Automating Employee Onboarding in Microsoft 365

Monday, 9 a.m. The new sales rep is standing in reception. No account, no laptop, no access to the team's Teams channel, and the manager is in a meeting. IT learns about the arrival that very morning because HR sent the email on Friday evening. The new hire will spend the first day waiting, and the first impression is already made.

Every arrival repeats the same list of twenty actions across six tools. That is exactly the kind of task that automates well: repetitive, predictable, and costly when done late. Here is how to make everything start from one form, what IT keeps in its own hands, and why the departure matters as much as the arrival.

Automate employee onboarding: one HR form triggers everything

The entry point is a form filled in by HR or the manager: first name, last name, start date, job title, department, manager, site, requested equipment, and above all an access profile. The answer is saved to a "New starters" list (SharePoint) or a Dataverse table, and the Power Automate flow starts ten working days before the start date.

The access profile is what makes automation possible. For each standard role, sales rep, accountant, technician, project manager, a table says which groups, which Teams, which licences, which SharePoint sites and which equipment. Nobody decides case by case, and an access audit becomes a matter of reading a table.

Account, licences, Teams and SharePoint sites

• The account. The flow creates the user in Microsoft Entra ID with the dedicated connector (a Premium connector: see Microsoft's pricing page for the current rate), or prepares a request that IT approves with one click. The address follows your naming rule; the temporary password is handed over in person on day one.
• Licences. Nobody assigns a licence by hand. Use group-based licensing: adding the employee to the "Microsoft 365 standard licence" group grants the licence. The flow adds them to the group, nothing more. Group-based licensing needs an edition that includes it, such as Business Premium or any plan with Microsoft Entra ID P1; check with your IT team.
• Teams and SharePoint. The flow adds the person to the Teams of their profile and to the security groups that open the SharePoint sites. It puts them on the department's distribution list and, if needed, gives access to the shared mailbox.
• Equipment. A Planner task goes to IT: "prepare a laptop for Camille, starting on the 3rd", with the details. If stock is empty, a purchase request is created in the usual approval process.

Then the welcome journey. The day before the start, a message to the manager with the first-week programme to prepare. On day one, a welcome email with the "Your first days" SharePoint page and the tasks to complete: sign the IT policy, take the security training, meet three key people. Then reminders to the manager: a fifteen-minute check-in the next day, a thirty-day review, the end of the probation period.

IT's role: keep control without doing it all by hand

Creating an account and granting access are sensitive actions. The flow must not have unlimited power. Two ways to do it, depending on your size. The first: the flow prepares everything and waits for IT approval in Teams; after the click, it executes. The second: the flow executes under a service account with strictly limited rights, and every action is logged.

In both cases, nothing runs under an employee's personal account. If that person leaves, the flow leaves with them. And each action is written back to the starter's row: account created, licence assigned, team added, laptop prepared. The manager and HR see the progress without asking.

The departure, in mirror image: the offboarding checklist

Arrivals get noticed; departures are where it costs you. A former employee who keeps access for three months is a more common risk than people think. Offboarding follows the same profile table, in reverse, triggered by a leaving date and a precise time.

In order: block sign-in and revoke sessions, convert the mailbox to a shared mailbox delegated to the manager to keep the emails, transfer the OneDrive, remove the groups and therefore the licences, remove access to third-party applications from a list kept up to date, change the passwords of shared accounts, and create a Planner task for returning the equipment. All of it logged, just like the arrival.

If you want to estimate what this represents for you, count last year's arrivals and departures and multiply by the time spent. Then bring that number: a two to three day scoping fixes the profiles and the scope, and the build follows our method, for a fixed fee known as soon as scoping ends. For a first conversation, thirty minutes is enough.