSchedulingEnabled := true
requestBody.SetIsSchedulingEnabled(&isSchedulingEnabled)
executionConditions := graphmodelsidentitygovernance.NewTriggerAndScopeBasedConditions()
scope := graphmodelsidentitygovernance.NewGroupBasedSubjectSet()
group := graphmodels.NewGroup()
id := "668e7540-7f8e-4ca4-a207-b7dffbb6d038"
group.SetId(&id)
groups := []graphmodels.Groupable {
group,
}
scope.SetGroups(groups)
executionConditions.SetScope(scope)
trigger := graphmodelsidentitygovernance.NewMembershipChangeTrigger()
changeType := graphmodels.REMOVE_MEMBERSHIPCHANGETYPE
trigger.SetChangeType(&changeType)
executionConditions.SetTrigger(trigger)
requestBody.SetExecutionConditions(executionConditions)
task := graphmodelsidentitygovernance.NewTask()
category := graphmodels.LEAVER_LIFECYCLETASKCATEGORY
task.SetCategory(&category)
continueOnError := false
task.SetContinueOnError(&continueOnError)
description := "Remove user from all Teams memberships"
task.SetDescription(&description)
displayName := "Remove user from all Teams"
task.SetDisplayName(&displayName)
isEnabled := true
task.SetIsEnabled(&isEnabled)
taskDefinitionId := "81f7b200-2816-4b3b-8c5d-dc556f07b024"
task.SetTaskDefinitionId(&taskDefinitionId)
arguments := []graphmodels.KeyValuePairable {
}
task.SetArguments(arguments)
task1 := graphmodelsidentitygovernance.NewTask()
category := graphmodels.LEAVER_LIFECYCLETASKCATEGORY
task1.SetCategory(&category)
continueOnError := false
task1.SetContinueOnError(&continueOnError)
description := "Remove user from all Azure AD groups memberships"
task1.SetDescription(&description)
displayName := "Remove user from all groups"
task1.SetDisplayName(&displayName)
isEnabled := true
task1.SetIsEnabled(&isEnabled)
taskDefinitionId := "b3a31406-2a15-4c9a-b25b-a658fa5f07fc"
task1.SetTaskDefinitionId(&taskDefinitionId)
arguments := []graphmodels.KeyValuePairable {
}
task1.SetArguments(arguments)
tasks := []graphmodelsidentitygovernance.Taskable {
task,
task1,
}
requestBody.SetTasks(tasks)
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
workflows, err := graphClient.IdentityGovernance().LifecycleWorkflows().Workflows().Post(context.Background(), requestBody, nil)
// Code snippets are only available for the latest version. Current version is 6.x
GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);
com.microsoft.graph.beta.models.identitygovernance.Workflow workflow = new com.microsoft.graph.beta.models.identitygovernance.Workflow();
workflow.setCategory(com.microsoft.graph.beta.models.identitygovernance.LifecycleWorkflowCategory.Leaver);
workflow.setDescription("Configure offboarding tasks for employees on their last day of work");
workflow.setDisplayName("Offboard an employee");
workflow.setIsEnabled(true);
workflow.setIsSchedulingEnabled(true);
com.microsoft.graph.beta.models.identitygovernance.TriggerAndScopeBasedConditions executionConditions = new com.microsoft.graph.beta.models.identitygovernance.TriggerAndScopeBasedConditions();
executionConditions.setOdataType("#microsoft.graph.identityGovernance.triggerAndScopeBasedConditions");
com.microsoft.graph.beta.models.identitygovernance.GroupBasedSubjectSet scope = new com.microsoft.graph.beta.models.identitygovernance.GroupBasedSubjectSet();
scope.setOdataType("#microsoft.graph.identityGovernance.groupBasedSubjectSet");
LinkedList<Group> groups = new LinkedList<Group>();
Group group = new Group();
group.setId("668e7540-7f8e-4ca4-a207-b7dffbb6d038");
groups.add(group);
scope.setGroups(groups);
executionConditions.setScope(scope);
com.microsoft.graph.beta.models.identitygovernance.MembershipChangeTrigger trigger = new com.microsoft.graph.beta.models.identitygovernance.MembershipChangeTrigger();
trigger.setOdataType("#microsoft.graph.identityGovernance.membershipChangeTrigger");
trigger.setChangeType(com.microsoft.graph.beta.models.identitygovernance.MembershipChangeType.Remove);
executionConditions.setTrigger(trigger);
workflow.setExecutionConditions(executionConditions);
LinkedList<com.microsoft.graph.beta.models.identitygovernance.Task> tasks = new LinkedList<com.microsoft.graph.beta.models.identitygovernance.Task>();
com.microsoft.graph.beta.models.identitygovernance.Task task = new com.microsoft.graph.beta.models.identitygovernance.Task();
task.setCategory(EnumSet.of(com.microsoft.graph.beta.models.identitygovernance.LifecycleTaskCategory.Leaver));
task.setContinueOnError(false);
task.setDescription("Remove user from all Teams memberships");
task.setDisplayName("Remove user from all Teams");
task.setIsEnabled(true);
task.setTaskDefinitionId("81f7b200-2816-4b3b-8c5d-dc556f07b024");
LinkedList<KeyValuePair> arguments = new LinkedList<KeyValuePair>();
task.setArguments(arguments);
tasks.add(task);
com.microsoft.graph.beta.models.identitygovernance.Task task1 = new com.microsoft.graph.beta.models.identitygovernance.Task();
task1.setCategory(EnumSet.of(com.microsoft.graph.beta.models.identitygovernance.LifecycleTaskCategory.Leaver));
task1.setContinueOnError(false);
task1.setDescription("Remove user from all Azure AD groups memberships");
task1.setDisplayName("Remove user from all groups");
task1.setIsEnabled(true);
task1.setTaskDefinitionId("b3a31406-2a15-4c9a-b25b-a658fa5f07fc");
LinkedList<KeyValuePair> arguments1 = new LinkedList<KeyValuePair>();
task1.setArguments(arguments1);
tasks.add(task1);
workflow.setTasks(tasks);
com.microsoft.graph.models.identitygovernance.Workflow result = graphClient.identityGovernance().lifecycleWorkflows().workflows().post(workflow);
const options = {
authProvider,
};
const client = Client.init(options);
const workflow = {
category: 'leaver',
description: 'Configure offboarding tasks for employees on their last day of work',
displayName: 'Offboard an employee',
isEnabled: true,
isSchedulingEnabled: true,
executionConditions: {
'@odata.type': '#microsoft.graph.identityGovernance.triggerAndScopeBasedConditions',
scope: {
'@odata.type': '#microsoft.graph.identityGovernance.groupBasedSubjectSet',
groups: [
{
id: '668e7540-7f8e-4ca4-a207-b7dffbb6d038'
}
]
},
trigger: {
'@odata.type': '#microsoft.graph.identityGovernance.membershipChangeTrigger',
changeType: 'remove'
}
},
tasks: [
{
category: 'leaver',
continueOnError: false,
description: 'Remove user from all Teams memberships',
displayName: 'Remove user from all Teams',
isEnabled: true,
taskDefinitionId: '81f7b200-2816-4b3b-8c5d-dc556f07b024',
arguments: []
},
{
category: 'leaver',
continueOnError: false,
description: 'Remove user from all Azure AD groups memberships',
displayName: 'Remove user from all groups',
isEnabled: true,
taskDefinitionId: 'b3a31406-2a15-4c9a-b25b-a658fa5f07fc',
arguments: []
}
]
};
await client.api('/identityGovernance/lifecycleWorkflows/workflows')
.version('beta')
.post(workflow);
<?php
use Microsoft\Graph\Beta\GraphServiceClient;
use Microsoft\Graph\Beta\Generated\Models\IdentityGovernance\Workflow;
use Microsoft\Graph\Beta\Generated\Models\IdentityGovernance\LifecycleWorkflowCategory;
use Microsoft\Graph\Beta\Generated\Models\IdentityGovernance\TriggerAndScopeBasedConditions;
use Microsoft\Graph\Beta\Generated\Models\IdentityGovernance\GroupBasedSubjectSet;
use Microsoft\Graph\Beta\Generated\Models\Group;
use Microsoft\Graph\Beta\Generated\Models\IdentityGovernance\MembershipChangeTrigger;
use Microsoft\Graph\Beta\Generated\Models\IdentityGovernance\MembershipChangeType;
use Microsoft\Graph\Beta\Generated\Models\IdentityGovernance\Task;
use Microsoft\Graph\Beta\Generated\Models\IdentityGovernance\LifecycleTaskCategory;
use Microsoft\Graph\Beta\Generated\Models\KeyValuePair;
$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);
$requestBody = new Workflow();
$requestBody->setCategory(new LifecycleWorkflowCategory('leaver'));
$requestBody->setDescription('Configure offboarding tasks for employees on their last day of work');
$requestBody->setDisplayName('Offboard an employee');
$requestBody->setIsEnabled(true);
$requestBody->setIsSchedulingEnabled(true);
$executionConditions = new TriggerAndScopeBasedConditions();
$executionConditions->setOdataType('#microsoft.graph.identityGovernance.triggerAndScopeBasedConditions');
$executionConditionsScope = new GroupBasedSubjectSet();
$executionConditionsScope->setOdataType('#microsoft.graph.identityGovernance.groupBasedSubjectSet');
$groupsGroup1 = new Group();
$groupsGroup1->setId('668e7540-7f8e-4ca4-a207-b7dffbb6d038');
$groupsArray []= $groupsGroup1;
$executionConditionsScope->setGroups($groupsArray);
$executionConditions->setScope($executionConditionsScope);
$executionConditionsTrigger = new MembershipChangeTrigger();
$executionConditionsTrigger->setOdataType('#microsoft.graph.identityGovernance.membershipChangeTrigger');
$executionConditionsTrigger->setChangeType(new MembershipChangeType('remove'));
$executionConditions->setTrigger($executionConditionsTrigger);
$requestBody->setExecutionConditions($executionConditions);
$tasksTask1 = new Task();
$tasksTask1->setCategory(new LifecycleTaskCategory('leaver'));
$tasksTask1->setContinueOnError(false);
$tasksTask1->setDescription('Remove user from all Teams memberships');
$tasksTask1->setDisplayName('Remove user from all Teams');
$tasksTask1->setIsEnabled(true);
$tasksTask1->setTaskDefinitionId('81f7b200-2816-4b3b-8c5d-dc556f07b024');
$tasksTask1->setArguments([]);
$tasksArray []= $tasksTask1;
$tasksTask2 = new Task();
$tasksTask2->setCategory(new LifecycleTaskCategory('leaver'));
$tasksTask2->setContinueOnError(false);
$tasksTask2->setDescription('Remove user from all Azure AD groups memberships');
$tasksTask2->setDisplayName('Remove user from all groups');
$tasksTask2->setIsEnabled(true);
$tasksTask2->setTaskDefinitionId('b3a31406-2a15-4c9a-b25b-a658fa5f07fc');
$tasksTask2->setArguments([]);
$tasksArray []= $tasksTask2;
$requestBody->setTasks($tasksArray);
$result = $graphServiceClient->identityGovernance()->lifecycleWorkflows()->workflows()->post($requestBody)->wait();
Import-Module Microsoft.Graph.Beta.Identity.Governance
$params = @{
category = "leaver"
description = "Configure offboarding tasks for employees on their last day of work"
displayName = "Offboard an employee"
isEnabled = $true
isSchedulingEnabled = $true
executionConditions = @{
"@odata.type" = "#microsoft.graph.identityGovernance.triggerAndScopeBasedConditions"
scope = @{
"@odata.type" = "#microsoft.graph.identityGovernance.groupBasedSubjectSet"
groups = @(
@{
id = "668e7540-7f8e-4ca4-a207-b7dffbb6d038"
}
)
}
trigger = @{
"@odata.type" = "#microsoft.graph.identityGovernance.membershipChangeTrigger"
changeType = "remove"
}
}
tasks = @(
@{
category = "leaver"
continueOnError = $false
description = "Remove user from all Teams memberships"
displayName = "Remove user from all Teams"
isEnabled = $true
taskDefinitionId = "81f7b200-2816-4b3b-8c5d-dc556f07b024"
arguments = @(
)
}
@{
category = "leaver"
continueOnError = $false
description = "Remove user from all Azure AD groups memberships"
displayName = "Remove user from all groups"
isEnabled = $true
taskDefinitionId = "b3a31406-2a15-4c9a-b25b-a658fa5f07fc"
arguments = @(
)
}
)
}
New-MgBetaIdentityGovernanceLifecycleWorkflow -BodyParameter $params
# Code snippets are only available for the latest version. Current version is 1.x
from msgraph_beta import GraphServiceClient
from msgraph_beta.generated.models.identity_governance.workflow import Workflow
from msgraph_beta.generated.models.lifecycle_workflow_category import LifecycleWorkflowCategory
from msgraph_beta.generated.models.identity_governance.trigger_and_scope_based_conditions import TriggerAndScopeBasedConditions
from msgraph_beta.generated.models.identity_governance.group_based_subject_set import GroupBasedSubjectSet
from msgraph_beta.generated.models.group import Group
from msgraph_beta.generated.models.identity_governance.membership_change_trigger import MembershipChangeTrigger
from msgraph_beta.generated.models.membership_change_type import MembershipChangeType
from msgraph_beta.generated.models.identity_governance.task import Task
from msgraph_beta.generated.models.lifecycle_task_category import LifecycleTaskCategory
from msgraph_beta.generated.models.key_value_pair import KeyValuePair
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
request_body = Workflow(
category = LifecycleWorkflowCategory.Leaver,
description = "Configure offboarding tasks for employees on their last day of work",
display_name = "Offboard an employee",
is_enabled = True,
is_scheduling_enabled = True,
execution_conditions = TriggerAndScopeBasedConditions(
odata_type = "#microsoft.graph.identityGovernance.triggerAndScopeBasedConditions",
scope = GroupBasedSubjectSet(
odata_type = "#microsoft.graph.identityGovernance.groupBasedSubjectSet",
groups = [
Group(
id = "668e7540-7f8e-4ca4-a207-b7dffbb6d038",
),
],
),
trigger = MembershipChangeTrigger(
odata_type = "#microsoft.graph.identityGovernance.membershipChangeTrigger",
change_type = MembershipChangeType.Remove,
),
),
tasks = [
Task(
category = LifecycleTaskCategory.Leaver,
continue_on_error = False,
description = "Remove user from all Teams memberships",
display_name = "Remove user from all Teams",
is_enabled = True,
task_definition_id = "81f7b200-2816-4b3b-8c5d-dc556f07b024",
arguments = [
],
),
Task(
category = LifecycleTaskCategory.Leaver,
continue_on_error = False,
description = "Remove user from all Azure AD groups memberships",
display_name = "Remove user from all groups",
is_enabled = True,
task_definition_id = "b3a31406-2a15-4c9a-b25b-a658fa5f07fc",
arguments = [
],
),
],
)
result = await graph_client.identity_governance.lifecycle_workflows.workflows.post(request_body)
Antwort
Das folgende Beispiel zeigt die Antwort.
Hinweis: Das hier gezeigte Antwortobjekt kann zur besseren Lesbarkeit gekürzt werden.
HTTP/1.1 201 Created
Content-Type: application/json
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#identityGovernance/lifecycleWorkflows/workflows/$entity",
"category": "leaver",
"description": "Configure offboarding tasks for employees on their last day of work",
"displayName": "Offboard an employee",
"isEnabled": true,
"isSchedulingEnabled": true,
"lastModifiedDateTime": "2024-03-28T20:20:05.6599449Z",
"createdDateTime": "2024-03-28T20:20:05.6599142Z",
"deletedDateTime": null,
"id": "73ed8912-6a04-4f5d-bef8-61fcc94336a7",
"nextScheduleRunDateTime": "2024-03-28T20:37:08Z",
"version": 1,
"executionConditions": {
"@odata.type": "#microsoft.graph.identityGovernance.triggerAndScopeBasedConditions",
"scope": {
"@odata.type": "#microsoft.graph.identityGovernance.groupBasedSubjectSet"
},
"trigger": {
"@odata.type": "#microsoft.graph.identityGovernance.membershipChangeTrigger",
"changeType": "remove"
}
}
}
Beispiel 4: Erstellen eines Mover-Workflows mit einem festgelegten Zielbereich
Anforderung
Das folgende Beispiel zeigt eine Anforderung, die einen Workflow mit der folgenden Konfiguration erstellt:
- Es handelt sich um einen "Mover"-Workflow-fähigen Vorgang, der nur bei Bedarf ausgeführt werden soll.
- Sie wird für Nutzer innerhalb des festgelegten Zielbereichs der Verwaltungseinheiten "4f9dc456-0574-4122-9e55-8b4cc494b27d" und "2c987843-e9b1-4b1a-b924-ff1d2a9b054d" ausgeführt.
- Eine Aufgabe wird ausgeführt, nämlich eine E-Mail zu senden, um den Manager des Benutzers über den Umzug zu informieren.
POST https://graph.microsoft.com/beta/identityGovernance/lifecycleWorkflows/workflows
{
"category": "mover",
"displayName": "On Demand workflow move",
"description": "Execute real-time tasks for employee job changes",
"tasks": [
{
"arguments": [],
"description": "Send email to notify user’s manager of user move",
"displayName": "Send email to notify manager of user move",
"isEnabled": true,
"continueOnError": false,
"taskDefinitionId": "aab41899-9972-422a-9d97-f626014578b7",
"category": "mover"
}
],
"executionConditions": {
"@odata.type": "#microsoft.graph.identityGovernance.onDemandExecutionOnly"
},
"isEnabled": true,
"isSchedulingEnabled": false,
"administrationScopeTargets": [
{
"@odata.type": "#microsoft.graph.administrativeUnit",
"id": "4f9dc456-0574-4122-9e55-8b4cc494b27d"
},
{
"@odata.type": "#microsoft.graph.administrativeUnit",
"id": "2c987843-e9b1-4b1a-b924-ff1d2a9b054d"
}
]
}
// Code snippets are only available for the latest version. Current version is 5.x
// Dependencies
using Microsoft.Graph.Beta.Models.IdentityGovernance;
using Microsoft.Graph.Beta.Models;
var requestBody = new Workflow
{
Category = LifecycleWorkflowCategory.Mover,
DisplayName = "On Demand workflow move",
Description = "Execute real-time tasks for employee job changes",
Tasks = new List<TaskObject>
{
new TaskObject
{
Arguments = new List<KeyValuePair>
{
},
Description = "Send email to notify user’s manager of user move",
DisplayName = "Send email to notify manager of user move",
IsEnabled = true,
ContinueOnError = false,
TaskDefinitionId = "aab41899-9972-422a-9d97-f626014578b7",
Category = LifecycleTaskCategory.Mover,
},
},
ExecutionConditions = new OnDemandExecutionOnly
{
OdataType = "#microsoft.graph.identityGovernance.onDemandExecutionOnly",
},
IsEnabled = true,
IsSchedulingEnabled = false,
AdministrationScopeTargets = new List<DirectoryObject>
{
new AdministrativeUnit
{
OdataType = "#microsoft.graph.administrativeUnit",
Id = "4f9dc456-0574-4122-9e55-8b4cc494b27d",
},
new AdministrativeUnit
{
OdataType = "#microsoft.graph.administrativeUnit",
Id = "2c987843-e9b1-4b1a-b924-ff1d2a9b054d",
},
},
};
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.IdentityGovernance.LifecycleWorkflows.Workflows.PostAsync(requestBody);
// Code snippets are only available for the latest major version. Current major version is $v0.*
// Dependencies
import (
"context"
msgraphsdk "github.com/microsoftgraph/msgraph-beta-sdk-go"
graphmodelsidentitygovernance "github.com/microsoftgraph/msgraph-beta-sdk-go/models/identitygovernance"
graphmodels "github.com/microsoftgraph/msgraph-beta-sdk-go/models"
//other-imports
)
requestBody := graphmodelsidentitygovernance.NewWorkflow()
category := graphmodels.MOVER_LIFECYCLEWORKFLOWCATEGORY
requestBody.SetCategory(&category)
displayName := "On Demand workflow move"
requestBody.SetDisplayName(&displayName)
description := "Execute real-time tasks for employee job changes"
requestBody.SetDescription(&description)
task := graphmodelsidentitygovernance.NewTask()
arguments := []graphmodels.KeyValuePairable {
}
task.SetArguments(arguments)
description := "Send email to notify user’s manager of user move"
task.SetDescription(&description)
displayName := "Send email to notify manager of user move"
task.SetDisplayName(&displayName)
isEnabled := true
task.SetIsEnabled(&isEnabled)
continueOnError := false
task.SetContinueOnError(&continueOnError)
taskDefinitionId := "aab41899-9972-422a-9d97-f626014578b7"
task.SetTaskDefinitionId(&taskDefinitionId)
category := graphmodels.MOVER_LIFECYCLETASKCATEGORY
task.SetCategory(&category)
tasks := []graphmodelsidentitygovernance.Taskable {
task,
}
requestBody.SetTasks(tasks)
executionConditions := graphmodelsidentitygovernance.NewOnDemandExecutionOnly()
requestBody.SetExecutionConditions(executionConditions)
isEnabled := true
requestBody.SetIsEnabled(&isEnabled)
isSchedulingEnabled := false
requestBody.SetIsSchedulingEnabled(&isSchedulingEnabled)
directoryObject := graphmodels.NewAdministrativeUnit()
id := "4f9dc456-0574-4122-9e55-8b4cc494b27d"
directoryObject.SetId(&id)
directoryObject1 := graphmodels.NewAdministrativeUnit()
id := "2c987843-e9b1-4b1a-b924-ff1d2a9b054d"
directoryObject1.SetId(&id)
administrationScopeTargets := []graphmodels.DirectoryObjectable {
directoryObject,
directoryObject1,
}
requestBody.SetAdministrationScopeTargets(administrationScopeTargets)
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
workflows, err := graphClient.IdentityGovernance().LifecycleWorkflows().Workflows().Post(context.Background(), requestBody, nil)
// Code snippets are only available for the latest version. Current version is 6.x
GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);
com.microsoft.graph.beta.models.identitygovernance.Workflow workflow = new com.microsoft.graph.beta.models.identitygovernance.Workflow();
workflow.setCategory(com.microsoft.graph.beta.models.identitygovernance.LifecycleWorkflowCategory.Mover);
workflow.setDisplayName("On Demand workflow move");
workflow.setDescription("Execute real-time tasks for employee job changes");
LinkedList<com.microsoft.graph.beta.models.identitygovernance.Task> tasks = new LinkedList<com.microsoft.graph.beta.models.identitygovernance.Task>();
com.microsoft.graph.beta.models.identitygovernance.Task task = new com.microsoft.graph.beta.models.identitygovernance.Task();
LinkedList<KeyValuePair> arguments = new LinkedList<KeyValuePair>();
task.setArguments(arguments);
task.setDescription("Send email to notify user’s manager of user move");
task.setDisplayName("Send email to notify manager of user move");
task.setIsEnabled(true);
task.setContinueOnError(false);
task.setTaskDefinitionId("aab41899-9972-422a-9d97-f626014578b7");
task.setCategory(EnumSet.of(com.microsoft.graph.beta.models.identitygovernance.LifecycleTaskCategory.Mover));
tasks.add(task);
workflow.setTasks(tasks);
com.microsoft.graph.beta.models.identitygovernance.OnDemandExecutionOnly executionConditions = new com.microsoft.graph.beta.models.identitygovernance.OnDemandExecutionOnly();
executionConditions.setOdataType("#microsoft.graph.identityGovernance.onDemandExecutionOnly");
workflow.setExecutionConditions(executionConditions);
workflow.setIsEnabled(true);
workflow.setIsSchedulingEnabled(false);
LinkedList<DirectoryObject> administrationScopeTargets = new LinkedList<DirectoryObject>();
AdministrativeUnit directoryObject = new AdministrativeUnit();
directoryObject.setOdataType("#microsoft.graph.administrativeUnit");
directoryObject.setId("4f9dc456-0574-4122-9e55-8b4cc494b27d");
administrationScopeTargets.add(directoryObject);
AdministrativeUnit directoryObject1 = new AdministrativeUnit();
directoryObject1.setOdataType("#microsoft.graph.administrativeUnit");
directoryObject1.setId("2c987843-e9b1-4b1a-b924-ff1d2a9b054d");
administrationScopeTargets.add(directoryObject1);
workflow.setAdministrationScopeTargets(administrationScopeTargets);
com.microsoft.graph.models.identitygovernance.Workflow result = graphClient.identityGovernance().lifecycleWorkflows().workflows().post(workflow);
const options = {
authProvider,
};
const client = Client.init(options);
const workflow = {
category: 'mover',
displayName: 'On Demand workflow move',
description: 'Execute real-time tasks for employee job changes',
tasks: [
{
arguments: [],
description: 'Send email to notify user’s manager of user move',
displayName: 'Send email to notify manager of user move',
isEnabled: true,
continueOnError: false,
taskDefinitionId: 'aab41899-9972-422a-9d97-f626014578b7',
category: 'mover'
}
],
executionConditions: {
'@odata.type': '#microsoft.graph.identityGovernance.onDemandExecutionOnly'
},
isEnabled: true,
isSchedulingEnabled: false,
administrationScopeTargets: [
{
'@odata.type': '#microsoft.graph.administrativeUnit',
id: '4f9dc456-0574-4122-9e55-8b4cc494b27d'
},
{
'@odata.type': '#microsoft.graph.administrativeUnit',
id: '2c987843-e9b1-4b1a-b924-ff1d2a9b054d'
}
]
};
await client.api('/identityGovernance/lifecycleWorkflows/workflows')
.version('beta')
.post(workflow);
<?php
use Microsoft\Graph\Beta\GraphServiceClient;
use Microsoft\Graph\Beta\Generated\Models\IdentityGovernance\Workflow;
use Microsoft\Graph\Beta\Generated\Models\IdentityGovernance\LifecycleWorkflowCategory;
use Microsoft\Graph\Beta\Generated\Models\IdentityGovernance\Task;
use Microsoft\Graph\Beta\Generated\Models\KeyValuePair;
use Microsoft\Graph\Beta\Generated\Models\IdentityGovernance\LifecycleTaskCategory;
use Microsoft\Graph\Beta\Generated\Models\IdentityGovernance\OnDemandExecutionOnly;
use Microsoft\Graph\Beta\Generated\Models\DirectoryObject;
use Microsoft\Graph\Beta\Generated\Models\AdministrativeUnit;
$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);
$requestBody = new Workflow();
$requestBody->setCategory(new LifecycleWorkflowCategory('mover'));
$requestBody->setDisplayName('On Demand workflow move');
$requestBody->setDescription('Execute real-time tasks for employee job changes');
$tasksTask1 = new Task();
$tasksTask1->setArguments([ ]);
$tasksTask1->setDescription('Send email to notify user’s manager of user move');
$tasksTask1->setDisplayName('Send email to notify manager of user move');
$tasksTask1->setIsEnabled(true);
$tasksTask1->setContinueOnError(false);
$tasksTask1->setTaskDefinitionId('aab41899-9972-422a-9d97-f626014578b7');
$tasksTask1->setCategory(new LifecycleTaskCategory('mover'));
$tasksArray []= $tasksTask1;
$requestBody->setTasks($tasksArray);
$executionConditions = new OnDemandExecutionOnly();
$executionConditions->setOdataType('#microsoft.graph.identityGovernance.onDemandExecutionOnly');
$requestBody->setExecutionConditions($executionConditions);
$requestBody->setIsEnabled(true);
$requestBody->setIsSchedulingEnabled(false);
$administrationScopeTargetsDirectoryObject1 = new AdministrativeUnit();
$administrationScopeTargetsDirectoryObject1->setOdataType('#microsoft.graph.administrativeUnit');
$administrationScopeTargetsDirectoryObject1->setId('4f9dc456-0574-4122-9e55-8b4cc494b27d');
$administrationScopeTargetsArray []= $administrationScopeTargetsDirectoryObject1;
$administrationScopeTargetsDirectoryObject2 = new AdministrativeUnit();
$administrationScopeTargetsDirectoryObject2->setOdataType('#microsoft.graph.administrativeUnit');
$administrationScopeTargetsDirectoryObject2->setId('2c987843-e9b1-4b1a-b924-ff1d2a9b054d');
$administrationScopeTargetsArray []= $administrationScopeTargetsDirectoryObject2;
$requestBody->setAdministrationScopeTargets($administrationScopeTargetsArray);
$result = $graphServiceClient->identityGovernance()->lifecycleWorkflows()->workflows()->post($requestBody)->wait();
Import-Module Microsoft.Graph.Beta.Identity.Governance
$params = @{
category = "mover"
displayName = "On Demand workflow move"
description = "Execute real-time tasks for employee job changes"
tasks = @(
@{
arguments = @(
)
description = "Send email to notify user’s manager of user move"
displayName = "Send email to notify manager of user move"
isEnabled = $true
continueOnError = $false
taskDefinitionId = "aab41899-9972-422a-9d97-f626014578b7"
category = "mover"
}
)
executionConditions = @{
"@odata.type" = "#microsoft.graph.identityGovernance.onDemandExecutionOnly"
}
isEnabled = $true
isSchedulingEnabled = $false
administrationScopeTargets = @(
@{
"@odata.type" = "#microsoft.graph.administrativeUnit"
id = "4f9dc456-0574-4122-9e55-8b4cc494b27d"
}
@{
"@odata.type" = "#microsoft.graph.administrativeUnit"
id = "2c987843-e9b1-4b1a-b924-ff1d2a9b054d"
}
)
}
New-MgBetaIdentityGovernanceLifecycleWorkflow -BodyParameter $params
# Code snippets are only available for the latest version. Current version is 1.x
from msgraph_beta import GraphServiceClient
from msgraph_beta.generated.models.identity_governance.workflow import Workflow
from msgraph_beta.generated.models.lifecycle_workflow_category import LifecycleWorkflowCategory
from msgraph_beta.generated.models.identity_governance.task import Task
from msgraph_beta.generated.models.key_value_pair import KeyValuePair
from msgraph_beta.generated.models.lifecycle_task_category import LifecycleTaskCategory
from msgraph_beta.generated.models.identity_governance.on_demand_execution_only import OnDemandExecutionOnly
from msgraph_beta.generated.models.directory_object import DirectoryObject
from msgraph_beta.generated.models.administrative_unit import AdministrativeUnit
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
request_body = Workflow(
category = LifecycleWorkflowCategory.Mover,
display_name = "On Demand workflow move",
description = "Execute real-time tasks for employee job changes",
tasks = [
Task(
arguments = [
],
description = "Send email to notify user’s manager of user move",
display_name = "Send email to notify manager of user move",
is_enabled = True,
continue_on_error = False,
task_definition_id = "aab41899-9972-422a-9d97-f626014578b7",
category = LifecycleTaskCategory.Mover,
),
],
execution_conditions = OnDemandExecutionOnly(
odata_type = "#microsoft.graph.identityGovernance.onDemandExecutionOnly",
),
is_enabled = True,
is_scheduling_enabled = False,
administration_scope_targets = [
AdministrativeUnit(
odata_type = "#microsoft.graph.administrativeUnit",
id = "4f9dc456-0574-4122-9e55-8b4cc494b27d",
),
AdministrativeUnit(
odata_type = "#microsoft.graph.administrativeUnit",
id = "2c987843-e9b1-4b1a-b924-ff1d2a9b054d",
),
],
)
result = await graph_client.identity_governance.lifecycle_workflows.workflows.post(request_body)
Antwort
Das folgende Beispiel zeigt die Antwort.
Hinweis: Das hier gezeigte Antwortobjekt kann zur besseren Lesbarkeit gekürzt werden.
HTTP/1.1 201 Created
Content-Type: application/json
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#identityGovernance/lifecycleWorkflows/workflows/$entity",
"category": "mover",
"description": "Execute real-time tasks for employee job changes",
"displayName": "On Demand workflow move",
"isEnabled": true,
"isSchedulingEnabled": false,
"lastModifiedDateTime": "2025-01-09T15:28:24.0565594Z",
"createdDateTime": "2025-01-09T15:28:24.0565526Z",
"id": "465d0d08-3099-483f-9d93-16aad77bcd22",
"version": 1,
"administrationScopeTargets": [
{
"@odata.type": "#microsoft.graph.administrativeUnit",
"id": "4f9dc456-0574-4122-9e55-8b4cc494b27d"
},
{
"@odata.type": "#microsoft.graph.administrativeUnit",
"id": "2c987843-e9b1-4b1a-b924-ff1d2a9b054d"
}
]
}
Beispiel 5: Erstellen eines Workflows, der sieben Tage vor einem Einstellungsdatum ausgeführt wird
Anforderung
Im folgenden Beispiel wird ein Workflow erstellt, der genau sieben Tage vor dem Einstellungsdatum eines Benutzers ausgeführt wird.
POST https://graph.microsoft.com/beta/identityGovernance/lifecycleWorkflows/workflows
Content-Type: application/json
{
"displayName": "Pre-hire onboarding: 7 days before hire",
"isEnabled": true,
"isSchedulingEnabled": true,
"executionConditions": {
"@odata.type": "#microsoft.graph.identityGovernance.triggerAndScopeBasedConditions",
"scope": {
"@odata.type": "#microsoft.graph.identityGovernance.ruleBasedSubjectSet",
"rule": "(department eq 'Engineering')"
},
"trigger": {
"@odata.type": "#microsoft.graph.identityGovernance.timeBasedAttributeTriggerV2",
"attribute": "employeeHireDate",
"operator": {
"@odata.type": "#microsoft.graph.identityGovernance.operatorEqualTo",
"eventTiming": "before",
"offsetInDays": 7
}
}
},
"tasks": [
{
"isEnabled": true,
"taskDefinitionId": "1b555e50-7f65-41d5-b514-5894a026d10d",
"displayName": "Generate TAP And Send Email"
}
]
}
Antwort
Das folgende Beispiel zeigt die Antwort.
HTTP/1.1 201 Created
Content-Type: application/json
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#identityGovernance/lifecycleWorkflows/workflows/$entity",
"id": "c35e0d2a-8725-4aa1-b132-6b21a80635b5",
"displayName": "Pre-hire onboarding: 7 days before hire",
"isEnabled": true,
"isSchedulingEnabled": true,
"version": 1
}
Beispiel 6: Erstellen eines Workflows für Benutzer innerhalb von 60 Tagen nach einem Urlaubsdatum
Anforderung
Im folgenden Beispiel wird ein Workflow erstellt, der den Bereich für Benutzer festlegt, deren Urlaubsdatum 60 Tage oder weniger zurückliegt.
POST https://graph.microsoft.com/beta/identityGovernance/lifecycleWorkflows/workflows
Content-Type: application/json
{
"displayName": "Post-leave compliance: within 60 days after leave",
"isEnabled": true,
"isSchedulingEnabled": true,
"executionConditions": {
"@odata.type": "#microsoft.graph.identityGovernance.triggerAndScopeBasedConditions",
"scope": {
"@odata.type": "#microsoft.graph.identityGovernance.ruleBasedSubjectSet",
"rule": "(department eq 'Finance')"
},
"trigger": {
"@odata.type": "#microsoft.graph.identityGovernance.timeBasedAttributeTriggerV2",
"attribute": "employeeLeaveDateTime",
"operator": {
"@odata.type": "#microsoft.graph.identityGovernance.operatorLessThanEqualTo",
"eventTiming": "after",
"offsetInDays": 60
}
}
},
"tasks": [
{
"isEnabled": true,
"taskDefinitionId": "1b555e50-7f65-41d5-b514-5894a026d10d",
"displayName": "Run Post-Leave Compliance Check"
}
]
}
Antwort
Das folgende Beispiel zeigt die Antwort.
HTTP/1.1 201 Created
Content-Type: application/json
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#identityGovernance/lifecycleWorkflows/workflows/$entity",
"id": "83d68cba-56c0-4412-8bf7-1af2befc1333",
"displayName": "Post-leave compliance: within 60 days after leave",
"isEnabled": true,
"isSchedulingEnabled": true,
"version": 1
}
Beispiel 7: Erstellen eines Workflows für Benutzer, die vor 7 bis 30 Tagen eingestellt wurden
Anforderung
Im folgenden Beispiel wird ein Workflow erstellt, der den Bereich für Benutzer einschränkt, die vor mehr als sieben Tagen und weniger als 30 Tagen eingestellt wurden.
POST https://graph.microsoft.com/beta/identityGovernance/lifecycleWorkflows/workflows
Content-Type: application/json
{
"displayName": "Post-hire check-in: 7 to 30 days after hire",
"isEnabled": true,
"isSchedulingEnabled": true,
"executionConditions": {
"@odata.type": "#microsoft.graph.identityGovernance.triggerAndScopeBasedConditions",
"scope": {
"@odata.type": "#microsoft.graph.identityGovernance.ruleBasedSubjectSet",
"rule": "(department eq 'Engineering')"
},
"trigger": {
"@odata.type": "#microsoft.graph.identityGovernance.timeBasedAttributeTriggerV2",
"attribute": "employeeHireDate",
"operator": {
"@odata.type": "#microsoft.graph.identityGovernance.operatorBetween",
"eventTiming": "after",
"greaterThanOffsetInDays": 7,
"lessThanOffsetInDays": 30
}
}
},
"tasks": [
{
"isEnabled": true,
"taskDefinitionId": "1b555e50-7f65-41d5-b514-5894a026d10d",
"displayName": "Send Onboarding Check-in Survey"
}
]
}
Antwort
Das folgende Beispiel zeigt die Antwort.
HTTP/1.1 201 Created
Content-Type: application/json
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#identityGovernance/lifecycleWorkflows/workflows/$entity",
"id": "445ffc46-3ccc-4e1a-bac9-aef675ee8d18",
"displayName": "Post-hire check-in: 7 to 30 days after hire",
"isEnabled": true,
"isSchedulingEnabled": true,
"version": 1
}
Beispiel 8: Erstellen eines Workflows für Benutzer zwischen 3 und 14 Tagen vor einem Urlaubsdatum
Anforderung
Im folgenden Beispiel wird ein Workflow erstellt, der Benutzer einschränkt, deren Austrittsdatum mehr als drei Tage und weniger als 14 Tage in der Zukunft liegt.
POST https://graph.microsoft.com/beta/identityGovernance/lifecycleWorkflows/workflows
Content-Type: application/json
{
"displayName": "Pre-leave prep: 3 to 14 days before leave",
"isEnabled": true,
"isSchedulingEnabled": true,
"executionConditions": {
"@odata.type": "#microsoft.graph.identityGovernance.triggerAndScopeBasedConditions",
"scope": {
"@odata.type": "#microsoft.graph.identityGovernance.ruleBasedSubjectSet",
"rule": "(department eq 'Engineering')"
},
"trigger": {
"@odata.type": "#microsoft.graph.identityGovernance.timeBasedAttributeTriggerV2",
"attribute": "employeeLeaveDateTime",
"operator": {
"@odata.type": "#microsoft.graph.identityGovernance.operatorBetween",
"eventTiming": "before",
"greaterThanOffsetInDays": 3,
"lessThanOffsetInDays": 14
}
}
},
"tasks": [
{
"isEnabled": true,
"taskDefinitionId": "1b555e50-7f65-41d5-b514-5894a026d10d",
"displayName": "Transfer Ownership of Shared Resources"
}
]
}
Antwort
Das folgende Beispiel zeigt die Antwort.
HTTP/1.1 201 Created
Content-Type: application/json
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#identityGovernance/lifecycleWorkflows/workflows/$entity",
"id": "6bc1a524-6df8-4cfd-ac6d-caf9f88b3702",
"displayName": "Pre-leave prep: 3 to 14 days before leave",
"isEnabled": true,
"isSchedulingEnabled": true,
"version": 1
}
Beispiel 9: Erstellen eines Workflows, der am Einstellungsdatum ausgeführt wird
Anforderung
Im folgenden Beispiel wird ein Workflow erstellt, der am Einstellungsdatum eines Benutzers ausgeführt wird. Wenn offsetInDays ist 0, eventTiming muss festgelegt werden auf on.
POST https://graph.microsoft.com/beta/identityGovernance/lifecycleWorkflows/workflows
Content-Type: application/json
{
"displayName": "Day-of-hire: enable account and grant access",
"isEnabled": true,
"isSchedulingEnabled": true,
"executionConditions": {
"@odata.type": "#microsoft.graph.identityGovernance.triggerAndScopeBasedConditions",
"scope": {
"@odata.type": "#microsoft.graph.identityGovernance.ruleBasedSubjectSet",
"rule": "(department eq 'Engineering')"
},
"trigger": {
"@odata.type": "#microsoft.graph.identityGovernance.timeBasedAttributeTriggerV2",
"attribute": "employeeHireDate",
"operator": {
"@odata.type": "#microsoft.graph.identityGovernance.operatorEqualTo",
"eventTiming": "on",
"offsetInDays": 0
}
}
},
"tasks": [
{
"isEnabled": true,
"taskDefinitionId": "6fc52c9d-398b-4571-8c4c-57c8ea85daac",
"displayName": "Enable User Account"
}
]
}
Antwort
Das folgende Beispiel zeigt die Antwort.
HTTP/1.1 201 Created
Content-Type: application/json
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#identityGovernance/lifecycleWorkflows/workflows/$entity",
"id": "275fb885-528a-46f1-b5cf-cfdfb7069824",
"displayName": "Day-of-hire: enable account and grant access",
"isEnabled": true,
"isSchedulingEnabled": true,
"version": 1
}
Beispiel 10: Erstellen eines Workflows, der 30 Tage nach einem Urlaubsdatum ausgeführt wird
Anforderung
Im folgenden Beispiel wird ein Workflow erstellt, der genau 30 Tage nach dem Urlaubsdatum eines Benutzers ausgeführt wird.
POST https://graph.microsoft.com/beta/identityGovernance/lifecycleWorkflows/workflows
Content-Type: application/json
{
"displayName": "Post-leave cleanup: 30 days after leave",
"isEnabled": true,
"isSchedulingEnabled": true,
"executionConditions": {
"@odata.type": "#microsoft.graph.identityGovernance.triggerAndScopeBasedConditions",
"scope": {
"@odata.type": "#microsoft.graph.identityGovernance.ruleBasedSubjectSet",
"rule": "(department eq 'Engineering')"
},
"trigger": {
"@odata.type": "#microsoft.graph.identityGovernance.timeBasedAttributeTriggerV2",
"attribute": "employeeLeaveDateTime",
"operator": {
"@odata.type": "#microsoft.graph.identityGovernance.operatorEqualTo",
"eventTiming": "after",
"offsetInDays": 30
}
}
},
"tasks": [
{
"isEnabled": true,
"taskDefinitionId": "8d18588d-9ad3-4c0f-99d0-ec215f0e3dff",
"displayName": "Delete User Account"
}
]
}
Antwort
Das folgende Beispiel zeigt die Antwort.
HTTP/1.1 201 Created
Content-Type: application/json
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#identityGovernance/lifecycleWorkflows/workflows/$entity",
"id": "83b77dc5-751d-4640-b628-69d949b09bac",
"displayName": "Post-leave cleanup: 30 days after leave",
"isEnabled": true,
"isSchedulingEnabled": true,
"version": 1
}
Beispiel 11: Erstellen eines Workflows für Benutzer innerhalb von 14 Tagen nach einem Urlaubsdatum
Anforderung
Im folgenden Beispiel wird ein Workflow erstellt, der Benutzer einschränkt, deren Urlaubsdatum 14 Tage oder weniger in der Zukunft liegt.
POST https://graph.microsoft.com/beta/identityGovernance/lifecycleWorkflows/workflows
Content-Type: application/json
{
"displayName": "Pre-leave: within 14 days of leave",
"isEnabled": true,
"isSchedulingEnabled": true,
"executionConditions": {
"@odata.type": "#microsoft.graph.identityGovernance.triggerAndScopeBasedConditions",
"scope": {
"@odata.type": "#microsoft.graph.identityGovernance.ruleBasedSubjectSet",
"rule": "(department eq 'Engineering')"
},
"trigger": {
"@odata.type": "#microsoft.graph.identityGovernance.timeBasedAttributeTriggerV2",
"attribute": "employeeLeaveDateTime",
"operator": {
"@odata.type": "#microsoft.graph.identityGovernance.operatorLessThanEqualTo",
"eventTiming": "before",
"offsetInDays": 14
}
}
},
"tasks": [
{
"isEnabled": true,
"taskDefinitionId": "1b555e50-7f65-41d5-b514-5894a026d10d",
"displayName": "Send Offboarding Reminder to Manager"
}
]
}
Antwort
Das folgende Beispiel zeigt die Antwort.
HTTP/1.1 201 Created
Content-Type: application/json
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#identityGovernance/lifecycleWorkflows/workflows/$entity",
"id": "b784cf0f-1b6e-4e04-bb24-d2af0261514d",
"displayName": "Pre-leave: within 14 days of leave",
"isEnabled": true,
"isSchedulingEnabled": true,
"version": 1
}