A company wants to implement Microsoft Entra Lifecycle Workflows to automatically provision and deprovision access to Azure AI Foundry resources for new hires and terminated employees. Which Lifecycle Workflow trigger and task combination correctly automates this?

B is correct because Microsoft Entra ID Governance Lifecycle Workflows support two key workflow categories: 'Joiner' workflows (triggered when an employee is hired, pre-hire, or on their start date) and 'Leaver' workflows (triggered on termination). The Joiner workflow can include a task to add the new employee to the 'AI-Foundry-Access' group (which grants Azure AI Foundry access via RBAC or Entitlement Management). The Leaver workflow includes tasks to remove the user from all groups and disable the account, automatically revoking AI Foundry access. A is wrong because attribute change triggers and email notifications address different automation scenarios, not provisioning/deprovisioning. C is wrong because user risk elevation is an Entra ID Protection trigger, not a Lifecycle Workflow trigger for hire/termination events. D is wrong because sign-in frequency and session revocation are Conditional Access and Entra ID controls, not Lifecycle Workflow triggers.