Every new joiner used to touch four teams before they could log in. HR sent a form, IT created the account, a manager approved licences, and someone walked to the store cupboard for a laptop. On a good week it took three days.
The 3-day problem
We mapped the process end to end and found eleven manual steps, six of which were pure data entry — copying the same name and job title from one system into another. None of it needed judgement.
If a step is the same every time and nobody has to decide anything, it belongs in a flow — not on a person's to-do list.
Starting from HR's form
The trigger is a Microsoft Form that HR already fills in. When it's submitted, Power Automate picks up the response and validates it: is the start date in the future, is the manager a real account, is the role one we have a licence template for?
- Bad data is bounced back to HR with a specific message, not a generic failure.
- Good data moves straight into provisioning with no human in the loop.
- Every run writes a row to a SharePoint list so we can audit what happened.
What the flow does
Once the response is valid, the flow creates the Entra ID account, adds it to the right groups, and assigns licences from a per-role template. Group membership drives everything downstream.
{
"role": "Store Associate",
"groups": ["All-Staff", "Retail-Users", "Intune-Auto-Enroll"],
"licenses": ["Microsoft 365 Business Premium"]
}
Results after 90 days
Median time from form submission to a working account dropped from 3 days to 12 minutes. IT logged 70% fewer onboarding tickets a month, and the audit list gave us a complete, timestamped record of who was granted what, and why.