Workday-Entra Provisioning - Pre-hire/hiring date not checked by the incremental sync

Question

Workday-Entra Provisioning - Pre-hire/hiring date not checked by the incremental sync

Fabrice Bastian 60

Hello,

We are using Workday with the Entra Provisioning connector to synchronize account from Workday to on-premise Active Directory.
The sync is in place and working as expected (mainly), except for this usecase:

We are trying to configure pre-hiring stuff: user is created in AD in disabled status and is then enable 1 day before his hiredate.
For this we have this expression in the accountDisabled attribute:

Switch([PastLastDayOfWork], Switch([Active], "False", "1", IIF(DateDiff("d", Now(), Join("", FormatDateTime([StatusHireDate], ,"yyyy-MM-ddzzz", "yyyy-MM-dd"), ""))<="1", "False", "True"), "0", "True"), "Workers past Last Day of Work", "True")

Account are correctly created in disabled state prior their hiredate.

Unfortunately, the account doesn't switch to active 1 day before reaching hiredate.

-> If we run on-demand provisioning, the account is correctly switch to active.

Is this a limitation of the incremental sync (as nothing changed on the worker profile, and so no workday transaction logs could be found)?

Did someone here already encounter this issue?

Best regards

Fabrice Bastian

VEMULA SRISAI 9,265 Reputation points Microsoft External Staff Moderator

2026-02-17T18:21:17.6433333+00:00

Hello Fabrice Bastian,

This is expected behavior with incremental sync in Workday → Entra provisioning. Incremental sync only processes workers that appear in Workday transaction/effective‑dated change logs. Since nothing changes on the worker record 1 day before the hire date, the user is not picked up and the Now()‑based expression is not re‑evaluated.

On‑demand provisioning works because it forces evaluation for that specific user. To enable accounts 1 day before hire, you’ll need a Workday‑driven attribute change/flag (so it appears in delta) or handle enablement via a scheduled downstream process (e.g., AD/Azure Automation) based on the hire date.

For your reference: https://learn.microsoft.com/en-us/entra/identity/app-provisioning/workday-integration-reference

https://learn.microsoft.com/en-us/entra/identity/app-provisioning/workday-integration-reference
VEMULA SRISAI 9,265 Reputation points Microsoft External Staff Moderator

2026-02-18T04:31:13.0933333+00:00

Fabrice Bastian I’m following up on my previous comment as I haven’t received a response. Please let me know if you need any additional information or assistance from my side.
Fabrice Bastian 60 Reputation points

2026-02-18T07:45:41.25+00:00
Hello Vemula,

First of all, thank you for your comment and links provided.
This was our assumption.
So basically it means that the accountDisabled attribute mapping should be configured should be configured as it will be only evaluated one time by default (as we cannot know in advance if something will be change on the worker profile between the first initial worker sync and the hiredate).

What kind of scheduling downstream process could we put in place to keep our logic:

when the worker is active in Workday, the account will be automatically created in disabled state on ActiveDirectory

1 day before his hiredate, the activedirectory profile is changed to active

Is there a way to schedule full sync to run to handle this case?

Best regards

Fabrice Bastian
VEMULA SRISAI 9,265 Reputation points Microsoft External Staff Moderator

2026-02-22T10:45:39.0966667+00:00

Fabrice Bastian I’m following up on my previous comment as I haven’t received a response. Please let me know if you need any additional information or assistance from my side.

Answer accepted by question author

0 additional answers

Your answer

VEMULA SRISAI 9,265 Reputation points Microsoft External Staff Moderator

2026-02-17T18:21:17.6433333+00:00

Hello Fabrice Bastian,

This is expected behavior with incremental sync in Workday → Entra provisioning. Incremental sync only processes workers that appear in Workday transaction/effective‑dated change logs. Since nothing changes on the worker record 1 day before the hire date, the user is not picked up and the Now()‑based expression is not re‑evaluated.

On‑demand provisioning works because it forces evaluation for that specific user. To enable accounts 1 day before hire, you’ll need a Workday‑driven attribute change/flag (so it appears in delta) or handle enablement via a scheduled downstream process (e.g., AD/Azure Automation) based on the hire date.

For your reference: https://learn.microsoft.com/en-us/entra/identity/app-provisioning/workday-integration-reference

https://learn.microsoft.com/en-us/entra/identity/app-provisioning/workday-integration-reference
VEMULA SRISAI 9,265 Reputation points Microsoft External Staff Moderator

2026-02-18T04:31:13.0933333+00:00

Fabrice Bastian I’m following up on my previous comment as I haven’t received a response. Please let me know if you need any additional information or assistance from my side.
Fabrice Bastian 60 Reputation points

2026-02-18T07:45:41.25+00:00

Hello Vemula,

First of all, thank you for your comment and links provided.
This was our assumption.
So basically it means that the accountDisabled attribute mapping should be configured should be configured as it will be only evaluated one time by default (as we cannot know in advance if something will be change on the worker profile between the first initial worker sync and the hiredate).

What kind of scheduling downstream process could we put in place to keep our logic:

when the worker is active in Workday, the account will be automatically created in disabled state on ActiveDirectory

1 day before his hiredate, the activedirectory profile is changed to active

Is there a way to schedule full sync to run to handle this case?

Best regards

Fabrice Bastian
VEMULA SRISAI 9,265 Reputation points Microsoft External Staff Moderator

2026-02-22T10:45:39.0966667+00:00

Fabrice Bastian I’m following up on my previous comment as I haven’t received a response. Please let me know if you need any additional information or assistance from my side.

Answer 1

Yes, your understanding is correct.

In Workday → Microsoft Entra provisioning, attribute mappings are evaluated only when a worker is picked up in the incremental (delta) sync. After the initial full sync, the connector cannot be configured to run scheduled full syncs, and there is no mechanism to periodically re‑evaluate mappings based on time‑based logic (such as Now() or hire‑date comparisons).

Because no Workday transaction occurs between pre‑hire creation and the hire date, the worker does not appear in the delta feed, so the accountDisabled expression is not re‑evaluated. On‑demand provisioning works because it explicitly forces evaluation for that user, but it cannot be scheduled or used at scale.

To keep your intended behavior:

Create AD account disabled when the worker becomes active in Workday
Enable AD account 1 day before hire date

you will need to use one of the following supported approaches:

Option 1 – Workday‑driven trigger (recommended) Introduce a Workday attribute or business process that changes 1 day before the hire date (for example, a calculated flag or effective‑dated field). This generates a Workday transaction, causing the worker to appear in incremental sync and allowing the accountDisabled mapping to be re‑evaluated.

Option 2 – Downstream scheduled process Keep Entra provisioning focused on account creation, and handle enablement separately using a scheduled process (PowerShell, Azure Automation, or AD task) that:

Identifies disabled AD accounts
Compares against the hire date
Enables the account 1 day before hire

This limitation is by design and applies to all time‑based provisioning scenarios.

For your reference: https://learn.microsoft.com/en-us/entra/identity/app-provisioning/workday-integration-reference

Fabrice Bastian 60 Reputation points

2026-02-24T07:39:42.5666667+00:00

Hello Vemula,

Thank you again.
We will try to work on this with a provisioning group to trigger Workday transaction log to ensure we are able to catch the worker on the desired date.

Yours information were really helpful, thank you again.

Best regards

Fabrice
VEMULA SRISAI 9,265 Reputation points Microsoft External Staff Moderator

2026-02-24T14:48:27.94+00:00

Fabrice Bastian Thank you for Informing,If the resolution was helpful, kindly take a moment to click on and click on Yes for was this answer helpful. And, if you have any further query do let us know

Share via

Workday-Entra Provisioning - Pre-hire/hiring date not checked by the incremental sync

0 additional answers

Your answer