Edit

Reference for extending Microsoft Entra attribute mappings with custom call-outs using LCW extensibility workflows (preview)

When you configure provisioning, one of the types of attribute mappings that you can specify is the Lifecycle Workflows (LCW) extensibility workflow mapping type. This mapping type allows you to extend attribute mappings beyond the basic transformations that are supported by the expression mapping type, enabling you to fulfill scenarios where custom business logic may be required.

To configure the LCW extensibility workflow mapping type, you will need to create an LCW extensibility workflow that invokes an Azure Logic App to generate a value. The value generated by the Azure Logic App is then applied to a target attribute.

Prerequisites

You will need to create an Azure Logic App. For that, you should have:

You will need to create an LCW extensibility workflow to trigger the Azure Logic App. For that, you should have:

To configure a provisioning job, including attribute mappings, you will need:

LCW extensibility workflow overview

An LCW extensibility workflow is a new type of Lifecycle Workflow that is distinct from the existing Joiner, Mover, and Leaver types.

Much like Joiner, Mover, and Leaver workflows, you will specify a task for the workflow to run. In this case, the task will be to trigger a custom extension. You can think of a custom extension as a wrapper for the Azure Logic App that houses your custom logic—when the custom extension is triggered by the extensibility workflow, the Azure Logic App will run.

Unlike Joiner, Mover, and Leaver workflows, however, extensibility workflows can run before a user is provisioned. In other words, an extensibility workflow can run independent of whether a given user account is present in the Entra ID directory.

This makes extensibility workflows useful in pre-provisioning (also referred to as pre-joiner) scenarios. For example, you can use an extensibility workflow to generate a unique alias for a newly hired employee before provisioning their account to the directory and subsequently giving them access to company resources.

Note

Currently, an LCW extensibility workflow only supports one trigger type (Provisioning attribute mapping) and one task (Run a Data-driven Custom Task Extension).

Step 0: Create an Azure Logic App

You will need to create a consumption-based Azure Logic App that outputs a single value that will be applied to a target attribute.

If you are new to Azure Logic Apps, you may read more here. Additionally, you can find instructions on how to create your first consumption-based Azure Logic App in this tutorial.

Step 1: Create a custom extension

Before creating an extensibility workflow, you need a custom extension that you can link to your extensibility workflow. As mentioned previously, you can think of the custom extension as a wrapper for the Azure Logic App where your custom logic resides. When the extensibility workflow triggers the custom extension, the Azure Logic App will run.

In the Microsoft Entra admin center

  1. Using your browser, sign in to your Entra ID tenant via the Microsoft Entra admin center.

  2. Navigate to Lifecycle workflows > Custom extensions > Add a custom extension.

    Screenshot of the custom extension blade in the Microsoft Entra portal and where to find the 'Add a custom extension' button.

  3. Under the Basics tab of the create wizard, add a name and description for your custom extension.

  4. Under the Task behavior tab, select Launch wait for result (Preview).

  5. Under the Details tab, you can link the custom extension to an Azure Logic App. Assuming you already have one created, select No for Create a logic app, then input the subscription, resource group, and Logic app details for Azure Logic App.

    Screenshot of the details pane of the custom extension create wizard, where customers link an Azure Logic app.

  6. Review the details of your custom extension in the Review + create tab, and click Create to finish.

You now have a custom extension that is ready to link to an extensibility workflow as a task. Now let’s work on creating an extensibility workflow.

Using Microsoft Graph

  1. Start the Microsoft Graph Explorer tool.
  2. Sign in to your tenant.
  3. Select Modify permissions.
  4. Consent to the following required permissions: LifecycleWorkflows-CustomExt.ReadWrite.All
  5. Use the Create customTaskExtensions API to create a custom extension.

Example request

POST /identityGovernance/lifecycleWorkflows/customTaskExtensions
Content-Type: application/json

{
	"displayName": "test1",
	"description": "test1",
	"endpointConfiguration": {
		"@odata.type": "#microsoft.graph.logicAppTriggerEndpointConfiguration",
		"subscriptionId": "00000000-0000-0000-0000-000000000000",
		"resourceGroupName": "lcw-synthetics",
		"logicAppWorkflowName": "masonReply"
	},
	"callbackConfiguration": null,
	"authenticationConfiguration": {
		"@odata.type": "#microsoft.graph.azureAdPopTokenAuthentication"
	},
	"id": "",
	"clientConfiguration": {
		"timeoutInMilliseconds": 1000,
		"maximumRetries": 1
	},
	"replyMode": "response"
}

Example response

HTTP/1.1 201 Created
Content-Type: application/json

{
  "@odata.context": "https://graph.microsoft.com/beta/$metadata#identityGovernance/lifecycleWorkflows/customTaskExtensions/$entity",
  "id": "902ca666-6b67-4d45-839c-8836d7f205f9",
  "displayName": "test1",
  "description": "test1",
  "createdDateTime": "2026-04-20T19:56:27.0723563Z",
  "lastModifiedDateTime": "2026-04-20T19:56:27.0723657Z",
  "replyMode": "response",
  "callbackConfiguration": null,
  "endpointConfiguration": {
		"@odata.type": "#microsoft.graph.logicAppTriggerEndpointConfiguration",
		"subscriptionId": "00000000-0000-0000-0000-000000000000",
		"resourceGroupName": "lcw-synthetics",
		"logicAppWorkflowName": "masonReply",
		"url": "https://prod-05.southcentralus.logic.azure.com:443/workflows/c070dc95455e4e5a98da954feeb7e756/triggers/manual/paths/invoke?api-version=2016-10-01"
  },
	"authenticationConfiguration": {
		"@odata.type": "#microsoft.graph.azureAdPopTokenAuthentication"
	},
	"clientConfiguration": {
		"maximumRetries": 1,
		"timeoutInMilliseconds": 1000
	}
}

You now have a custom extension that is ready to link to an extensibility workflow as a task. Now let’s work on creating an extensibility workflow.

Step 2: Create an extensibility workflow

Once you’ve created a custom extension, you can now create an extensibility workflow whose task is to trigger the custom extension.

In the Microsoft Entra admin center

  1. Using your browser, sign in to your Entra ID tenant via the Microsoft Entra admin center.

  2. Navigate to Identity Governance > Lifecycle Workflows > Create workflow.

  3. In the Choose a template tab, select the Real-time Provisioning extensibility template.

    Screenshot of the catalog of templates in the Lifecycle Workflow create wizard, one of which is a template for an extensibility workflow.

  4. In the Basics tab, input a name and description for the workflow. The trigger type will be automatically set to Provisioning attribute mapping, which is the only trigger type that we currently support for extensibility workflows.

  5. Now let’s configure your extensibility workflow so that it triggers a custom extension. In the Review tasks tab, click on the Run a Data-driven Custom Task Extension task, which should have been automatically added to the workflow tasks table as part of the real-time provisioning extensibility template.

    Screenshot of the 'Review tasks' pane in the Lifecycle Workflow create wizard, where the extensibility workflow template lists the 'Run a Data-driven Custom Task Extension' task.

  6. In the Run a Data-driven Custom Task Extension context pane, click on the Select custom extension field and select the custom extension you created in the previous section.

  7. Click Save.

  8. Review the details of your workflow in the Review + create tab, and click Create to finish.

You now have an extensibility workflow that can trigger an Azure Logic App that contains your custom logic. Now let’s work on mapping the extensibility workflow to a target attribute.

Using Microsoft Graph

  1. Start the Microsoft Graph Explorer tool.
  2. Sign in to your tenant.
  3. Select Modify permissions.
  4. Consent to the following required permissions: LifecycleWorkflows-Workflow.ReadWrite.All
  5. Use the Create workflow API to create an LCW extensibility workflow.

Example request

POST /identityGovernance/lifecycleWorkflows/workflows
Content-Type: application/json

{
	"category": "extensibility",
	"displayName": "Real-time Provisioning extensibility (Preview)",
	"description": "Execute real-time extensibility tasks for performing attribute mapping extensions",
	"tasks": [
		{
      "arguments": [
        {
          "name": "customTaskExtensionID",
					"value": "f740553f-a6a2-4dc8-82df-148336dcd920"
				}
			],
			"description": "Run a Custom Task Extension and pass data from the workflow as input",
			"displayName": "Run a Data driven Custom Task Extension (Preview)",
			"isEnabled": true,
			"id": "77bb973f-3150-4a0f-b49b-24d1baa677f6",
			"continueOnError": false,
			"taskDefinitionId": "09303719-609e-4348-8bbc-d3ee45a2657e",
			"category": "extensibility"
		}
	],
	"executionConditions": {
		"@odata.type": "#microsoft.graph.identityGovernance.provisioningAttributeMapping"
 	},
	"isEnabled": true,
	"isSchedulingEnabled": false,
	"targetSubjectType": "provisioningObject"
}

Example response

HTTP/1.1 201 Created
Content-Type: application/json

{
	"@odata.context": "https://graph.microsoft.com/beta/$metadata#identityGovernance/lifecycleWorkflows/workflows/$entity",
	"category": "extensibility",
	"description": "Execute real-time extensibility tasks for performing attribute mapping extensions",
	"displayName": "Real-time Provisioning extensibility (Preview)",
	"isEnabled": true,
	"isSchedulingEnabled": false,
	"lastModifiedDateTime": "2026-04-20T19:58:42.4447369Z",
	"targetSubjectType": "provisioningObject",
	"createdDateTime": "2026-04-20T19:58:42.444727Z",
	"deletedDateTime": null,
	"id": "e41388b5-446e-4cf1-9bce-92cd09f828e5",
	"nextScheduleRunDateTime": null,
	"version": 1,
	"executionConditions": {
		"@odata.type": "#microsoft.graph.identityGovernance.provisioningAttributeMapping"
	},
	"quarantineDetails": {
		"quarantinedDateTime": null,
		"quarantineType": "notQuarantined",
		"quarantineReason": null
	},
	"settings": {
		"quarantineConfiguration": {
			"matchMode": "any",
			"conditions": []
		}
	}
}

You now have an extensibility workflow that can trigger an Azure Logic App that contains your custom logic. Now let’s work on mapping the extensibility workflow to a target attribute.

Step 3: Mapping an extensibility workflow to a target attribute

Now that you’ve created an extensibility workflow, it’s time to map it to an attribute in a provisioning job. This is so that when a provisioning job is in-progress, the extensibility workflow will generate a value for that attribute for every object in the scope of the provisioning job.

For example, if you map an extensibility workflow to the userPrincipalName target attribute and there are five users in scope of your provisioning job, the workflow will generate a value for the userPrincipalName attribute for all five users.

In the Microsoft Entra admin center

  1. Using your browser, sign in to your Entra ID tenant via the Microsoft Entra admin center.

  2. Navigate to Enterprise apps > All applications.

    Screenshot of the enterprise apps blade in the Microsoft Entra portal.

  3. Select a specific application (e.g. an HR connector like SuccessFactors or Workday, or a SaaS application).

  4. Within the application, navigate to Provisioning > Attribute mapping.

  5. Within the attribute mapping list, find the target attribute that you would like to invoke custom logic for. Select the edit icon (the pencil symbol) for that attribute.

    Screenshot of the 'Attribute mapping' blade and where to find the pencil icon, which is the entry point to the 'Edit attribute mapping' blade.

  6. In the Edit Attribute Mapping blade, select LCW extensibility workflow in the Mapping type dropdown.

  7. Click on the LCW extensibility workflow field to open the extensibility workflow picker.

  8. In the Select extensibility workflow context pane, select the appropriate extensibility workflow from the list and press Select.

  9. For the Input attributes field, specify what source system attributes you will pass into the extensibility workflow and an alias for the attribute (aliases can be especially helpful for scenarios where the source attribute names are long or non-human-readable and may need a friendly name).

  10. Select the Edit button at the bottom of the Edit Attribute Mapping blade.

If the extensibility workflow was successfully mapped to the target attribute, the Attribute mapping page will update so that the Mapping Type column shows “LCW extensibility workflow” for that given attribute.

Once you’re done configuring the settings of your provisioning job, you can now start a provisioning job as normal. The LCW extensibility workflow wil now run for all objects in scope.

Using Microsoft Graph

  1. Using your browser, sign in to your Entra ID tenant via the Microsoft Entra admin center.

  2. Navigate to Enterprise apps > All applications.

  3. Select the application that you would like to modify the attribute mappings for.

  4. Navigate to Provisioning > Attribute mapping and select Advanced options > Edit schema.

    Important

    Before you make any changes, we recommend that you save a copy of your existing schema. This allows you to easily revert to a stable/unmodified version of your schema.

  5. Search for the target attribute that you wish to edit so that it maps to the LCW extensibility workflow. These are the fields that you will need to modify for that attribute:

    Name of field Description
    flowType Must be ObjectAddOnly, since LCW extensibility workflows can only be run during create events
    matchingPriority Must be 0, since target attributes that are mapped to an LCW extensibility workflow cannot be used as matching attributes
    expression This will be the GUID of the LCW extensibility workflow
    name Same as expression; this will be GUID of the LCW extensibility workflow
    type Must be LifecycleWorkflow
    parameters Here, you will configure the source attributes that you would like to pass as inputs into the Azure Logic App. key is the alias for a given input (this allows developers to use a friendly name with referencing an input in the Azure Logic App, which is helpful for situations where a source attribute may be long or complicated). expression and name will be a source attribute.

    Example of a new attribute mapping that uses LCW extensibility workflows

    In the example below, we are updating the userPrincipalName target attribute.

    {
	"defaultValue": null,
	"exportMissingReferences": false,
	"flowBehavior": "FlowWhenChanged",
	"flowType": "ObjectAddOnly",
	"matchingPriority": 0,
	"targetAttributeName": "userPrincipalName",
	"source": {
		"expression": "2b19441a-9ff0-449d-ba74-3e4226eff132",
		"name": "2b19441a-9ff0-449d-ba74-3e4226eff132",
		"type": "LifecycleWorkflow",
		"parameters": [
			{
				"key": "firstname",
				"value": {
					"expression": "[name.givenName]",
					"name": "name.givenName",
					"type": "Attribute",
					"parameters": []
				}
			},
			{
				"key": "lastname",
				"value": {
					"expression": "[name.familyName]",
					"name": "name.familyName",
					"type": "Attribute",
					"parameters": []
				}
			}
		]
	}
}

  6. Save the entire edited schema object, not just the part you edited (consider doing so in a separate file). You will need to provide the entire schema object in the request body of the Microsoft Graph Explorer tool later.

  7. Start the Microsoft Graph Explorer tool.

  8. Sign in to your tenant.

  9. Select Modify permissions.

  10. Consent to the following required permissions: Synchronization.ReadWrite.All

  11. Copy/paste the edited schema object into the Request body section of the Microsoft Graph Explorer tool, and use the Update synchronizationSchema API to update the attribute mappings for a given provisioning job.

Example request

PUT /servicePrincipals/{id}/synchronization/jobs/{jobId}/schema
Content-Type: application/json

// In your request body, paste the entire schema object

Example response

HTTP/1.1 204 No Content

Once you’re done configuring the settings of your provisioning job, you can now start a provisioning job as normal. The LCW extensibility workflow wil now run for all objects in scope.

Limitations

Please note the following feature limitations:

  • Custom call-outs are not supported for Cloud sync. LCW extensibility workflows can only be used for HR inbound, API-driven provisioning, SaaS outbound provisioning, and cross-tenant synchronization flows.
  • An attribute with the LCW extensibility workflow mapping type cannot be used for matching. If an attribute's value was generated using an LCW extensibility workflow, it cannot be used as a matching attribute.
  • Custom call-outs are only supported for create events. The LCW extensibility workflow mapping can only be applied during creates, not updates or deletes.
  • Custom security attributes (CSAs). We do not explicitly support the use of LCW extensibility workflows for generating values for CSAs. If you decide to do so, please proceed with caution.
  • Last updated on