LifecycleWorkflows-Workflow.Read.All

Allows the app to list and read all workflows and tasks on behalf of a signed-in user.

Merill's Note

For an app to access data in Microsoft Graph, the user or administrator must grant it the permissions it needs. This article lists all the Microsoft Graph APIs and your tenant data that can be accessed by the application (vendor/developer) if you consent to the LifecycleWorkflows-Workflow.Read.All permission.

If you need to create an audit report of the permissions granted to all the apps in your tenant, you can run the Export-MsIdAppConsentGrantReport command. See How To: Run a quick OAuth app audit of your tenant

Category	Application	Delegated
Identifier	03b0ad3e-fc2b-4ef1-b0ff-252e865cb608	7fabe5bd-2e47-4e61-b924-327117024e18
DisplayText	Read all workflows in Lifecycle workflows	Read all workflows in Lifecycle workflows
Description	Allows the app to list and read all workflows and tasks without a signed-in user.	Allows the app to list and read all workflows and tasks on behalf of a signed-in user.
AdminConsentRequired	Yes	Yes

Graph Methods

→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)

	Methods
	GET /identityGovernance/lifecycleWorkflows/deletedItems/workflows/
	GET /identityGovernance/lifecycleWorkflows/deletedItems/workflows/{workflowId}/
	GET /identityGovernance/lifecycleWorkflows/workflows
	GET /identityGovernance/lifecycleWorkflows/workflows/{workflowId}
	GET /identitygovernance/lifecycleWorkflows/workflows/{workflowId}/executionScope
	GET /identityGovernance/lifecycleWorkflows/workflows/{workflowId}/tasks
	GET /identityGovernance/lifecycleWorkflows/workflows/{workflowId}/tasks/{taskId}
	GET /identityGovernance/lifecycleWorkflows/workflows/{workflowId}/versions
	GET /identityGovernance/lifecycleWorkflows/workflows/{workflowId}/versions/{workflowVersion-versionNumber}
	GET /identityGovernance/lifecycleWorkflows/workflows/{workflowId}/versions/{workflowVersion-versionNumber}/tasks

→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)

	Methods
	GET /identityGovernance/lifecycleWorkflows/deletedItems/workflows/
	GET /identityGovernance/lifecycleWorkflows/deletedItems/workflows/{workflowId}/
	GET /identityGovernance/lifecycleWorkflows/workflows
	GET /identityGovernance/lifecycleWorkflows/workflows/{workflowId}
	GET /identitygovernance/lifecycleWorkflows/workflows/{workflowId}/executionScope
	GET /identityGovernance/lifecycleWorkflows/workflows/{workflowId}/tasks
	GET /identityGovernance/lifecycleWorkflows/workflows/{workflowId}/tasks/{taskId}
	GET /identityGovernance/lifecycleWorkflows/workflows/{workflowId}/versions
	GET /identityGovernance/lifecycleWorkflows/workflows/{workflowId}/versions/{workflowVersion-versionNumber}
	GET /identityGovernance/lifecycleWorkflows/workflows/{workflowId}/versions/{workFlowVersion-versionNumber}/tasks

→ Command supports delegated access (access on behalf of a user)
→ Command supports app-only access (access without a user)

	Commands
	Get-MgIdentityGovernanceLifecycleWorkflow
	Get-MgIdentityGovernanceLifecycleWorkflowDeletedItemWorkflow
	Get-MgIdentityGovernanceLifecycleWorkflowExecutionScope
	Get-MgIdentityGovernanceLifecycleWorkflowTask
	Get-MgIdentityGovernanceLifecycleWorkflowVersion
	Get-MgIdentityGovernanceLifecycleWorkflowVersionTask

→ Command supports delegated access (access on behalf of a user)
→ Command supports app-only access (access without a user)

	Commands
	Get-MgBetaIdentityGovernanceLifecycleWorkflow
	Get-MgBetaIdentityGovernanceLifecycleWorkflowDeletedItemWorkflow
	Get-MgBetaIdentityGovernanceLifecycleWorkflowExecutionScope
	Get-MgBetaIdentityGovernanceLifecycleWorkflowTask
	Get-MgBetaIdentityGovernanceLifecycleWorkflowVersion
	Get-MgBetaIdentityGovernanceLifecycleWorkflowVersionTask

Resources

Granting this permission allows the calling application to access (and/or update) the following information in your tenant.

Graph reference: deletedItemContainer

Property	Type	Description
id	String	The unique identifier of the workflow that was deleted. Inherited from entity.

Graph reference: identitygovernance-task

Property	Type	Description
arguments	microsoft.graph.keyValuePair collection	Arguments included within the task. For guidance to configure this property, see Configure the arguments for built-in Lifecycle Workflow tasks. Required.
category	microsoft.graph.identityGovernance.lifecycleTaskCategory	The category of the task. The possible values are: `joiner`, `leaver`, `unknownFutureValue`. This property is multi-valued and the same task can apply to both `joiner` and `leaver` categories. Supports `$filter`(`eq`, `ne`).
continueOnError	Boolean	A Boolean value that specifies whether, if this task fails, the workflow stops, and subsequent tasks aren't run. Optional.
description	String	A string that describes the purpose of the task for administrative use. Optional.
displayName	String	A unique string that identifies the task. Required. Supports `$filter`(`eq`, `ne`) and `orderBy`.
executionSequence	Int32	An integer that states in what order the task runs in a workflow. Supports `$orderby`.
id	String	Identifier used for individually addressing a specific task. Inherited from entity. Supports `$filter`(`eq`, `ne`) and `$orderby`.
isEnabled	Boolean	A Boolean value that denotes whether the task is set to run or not. Optional. Supports `$filter`(`eq`, `ne`) and `orderBy`.
taskDefinitionId	String	A unique template identifier for the task. For more information about the tasks that Lifecycle Workflows currently supports and their unique identifiers, see Configure the arguments for built-in Lifecycle Workflow tasks. Required. Supports `$filter`(`eq`, `ne`).

Graph reference: timeBasedAttributeTrigger

Property	Type	Description
offsetInDays	Int32	How many days before or after the time-based attribute specified the workflow should trigger. For example, if the attribute is `employeeHireDate` and offsetInDays is -1, then the workflow should trigger one day before the employee hire date. The value can range between -180 and 180 days.
timeBasedAttribute	microsoft.graph.identityGovernance.workflowTriggerTimeBasedAttribute	Determines which time-based identity property to reference. The possible values are: `employeeHireDate`, `employeeLeaveDateTime`, `createdDateTime`, `unknownFutureValue`.

Graph reference: triggerAndScopeBasedConditions

Property	Type	Description
scope	microsoft.graph.subjectSet	Defines who the workflow runs for.
trigger	microsoft.graph.identityGovernance.workflowExecutionTrigger	What triggers a workflow to run.

Graph reference: userProcessingResult

Property	Type	Description
completedDateTime	DateTimeOffset	The date time that the workflow execution for a user completed. Value is null if the workflow hasn't completed. Supports `$filter`(`lt`, `le`, `gt`, `ge`, `eq`, `ne`) and `$orderby`.
failedTasksCount	Int32	The number of tasks that failed in the workflow execution.
id	String	Identifier used for individually addressing a specific user processing result. Inherited from entity. Supports `$filter`(`eq`, `ne`) and `$orderby`.
processingStatus	microsoft.graph.identityGovernance.lifecycleWorkflowProcessingStatus	The workflow execution status. Supports `$filter`(`eq`, `ne`) and `$orderby`.
scheduledDateTime	DateTimeOffset	The date time that the workflow is scheduled to be executed for a user. Supports `$filter`(`lt`, `le`, `gt`, `ge`, `eq`, `ne`) and `$orderby`.
startedDateTime	DateTimeOffset	The date time that the workflow execution started. Value is `null` if the workflow execution hasn't started. Supports `$filter`(`lt`, `le`, `gt`, `ge`, `eq`, `ne`) and `$orderby`.
totalTasksCount	Int32	The total number of tasks that in the workflow execution.
totalUnprocessedTasksCount	Int32	The total number of unprocessed tasks for the workflow.
workflowExecutionType	microsoft.graph.identityGovernance.workflowExecutionType	Describes the execution type of the workflow. The possible values are: `scheduled`, `onDemand`, `unknownFutureValue`, `activatedWithScope`. Use the `Prefer: include-unknown-enum-members` request header to get the following values from this evolvable enum: `activatedWithScope`. Supports `$filter`(`lt`, `le`, `gt`, `ge`, `eq`, `ne`) and `$orderby`.
workflowVersion	Int32	The version of the workflow that was executed.

Graph reference: workflow

Property	Type	Description
category	microsoft.graph.identityGovernance.lifecycleWorkflowCategory	The category of the HR function supported by the workflows created using this template. A workflow can only belong to one category. The possible values are: `joiner`, `leaver`, `mover`, `unknownFutureValue`. Inherited from workflowBase. Required. Supports `$filter`(`eq`,`ne`) and `$orderby`
createdDateTime	DateTimeOffset	When the `workflow` was created. Inherited from workflowBase. Supports `$filter`(`lt`, `le`, `gt`, `ge`, `eq`, `ne`) and `$orderby`.
deletedDateTime	DateTimeOffset	When the workflow was deleted. Supports `$filter`(`lt`, `le`, `gt`, `ge`, `eq`, `ne`) and `$orderby`.
description	String	The description of the `workflow`. Inherited from workflowBase. Optional.
displayName	String	The display name of the `workflow`. Inherited from workflowBase. Required. Supports `$filter`(`eq`, `ne`) and `orderby`.
executionConditions	microsoft.graph.identityGovernance.workflowExecutionConditions	Conditions describing when to execute the workflow and the criteria to identify in-scope subject set. Inherited from workflowBase. Required.
id	String	Identifier used for individually addressing a specific workflow. Supports `$filter`(`eq`, `ne`) and `$orderby`.
isEnabled	Boolean	Whether the workflow is enabled or disabled. If this setting is `true`, the workflow can be run on demand or on schedule when isSchedulingEnabled is `true`. Inherited from workflowBase. Optional. Defaults to `true`. Supports `$filter`(`eq`, `ne`) and `orderBy`.
isSchedulingEnabled	Boolean	If `true`, the Lifecycle Workflow engine executes the workflow based on the schedule defined by tenant settings. Cannot be `true` for a disabled workflow (where isEnabled is `false`). Inherited from workflowBase. Optional. Defaults to `false`. Supports `$filter`(`eq`, `ne`) and `orderBy`.
lastModifiedDateTime	DateTimeOffset	The date time when the `workflow` was last modified. Inherited from workflowBase. Supports `$filter`(`lt`, `le`, `gt`, `ge`, `eq`, `ne`) and `$orderby`.
nextScheduleRunDateTime	DateTimeOffset	The date time when the `workflow` is expected to run next based on the schedule interval, if there are any users matching the execution conditions. Supports `$filter`(`lt`,`gt`) and `$orderby`.
quarantineDetails	microsoft.graph.identityGovernance.quarantineDetails	The current quarantine state of the workflow. Read-only.
settings	microsoft.graph.identityGovernance.workflowSetting	The settings of the workflow, including its quarantine configuration.
version	Int32	The current version number of the workflow. Value is 1 when the workflow is first created. Supports `$filter`(`lt`, `le`, `gt`, `ge`, `eq`, `ne`) and `$orderby`.

Graph reference: workflowVersion

Property	Type	Description
category	microsoft.graph.identityGovernance.lifecycleWorkflowCategory	The category of the HR function supported by the workflows created using this template. A workflow can only belong to one category. The possible values are: `joiner`, `leaver`, `mover`,`unknownFutureValue`. Inherited from workflowBase. Supports `$filter`(`eq`,`ne`) and `$orderby`
createdDateTime	DateTimeOffset	The date time when the `workflow` was versioned. Inherited from workflowBase. Supports `$filter`(`lt`, `le`, `gt`, `ge`, `eq`, `ne`) and `$orderby`.
description	String	The description of the `workflowversion`. Inherited from workflowBase.
displayName	String	The display name of the `workflowversion`. Inherited from workflowBase. Supports `$filter`(`eq`, `ne`) and `orderby`.
executionConditions	microsoft.graph.identityGovernance.workflowExecutionConditions	Conditions describing when to execute the workflow and the criteria to identify in-scope subject set. Inherited from workflowBase.
isEnabled	Boolean	Whether the workflow is enabled or disabled. If this setting is `true`, the workflow can be run on demand or on schedule when isSchedulingEnabled is `true`. Inherited from workflowBase. Supports `$filter`(`eq`, `ne`) and `orderBy`.
isSchedulingEnabled	Boolean	If `true`, the Lifecycle Workflow engine executes the workflow based on the schedule defined by tenant settings. Cannot be `true` for a disabled workflow (where isEnabled is `false`). Inherited from workflowBase. Supports `$filter`(`eq`, `ne`) and `orderBy`.
lastModifiedDateTime	DateTimeOffset	The date time when the `workflow` was last modified. Inherited from workflowBase. Supports `$filter`(`lt`, `le`, `gt`, `ge`, `eq`, `ne`) and `$orderby`.
settings	microsoft.graph.identityGovernance.workflowSetting	The settings of the workflow version, including its quarantine configuration.
versionNumber	Int32	The version of the workflow. Supports `$filter`(`lt`, `le`, `gt`, `ge`, `eq`, `ne`) and `$orderby`.

Table of Contents

LifecycleWorkflows-Workflow.Read.All

Graph Methods

Resources