Workspace User-Service Rule Reference

Workspace uses the internal service name WorkSpace. A user-service request contains the standard user-service properties and adds the Workspace items and roles being assigned or removed.

Rule locations

Use service-level extension points when the custom action concerns the user's Workspace service as a whole:

Event$User Service$WorkSpace$After Provision
Event$User Service$WorkSpace$After Deprovision

The full PreProvision, Provision, PostProvision, PreDeprovision, Deprovision, and PostDeprovision lifecycle is available, with Before, Main, and After rule sets.

Service-level properties

Alongside the standard customer, user, and service values, Workspace adds these entries to ServiceProperties:

Service property	Shape	Description
AddedItems	Hashtable	Workspace items being assigned, keyed by <ListId>-<ListItemId>-<ItemId>.
RemovedItems	Hashtable	Workspace items being removed, using the same key format.
AddedRoles	Hashtable	Roles being assigned, keyed by role ID. Added for multi-user provisioning.
RemovedRoles	Hashtable	Roles being removed, keyed by role ID. Added for multi-user provisioning.

The base rule value syntax can select a known entry, but these collections normally contain a variable number of items. For per-item work, use the Workspace item events described below instead of hard-coding a collection key.

Properties on each Workspace item

An entry in AddedItems or RemovedItems contains:

Group	Properties
List identity	ListId, ListItemId, ListName
Item identity	ItemId, ItemObjectId, ItemDisplayName, ItemDescription, SKU, Type
Item type	ItemTypeId, ItemTypeIconId, ItemTypeIconReference
Directory target	IDPType, IDPGroupType, DirResName, DirResNameUID, DirUserGroupName, DirUserGroupNameUID, UserIDPType, UserIDPGroupType
Presentation	IconId, IconReference
Behaviour	ProvisioningString, NumberOfUsers, IsEnabled, IsCreateGroupItem, IsSharedItem

Workspace configuration values are also copied onto the item hashtable. The exact names depend on the item's configuration schema, so inspect a request for the Workspace item you are customising.

Each role entry contains RoleId and Name.

Item rule events

Workspace expands the service request into per-item events. <IDPType> is the item's identity-provider type, such as ActiveDirectory or AzureAD:

Event$User Service$WorkSpace$Item$<IDPType>$After Provision
Event$User Service$WorkSpace$Item$<IDPType>$After Deprovision

In an item event, the item values are promoted to ordinary request properties. For example:

{ItemDisplayName}
{ProvisioningString}
{ListItemId}
{IDPType}
{DirUserGroupName}

The user identity remains available through values such as {UserID}, {Username}, {Userfullname}, {UserEmail}, and {UserExternalEmail}.

Use Workspace Automation for item customisation

If the action belongs to a Workspace item or item type—creating an application container, assigning a user in an external application, managing storage, or archiving item data—configure it through Workspace Automation.

Workspace Automation:

• attaches a managed script to an item or item type;
• supports customer provision/deprovision and user assign/unassign events;
• passes the request context to the script in $RequestProperties;
• automatically selects the applicable Active Directory or Azure tenant context for the item type.

Use Provisioning Manager service-level rules for orchestration that applies to the entire Workspace user service. Use Workspace Automation for item-specific behaviour so the automation follows the item's assignment and removal lifecycle.

Example decision

Requirement	Recommended location
Notify an external system whenever the Workspace service is enabled for a user	Event$User Service$WorkSpace$After Provision
Create a database login only when a particular application item is assigned	Workspace Automation user.assign event on that item
Archive data when that application item is removed	Workspace Automation user.unassign event on that item
Perform final cleanup after the entire Workspace service is removed	Event$User Service$WorkSpace$After Deprovision

Capture a journalled request for the actual item before relying on optional configuration keys.