New Microsoft Graph WorkingTimeSchedule: Automate User Working Hours in Entra ID

WHAT JUST CHANGED

Microsoft Graph has released the WorkingTimeSchedule and userSolutionRoot resources, with startWorkingTime and endWorkingTime methods. As of June 2024, these features are in Public Preview and available to tenants with Microsoft Entra ID and Microsoft Graph API access.

This rollout affects all cloud-only and hybrid tenants using Microsoft Graph for user management, scheduling, or automation workflows. Admins with delegated or application permissions to read/write user profiles will see expanded scheduling capabilities.

WHAT’S NEXT ON THE ROADMAP

• Workflow Automation: Upcoming Graph API enhancements will allow admins to trigger flows based on working hour boundaries (e.g., auto-disable access, schedule notifications, enforce Conditional Access).
• Integration with Microsoft Teams/Shifts: Microsoft continues to converge user working schedules with Teams and Outlook calendar, enabling richer policy controls for presence, guest scheduling, and access windows.
• Lifecycle Management: Expect preview features to support automatic onboarding/offboarding actions tied to WorkingTimeSchedule, improving guest and external user management.
• Conditional Access: Time-based CA policies are in preview, allowing enforcement on user activity windows set via WorkingTimeSchedule.

WHY THIS DIRECTION IS BETTER

• Centralized Scheduling: Previous methods required custom attributes or external HR systems. Now, working hours are native to Entra ID and accessible via Graph.
• Automation Ready: Schedules can trigger business rules, automate access, and integrate with Power Automate or Logic Apps.
• Consistency: Competing IdPs (e.g., Okta, Ping) often lack native working hour controls; Microsoft’s approach ensures parity across M365, Teams, and Entra workflows.
• Granular Control: Admins can set, audit, and enforce user-specific or group-wide schedules, supporting compliance and operational requirements.

ADJACENT ENTRA ID WORKFLOW CHANGES

• Conditional Access Updates: Preview features for time-based policies now integrate with WorkingTimeSchedule.
• Guest Lifecycle Management: External user expiration can now reference working hours for automated deactivation.
• Microsoft.Graph PowerShell Module: Recent module updates (v2.1+) bring support for new WorkingTimeSchedule cmdlets and improved error handling.
• Entra Admin Center UX: Admins can now view and edit working hours directly in user profile blades (Preview).

WHAT TO DO: Step-by-step Admin Actions

1. Update Microsoft.Graph Module: Ensure you’re running v2.1 or later.

   Update-Module -Name Microsoft.Graph -Force

2. Review WorkingTimeSchedule API Permissions: Grant appropriate delegated or application permissions (User.ReadWrite.All, WorkingTimeSchedule.ReadWrite.All).
3. Audit Existing Schedules: Use PowerShell to report users with or without WorkingTimeSchedule (see below).
4. Configure Working Hours: Set working schedules for key users/groups via Graph API or Admin Center.
5. Plan Conditional Access Policies: Draft time-bound CA rules leveraging working hours.

CHECK IT YOURSELF: Audit WorkingTimeSchedule with Microsoft.Graph PowerShell

This script reports users with or without a WorkingTimeSchedule, handling pagination and errors. No changes are made.

# Requires Microsoft.Graph v2.1+ and User.Read.All or WorkingTimeSchedule.Read.All permissions
Import-Module Microsoft.Graph.Users
Import-Module Microsoft.Graph.Beta.Users

$users = @()
$skipToken = $null
$maxPages = 10
$page = 1

try {
    do {
        $uri = "https://graph.microsoft.com/beta/users?$top=100"
        if ($skipToken) { $uri += "&$skiptoken=$skipToken" }
        $response = Invoke-MgGraphRequest -Uri $uri -Method GET
        $usersPage = $response.value
        $users += $usersPage
        $skipToken = $response.'@odata.nextLink' -replace '^.*skiptoken=(.*)$', '$1'
        $page++
    } while ($skipToken -and $page -le $maxPages)

    foreach ($user in $users) {
        $wtUri = "https://graph.microsoft.com/beta/users/$($user.id)/userSolutionRoot/workingTimeSchedule"
        try {
            $wt = Invoke-MgGraphRequest -Uri $wtUri -Method GET
            if ($wt) {
                Write-Output "User: $($user.displayName) ($($user.userPrincipalName)) -- WorkingTimeSchedule FOUND"
            } else {
                Write-Output "User: $($user.displayName) ($($user.userPrincipalName)) -- WorkingTimeSchedule NOT SET"
            }
        } catch {
            Write-Output "User: $($user.displayName) ($($user.userPrincipalName)) -- ERROR: $_"
        }
    }
} catch {
    Write-Error "Failed to enumerate users or schedules: $_"
}

PORTAL PATH: Where to Find This in Entra Admin Center

• Go to Entra Admin Center > Identity > Users.
• Select user > Profile > Working Hours (Preview).
• For bulk schedule management, use Microsoft Graph Explorer or PowerShell.

BOTTOM LINE

• Priority: Audit your tenant for working hour configuration and update Microsoft.Graph module.
• Action: Begin onboarding key users/groups to WorkingTimeSchedule for automated workflows and compliance.
• Plan: Prepare for upcoming CA and lifecycle management enhancements tied to working hours.
• Monitor: Stay alert for GA status and expanded API support by subscribing to Entra and Microsoft Graph roadmap updates.