---
title: Azure AD Identity Governance lifecycle workflow created
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Azure AD Identity Governance lifecycle
  workflow created
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Azure AD Identity Governance lifecycle workflow created
Classification:attackTactic:[TA0003-persistence](https://attack.mitre.org/tactics/TA0003)Technique:[T1098-account-manipulation](https://attack.mitre.org/techniques/T1098) 
## Goal{% #goal %}

Detects the creation of an Microsoft Entra Identity Governance lifecycle workflow.

## Strategy{% #strategy %}

This rule monitors Entra ID audit logs for the `@ocsf.metadata.event_code` `Create workflow` under the `WorkflowManagement` audit category. Lifecycle workflows in Entra ID Identity Governance automate identity lifecycle actions such as adding a user to a group, or enabling a user account. Because these workflows execute automatically and can be scoped to specific users or groups, they can establish a durable, low-touch persistence mechanism.

## Triage and response{% #triage-and-response %}

- Determine whether `{{@ocsf.actor.user.uid}}` has a legitimate business reason to create lifecycle workflows.
- Review the specific workflow configuration created by `{{@ocsf.actor.user.uid}}` in the Entra admin center, including its trigger conditions, scope (users or groups), and the tasks it executes.
- Examine whether the workflow's scope or tasks touch privileged groups, sensitive attributes, or credential issuance such as `TAP` generation.
- Check whether `{{@ocsf.actor.user.uid}}`'s account shows other signs of compromise, such as recent suspicious sign-ins, MFA changes, or new role assignments, prior to this activity.
- Identify any other actors who subsequently modify or reuse the workflow created by `{{@ocsf.actor.user.uid}}` to assess the scope of potential impact.
- Confirm with the workflow owner or their manager that the workflow was intentionally created and matches an approved identity governance process.