A growing organization with no standardized provisioning process. New hires were receiving inconsistent access, missing licenses, and unmanaged devices on day one. Offboarding was even worse — manual, checklist-driven, and frequently incomplete, leaving residual access in place days after departures.
Replace ad-hoc provisioning with a role-based, auditable workflow that completes in minutes and leaves a full paper trail.
- Role-to-license mapping — defined RBAC matrix mapping job roles to M365 license tiers, Entra ID group membership, and Intune compliance profiles
- Intake via Slack/Jira — HR submits a structured form; automation triggers immediately on submission without IT intervention
- PowerShell automation — creates the user, assigns licenses, applies Intune baseline profiles, configures mailbox and archive policies, and logs every action with timestamps
- Offboarding revocation — account disable, license reclaim, device wipe trigger, and access revocation checklist run in sequence with evidence captured at each step
- Audit trail — every provisioning and deprovisioning action logged with who/what/when for access review and compliance purposes
- Provisioning time reduced from hours to under 5 minutes
- Consistent security baseline applied on first login for every new device
- Complete, timestamped audit trail for every access change — no more gaps during audits
- Offboarding residual access reduced to near zero
- Scripts:
../hr-onboarding-automation/scripts/ - Templates: RBAC matrix, access review checklist, offboarding revocation checklist
- Docs:
./docs/— workflow diagram + screenshots
- Add Entra ID PIM elevation for privileged role assignments
- Scheduled periodic access review job to flag stale permissions automatically
- Manager approval gate for sensitive role assignments before provisioning completes