From the deployment
Managed services provider — 4,500 users across 3 continents — 7 enterprise clients (pharma, publishing, education) — MS Graph + Power Platform
3 full-time staff managing employee lifecycle manually across all 7 clients. Offboarding ran as a 6pm rush — triggered by hand, frequently delayed, with access staying live hours after departure. Overtime. Compliance exposure. Every time.
Fully scheduled and automated across all 6 client environments. Offboarding triggers within minutes of the scheduled time. 1 person part-time handles genuine exceptions. No overtime. No missed steps.
3 full-time → 1 part-time. Compliance exposure from delayed offboarding eliminated across 4,500 users.
The problem was not technical. It was operational.
A managed services provider running infrastructure for clients across the US, Asia-Pacific, and Europe — pharma companies, publishers, education institutions — was managing the full employee lifecycle for a combined headcount of 4,500 users.
Every time a client hired someone, the MSP's tech team had to:
- Receive a ticket from the client's HR team
- Manually create the user account in Azure AD
- Allocate the appropriate Microsoft 365 license based on role
- Add the user to the correct Azure AD groups and Microsoft Teams channels
- Coordinate with the client's internal HR team for the onboarding process
- Notify the reporting officer
- Follow up across all these threads to confirm completion
And then do the entire reverse when someone left.
The tech team was not understaffed. The process was structurally broken. Every onboarding was a multi-ticket, multi-department coordination task that landed on Day 1 — when pressure to have everything ready was highest and the window to fix mistakes was smallest.
Offboarding was worse than onboarding. When an employee left, licenses weren't deallocated immediately. Deboarded users had live Microsoft 365 access for 24–48 hours after their last day. In regulated industries like pharma, that's not a process inefficiency — it's a compliance exposure.
HR teams were not relieved by any of this. They were the ones tracking whether every step had been completed, chasing ticket status across departments, and managing the experience of a new hire whose laptop wasn't ready or whose reporting officer hadn't been notified. Multiple tickets, multiple departments, manual follow-up — every single hire.
What we built: an MS Graph + Power Platform lifecycle automation
The solution has two parts: a scheduling interface and an automated execution layer.
Part 1 — scheduling via a low-code portal
Client HR teams now submit onboarding and offboarding requests through a low-code portal form — typically 7 to 14 days in advance of the effective date. The form captures employee details, role, department, reporting officer, user group (which determines license tier), and the start or exit date.
The ticket queue is gone. The MSP's tech team is not in the loop for routine cases.
Part 2 — automated execution on the scheduled date
The tech stack is Microsoft Graph API for identity and license operations, Power Automate for workflow orchestration, and a low-code portal built on Power Platform for the front-end form. No custom software. No new systems for clients to learn.
The deeper move was connecting disconnected systems — HR's intake form, Azure AD, M365 licensing, mailbox provisioning, and the audit log — into a single orchestrated flow. The portal is the visible surface; the orchestration layer underneath is what removes the manual coordination.
What changed: provisioning latency, license reclamation, audit trail
For the tech team: Routine onboarding and offboarding no longer occupies their day. Exceptions — edge cases, role changes mid-process, custom configurations — are the only things that require human attention.
For HR teams: They submit once, in advance, and receive a confirmation when it's done. The overhead of tracking whether the laptop was provisioned, whether the reporting officer was notified, whether the license was active — gone.
For new hires: Day 1 infrastructure is ready. Not later that week.
For compliance: License deallocation happens at the scheduled time. Orphaned accounts and open access windows after offboarding are no longer a risk. This matters most in the pharma segment, where the MSP's clients operate under regulatory environments where access control is an audit point.
What's next: replacing Power Automate with Python
The current implementation uses Power Automate for workflow orchestration. Phase 2, currently being scoped, replaces Power Automate with a Python-based automation framework — keeping the same MS Graph integrations, the same portal experience, and the same functional outcomes, but removing the per-user Power Automate licensing cost entirely.
For an MSP managing 4,500 users across multiple client environments, that licensing delta is significant. The same automation capability at lower per-client cost changes what the MSP can offer and at what margin as managed headcount grows. It also removes dependency on a licensed platform for a workflow that, once built, doesn't need it.
We'll publish a follow-up piece when Phase 2 is scoped and live.
A note on applicability
This was built for an MSP, but the underlying problem — manual, multi-department, Day 1-dependent onboarding with compliance exposure at offboarding — exists in most mid-market operations teams running on Microsoft infrastructure. The architecture is not MSP-specific. If your onboarding still runs on ticket queues, the same approach applies.