Generating temporary access pass(TAP) at 8 am BST on user's joining date and sending it to a specific email address - is it possible? using LCW and custom logic app

Question

Generating temporary access pass(TAP) at 8 am BST on user's joining date and sending it to a specific email address - is it possible? using LCW and custom logic app

VedaPraneetha Edala 5

I'm doing a Entra ID Gov POC, includes Workday-AD provisioning, JML, Access reviews. I also want to test generating TAP and sent to manager's email for my POC.
I will use the LCW to trigger on user's joining date and have a custom task created. (because I need to generate TAP only at 8am BST time - this is not something possible using the default/available Generate TAP task).

My custom task should check for the time, generate a TAP and send it to manager's mail address. But my managers are also test accounts and don't have a mailbox assigned yet(not planning to have one as of now for POC).
If I give my email address (or maybe a shared email address) just for the mail attribute for testing purpose, will this work? Any gotchas to keep in mind?

Also is it possible to do it that way? I generate a TAP first at the specific time, need to capture it, and send it to a specific email address - all via a custom task using logic app.

Possible ways I was thinking of:
-I'm looking to adding another mail in 'To' or 'cc' so that TAP can be captured and sent to me directly - if it allows, just for PoC testing.
-I will only add 'mail' attribute for these test users (no proxy, mailnickname, etc). I just want to demo the generated TAP being sent via email. Any concerns related to smtp, licenses, mailnickname, any other attirbutes? Once the user is synced to Entra (via cloud sync) will it cause any issue because two users have same email address and this article says when syncing to Entra it will automatically add proxy and other values from upn?

Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-06-09T09:18:54.41+00:00
Hello VedaPraneetha Edala,

Yes, this should be possible for a PoC.

A custom task in Lifecycle Workflows can invoke a Logic App.

The Logic App can generate a Temporary Access Pass (TAP) through Microsoft Graph, capture the returned value, and send it to a specified email address.

For testing, the manager account does not need an Exchange mailbox if the email is sent directly by the Logic App. Using your own mailbox or a shared mailbox should work.

One thing to consider is the use of the same email address across multiple synchronized accounts. If mail-related attributes such as proxyAddresses are populated during synchronization, duplicate values could cause attribute conflicts. Using a dedicated test mailbox for notifications may help avoid this.

For the 8:00 AM BST requirement, Lifecycle Workflows are event-driven and may not guarantee execution at an exact time. If precise timing is required, a scheduled Logic App may be a more reliable approach.
VedaPraneetha Edala 5 Reputation points

2026-06-09T19:27:02.3+00:00

Thanks for responding @Sridevi Machavarapu

I've been thinking about configuring everything via logic app with a recurrence of running everyday at 8am rather than a LCW with a custom task of logic app.

The reason being:

If I configure it via LCW which runs every 3 hours by default(or even changing it to run every hour), unsure if I'll be able to achieve the TAP generating at 8am logic.

My understanding employeehiredate and employeeleavedatetime attributes will include time as well.
I see the hiredate attribute from Source (Workday) is sending only the date YYYY-MM-DD.
If I try converting to AD acceptable format I see YYYY-MM-DD000000.0Z, does that mean it's 12:00 am time?
I will be syncing this value back to Entra (I will either convert it to AD acceptable values or just store it as a string on AD).

And either ways if Workday is not sending values so if I need to use LCW maybe I need to hardcode time in the attribute mapping expression on the provisioning connector or entra connect attribute mapping. I think it's anyway possible to amend date with 000000 or 080000 as start time and 235959 for leavedatetime?
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-06-10T16:33:40.89+00:00

Hello VedaPraneetha Edala,

Thanks for the additional details.

If your main requirement is to generate the TAP at exactly 8:00 AM BST, then a Logic App running on a daily schedule may be easier to manage than using Lifecycle Workflows for the timing aspect. The Logic App could run at 8:00 AM BST, identify users whose hire date matches the current date, generate the TAP, and send the notification.

Regarding the date values, if Workday is only providing YYYY-MM-DD, then the value contains a date but no time component. A value such as YYYY-MM-DDT00:00:00Z would represent midnight (00:00 UTC) for that date.

Based on that, Lifecycle Workflows would generally only have the date available unless a date/time value is explicitly populated during provisioning. I'm not aware of a supported method to append a specific time (for example, 08:00) to the hire date through Lifecycle Workflows itself, but this may be possible depending on the provisioning mapping capabilities available in your Workday or provisioning configuration.

For your scenario, it may be simpler to keep the hire date as a date-only attribute and handle the 8:00 AM BST requirement within the Logic App rather than modifying the source value. This would also avoid any dependency on how the date is formatted or synchronized into Entra ID.

The same approach could be applied to leave dates if you need actions to occur at a specific time.
VedaPraneetha Edala 5 Reputation points

2026-06-12T07:42:35.4366667+00:00

Hi @Sridevi Machavarapu

(FYI, I'm in BST timezone).

So I tried the logic for StatusHireDate. My workday sends only dates YYYY-MM-DD and after date formatting when I tested my flow using an on-demand provisioning, here's what I saw : YYYYMMDD00000.0Z as the value in my target attribute.

Please correct me if my understanding is wrong - both employeeHireDate and emploeeLeaveDateTime attributes are datetimeoffset type values and thus include time as well and not just date. I tried to explicitly give time as 070000.0Z in the expression and it works! I am seeing the same on AD as well (of course Entra shows 8:00 AM).

So, if l just make sure I have my Entra LCW running at least once (one scheduled cycle) between the 6-9am interval and making sure to include time in my hiredate around the same time - it should work.Seeing two possible implementation approaches here : either by running a logic app daily at 8am or a LCW considering all timing constrains are met.

Something else just did strike my mind - if I use a logic app to run everyday at 8am and check for users with hire date as today - there's a possibility that the flow could skip late joiners. Immediate joiners will be included but not the same case for late joiners.
and LCW have a the catch-up time is upto 3 days.

1 answer

Your answer

Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-06-09T09:18:54.41+00:00

Hello VedaPraneetha Edala,

Yes, this should be possible for a PoC.

A custom task in Lifecycle Workflows can invoke a Logic App.

The Logic App can generate a Temporary Access Pass (TAP) through Microsoft Graph, capture the returned value, and send it to a specified email address.

For testing, the manager account does not need an Exchange mailbox if the email is sent directly by the Logic App. Using your own mailbox or a shared mailbox should work.

One thing to consider is the use of the same email address across multiple synchronized accounts. If mail-related attributes such as proxyAddresses are populated during synchronization, duplicate values could cause attribute conflicts. Using a dedicated test mailbox for notifications may help avoid this.

For the 8:00 AM BST requirement, Lifecycle Workflows are event-driven and may not guarantee execution at an exact time. If precise timing is required, a scheduled Logic App may be a more reliable approach.
VedaPraneetha Edala 5 Reputation points

2026-06-09T19:27:02.3+00:00

Thanks for responding @Sridevi Machavarapu

I've been thinking about configuring everything via logic app with a recurrence of running everyday at 8am rather than a LCW with a custom task of logic app.

The reason being:

If I configure it via LCW which runs every 3 hours by default(or even changing it to run every hour), unsure if I'll be able to achieve the TAP generating at 8am logic.

My understanding employeehiredate and employeeleavedatetime attributes will include time as well.
I see the hiredate attribute from Source (Workday) is sending only the date YYYY-MM-DD.
If I try converting to AD acceptable format I see YYYY-MM-DD000000.0Z, does that mean it's 12:00 am time?
I will be syncing this value back to Entra (I will either convert it to AD acceptable values or just store it as a string on AD).

And either ways if Workday is not sending values so if I need to use LCW maybe I need to hardcode time in the attribute mapping expression on the provisioning connector or entra connect attribute mapping. I think it's anyway possible to amend date with 000000 or 080000 as start time and 235959 for leavedatetime?
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-06-10T16:33:40.89+00:00

Hello VedaPraneetha Edala,

Thanks for the additional details.

If your main requirement is to generate the TAP at exactly 8:00 AM BST, then a Logic App running on a daily schedule may be easier to manage than using Lifecycle Workflows for the timing aspect. The Logic App could run at 8:00 AM BST, identify users whose hire date matches the current date, generate the TAP, and send the notification.

Regarding the date values, if Workday is only providing YYYY-MM-DD, then the value contains a date but no time component. A value such as YYYY-MM-DDT00:00:00Z would represent midnight (00:00 UTC) for that date.

Based on that, Lifecycle Workflows would generally only have the date available unless a date/time value is explicitly populated during provisioning. I'm not aware of a supported method to append a specific time (for example, 08:00) to the hire date through Lifecycle Workflows itself, but this may be possible depending on the provisioning mapping capabilities available in your Workday or provisioning configuration.

For your scenario, it may be simpler to keep the hire date as a date-only attribute and handle the 8:00 AM BST requirement within the Logic App rather than modifying the source value. This would also avoid any dependency on how the date is formatted or synchronized into Entra ID.

The same approach could be applied to leave dates if you need actions to occur at a specific time.
VedaPraneetha Edala 5 Reputation points

2026-06-12T07:42:35.4366667+00:00

Hi @Sridevi Machavarapu

(FYI, I'm in BST timezone).

So I tried the logic for StatusHireDate. My workday sends only dates YYYY-MM-DD and after date formatting when I tested my flow using an on-demand provisioning, here's what I saw : YYYYMMDD00000.0Z as the value in my target attribute.

Please correct me if my understanding is wrong - both employeeHireDate and emploeeLeaveDateTime attributes are datetimeoffset type values and thus include time as well and not just date. I tried to explicitly give time as 070000.0Z in the expression and it works! I am seeing the same on AD as well (of course Entra shows 8:00 AM).

So, if l just make sure I have my Entra LCW running at least once (one scheduled cycle) between the 6-9am interval and making sure to include time in my hiredate around the same time - it should work.Seeing two possible implementation approaches here : either by running a logic app daily at 8am or a LCW considering all timing constrains are met.

Something else just did strike my mind - if I use a logic app to run everyday at 8am and check for users with hire date as today - there's a possibility that the flow could skip late joiners. Immediate joiners will be included but not the same case for late joiners.
and LCW have a the catch-up time is upto 3 days.

Answer 1

Lifecycle Workflows (LCW) can generate a Temporary Access Pass (TAP) and send it by email using the built‑in Generate Temporary Access Pass and send via email to user's manager task, or via Microsoft Graph using the same task definition.

From the built‑in task definition:

Category: joiner
Task: Generate Temporary Access Pass and send via email to user's manager
tapLifetimeInMinutes: TAP lifetime in minutes (10–43,200)
tapIsUsableOnce: one‑time or multi‑use
Email content can be customized and can include the dynamic attribute temporaryAccessPass so the TAP value is embedded in the email.
The TAP start time is based on the user’s employeeHireDate (if that date/time is in the past at execution, current time is used).

Prerequisites for this built‑in task:

The user must have a populated manager attribute.
The manager must have a populated mail attribute.
The TAP tenant policy must be enabled, and the selected activation duration and one‑time‑use settings must be within the policy range.
The target user must not have any other authentication methods, sign‑ins, or Microsoft Entra role assignments.

Regarding email delivery and attributes:

Email tasks in Lifecycle Workflows support different recipient options, including Manager mail attribute and User mail attribute, and can be customized under Basics and Email Customization.
Dynamic attributes available in customized email bodies/subjects include temporaryAccessPass, managerEmail, userDisplayName, userEmployeeHireDate, etc.
The platform only requires that the mail attribute be populated for the chosen recipient; it does not require that the manager have a full mailbox in the same sense as a production user. For PoC, setting the manager’s mail attribute to a test or shared address satisfies the built‑in task prerequisites.
Additional CC recipients are only available when the primary recipient is the user or the manager. Multiple CC recipients are copied on a single email.

For the PoC scenarios described:

Using a test manager account whose mail attribute is set to a shared or personal test email address is supported by the built‑in task, as long as the manager attribute and manager’s mail attribute are populated.
The TAP value can be included in the email using the temporaryAccessPass dynamic attribute in the customized email body/subject.
The documentation does not describe additional requirements such as proxyAddresses or mailNickname for these workflow email tasks; it only calls out the mail attribute for the manager and user.

For timing at exactly 08:00 BST and custom Logic Apps:

The provided documentation covers using Lifecycle Workflows and the built‑in TAP task, and using Microsoft Graph with the same task definition. It does not describe Logic App–based custom tasks or time‑of‑day scheduling beyond the use of employeeHireDate as the TAP start time.
It does state that the TAP lifetime starts at employeeHireDate (or current time if the hire date is already in the past), so precise 08:00 BST control would need to align the hire date/time and workflow execution with that behavior.

For onboarding PoC using Graph/LCW tutorial:

The tutorial shows configuring a workflow that:
1. Triggers based on employeeHireDate (for example, two days before hire date).
2. Uses the Generate Temporary Access Pass and send via email to user's manager task.
3. Requires mail and manager attributes on the employee, and mail on the manager.
4. Requires TAP policy enabled and the user enabled for TAP.

The documentation in context does not describe conflicts or errors arising from multiple users sharing the same mail value, nor automatic behavior around proxyAddresses or mailNickname in this scenario. It only specifies that the relevant mail attributes must be populated for the workflow tasks to run.

References: