We have OneDrive access automated, but I want to cover mailbox access and tell managers when that access will expire. We're on Microsoft 365 E5 and would prefer something mostly hands off without scheduled PowerShell scripts.
Are Entra Lifecycle Workflows enough for this, or should we be looking at another tool?
Start with the process before picking the automation. Decide where the termination date and time come from, who gets mailbox and OneDrive access, when that access expires, and when the license comes off. Also decide who owns the auto-reply and what it should say.
Have a named owner for exceptions too. Legal holds, sensitive departures and managers asking for more time need a route that doesn't rely on the standard flow quietly guessing what to do. Once those rules are written down, it's much easier to see which parts a tool can actually automate.
Check licensing before building around Lifecycle Workflows. They require Microsoft Entra ID Governance or Entra Suite, which is separate from the Entra ID P2 entitlement included with E5.
Manager notifications are supported natively, but mailbox delegation is not a built-in lifecycle task. That would need a custom task extension connected to a Logic App or another process. So the workflow can be part of the solution without necessarily covering everything on its own.
x38!spool_274:
Good to know. I'll check the additional licensing and custom task requirements before assuming E5 covers the whole workflow.
Power Automate is worth a look if the goal is to stay close to the Microsoft tools you already have. Map out the trigger, manager notifications and expiry handling first, then check which actions and licenses each step needs.
If scripts aren't completely off the table, Power Automate can also coordinate PowerShell run through Azure Automation. That avoids a scheduled script as the main driver, though it does introduce code and another service to maintain.
!leave~room+for_notes:
Also check whether you have on-premises systems in the offboarding path. A cloud workflow may not cover those without additional integration.
For departing staff mail, another option is a shared notice mailbox with a generic departure response. The former employee's address can be moved to it as an alias. That handles future messages, but it doesn't replace a plan for access to the existing mailbox or its retention.
A third-party offboarding tool may be worth evaluating if you want a more hands-off workflow, especially if it can connect to your HR system as the source for departure dates. Check exactly which mailbox actions, notifications, exception handling and integrations it supports before comparing its cost with the native options.
Answers are reviewed before publication.
Velnick.7:
An exception queue is worth planning for from the start. A request to extend access needs an owner and a new expiry date, not just an open-ended approval.