{
  "_program": {
    "version": "1.0.0",
    "owner": "security",
    "executionLimit": {
      "users": 40,
      "percent": 1
    },
    "customTaskNote": "the Launch and wait custom task is added by examples/lifecycle-extensions (Book 19, Chapter 05)"
  },
  "category": "leaver",
  "displayName": "JML-Leaver-LastDay-Employees",
  "description": "Leaver: block first (disable, revoke), then the custom task, then removals",
  "isEnabled": true,
  "isSchedulingEnabled": true,
  "executionConditions": {
    "@odata.type": "#microsoft.graph.identityGovernance.triggerAndScopeBasedConditions",
    "scope": {
      "@odata.type": "#microsoft.graph.identityGovernance.ruleBasedSubjectSet",
      "rule": "(employeeType eq 'Employee') and (onPremisesExtensionAttributes/extensionAttribute11 eq 'EMP')"
    },
    "trigger": {
      "@odata.type": "#microsoft.graph.identityGovernance.timeBasedAttributeTrigger",
      "timeBasedAttribute": "employeeLeaveDateTime",
      "offsetInDays": 0
    }
  },
  "tasks": [
    {
      "continueOnError": false,
      "description": "Disable user account",
      "displayName": "Disable user account",
      "isEnabled": true,
      "taskDefinitionId": "1dfdfcc7-52fa-4c2e-bf3a-e3919cc12950",
      "arguments": [
        {
          "name": "disableOnPremisesAccount",
          "value": "true"
        }
      ]
    },
    {
      "continueOnError": false,
      "description": "Revoke all refresh tokens for user",
      "displayName": "Revoke all refresh tokens for user",
      "isEnabled": true,
      "taskDefinitionId": "509589a4-0466-4471-829e-49c5e502bdee",
      "arguments": []
    },
    {
      "continueOnError": true,
      "description": "Remove all access package assignments for user",
      "displayName": "Remove all access package assignments for user",
      "isEnabled": true,
      "taskDefinitionId": "42ae2956-193d-4f39-be06-691b8ac4fa1d",
      "arguments": []
    }
  ]
}
