HR-Driven Joiner-Mover-Leaver Automation with Entra ID

HR-driven means the HR system is the source of authority: a person exists in Entra ID because HR says they were hired, changes because HR says they moved, and stops because HR says they left. A user sync copies attributes between two systems and stops there — useful, cheap, and what our BambooHR and Ramp synchronization services do. This service adds the lifecycle: pre-hire account creation, a hire-date trigger that enables the account and issues a Temporary Access Pass, mover logic when department or manager changes, and a leaver sequence that disables, revokes, unlicenses and eventually deletes. The sync is one deliverable inside it; the workflows, the licence model and the device targeting are the rest.

Workday and SAP SuccessFactors through Microsoft's first-party gallery connectors — the fastest path, with attribute mappings Microsoft maintains. Everything else through API-driven inbound provisioning, where Microsoft accepts worker records in SCIM form from whatever reads your HR system: for BambooHR, UKG, ADP, Paylocity, Paycor, HiBob, Dayforce and similar we build an Azure Logic App or Power Automate flow against the vendor's API, or configure a partner bridge from Microsoft's partner-driven integration list — Aquera, for example, publishes bridges for UKG Pro and ADP Workforce Now — if you would rather license one than own a flow. If your HR system has no usable API, the assessment says so and we look at the export the vendor does offer before promising anything.

Two tiers. Microsoft Entra ID P1 — which Microsoft 365 Business Premium and the Microsoft 365 E3 and E5 suites include — covers HR-driven provisioning, dynamic groups and group-based licensing for the users those features touch. Lifecycle workflows are a Microsoft Entra ID Governance feature and need either the Governance licence (an add-on to P1 or P2) or Microsoft Entra Suite, which includes Governance. Microsoft's licensing terms require enough Governance or Suite licences to cover every user in scope of the workflows — the employees being joined, moved and left — not just the administrators. We count that population in the assessment and put the number in the design; you buy the licences at Microsoft's price through your licensing partner, or through us. We deliberately print no Entra prices on this page because Microsoft revises them.

Every user the workflows manage. That is the question most often asked on Microsoft's own Q&A forums, and Microsoft's answer is consistent: the Governance features are licensed per user in scope, and the tenant needs as many licences as there are users covered, whether or not each user has one assigned. It is the single biggest cost line in this design, which is why we surface it in week one. If that licence is not going to happen, the honest alternative is to keep the P1-only parts — provisioning, dynamic groups, group-based licensing — and run the leaver sequence as a request-and-approval flow in SharePoint, Teams and Power Automate instead of lifecycle workflows; that is our Secure Employee Offboarding Automation for Microsoft 365, and we will tell you which one fits before you spend anything.

Yes, with a design decision. If accounts are mastered in Active Directory, the cloud-side workflow tasks that write to the account — enable, disable, attribute updates, delete — cannot simply overwrite an object that Entra Connect or Cloud Sync owns. Microsoft's answer is HR-driven provisioning into Active Directory through the provisioning agent — the Workday and SuccessFactors connectors and the API-driven path all support it — with the sync carrying the result to Entra ID, and the cloud-side tasks limited to what the cloud owns: licences, groups, teams, tokens, notifications. The alternative is on-premises automation for the account tasks. We choose with you in the design, and it is one of the reasons the price is 'from'. If you are already planning to leave Active Directory, say so — the pipeline is simpler cloud-only, and we would rather build it once.

Nothing dramatic, which is the point. Days before, HR entered the hire and the provisioning service created a disabled account with the right UPN, department, manager, location and usage location. On the hire date the joiner workflow enables the account, generates a Temporary Access Pass and emails it to the manager with the welcome message, adds the groups and teams the design assigns to that department and role, and the licence arrives through the licence group. If the person picks up an Autopilot device, it lands in the right deployment profile and gets its apps and policies from the same groups. The manager hands over the pass, the employee registers their own authentication methods and Windows Hello, and IT has not opened a ticket.

HR enters the termination date, provisioning writes it to the account, and on that date the leaver workflow disables the account, revokes refresh tokens so open sessions die, removes every licence, removes the user from all groups and teams, and emails the manager. A second workflow deletes the account after the delay you chose — long enough for the manager to retrieve what they need, short enough to close the door. What happens to the mailbox and OneDrive — shared-mailbox conversion, a retention hold, a delegate — is a decision recorded in the design, because Microsoft's soft-delete window after deletion is finite and nobody should discover that afterwards.

Two mechanisms. Dynamic groups react on their own: when HR changes a department, the provisioning service updates the attribute, and the user drops out of the old department group and into the new one, taking the Intune policies, apps and licences those groups carry with them. The mover lifecycle workflow reacts to the attribute change as well — Microsoft's attribute-change trigger on department, manager or job title — and does what groups cannot: swap or remove specific licences, notify the new manager, and revoke refresh tokens where the move is a privilege change and you want sessions re-established under the new rules. A change of manager alone, without a department change, is a common special case and we handle it explicitly.

Because the HR side is not standard. A Workday or SuccessFactors gallery connector is a configuration exercise; an API-driven pipeline against a vendor's API is a small build with authentication, paging, error handling and a schedule; a partner bridge is somewhere in between. On top of that: additional workflows beyond the standard joiner, mover and two leaver workflows, custom task extensions, several HR systems or legal entities, and a hybrid Active Directory target. The assessment fixes those variables in week one and the quote is issued in writing before build — you pay after you approve delivery. A single cloud-only tenant with one HR system on a gallery connector and the standard workflows sits at the starting price.

Four weeks is the listed duration: design in week one, connection and workflows in weeks two and three, pilot and cutover in weeks three and four. The HR team's part is small but on the critical path — an integration user or API credentials, a few test workers for the pilot, and someone with the authority to say how conventions and retention should work. Where the assessment finds bad data — duplicate employee IDs, missing managers, unmaintained end dates — HR's cleanup runs alongside our build, and a population goes live when its data is ready rather than on a date. Waiting for a licence purchase or an HR vendor to enable an API adds calendar time, not cost.

Whatever HR masters, the pipeline can manage; whatever HR does not, it cannot. Most HR systems carry employees and often interns, some carry contingent workers, few carry every contractor. The design lists each worker type, who is the source for it, and whether it is in scope. Rehires are handled explicitly: matching on employee ID finds the old account if it still exists, and the joiner path for a returning account differs from a fresh one — Microsoft's Temporary Access Pass task, for instance, only works for accounts with no existing authentication methods. The reconciliation report keeps anyone outside the pipeline visible so they do not become the next stale account.

No — it feeds them. If Intune and Windows Autopilot deployment profiles already exist, we build the dynamic groups from HR attributes that carry your configuration, compliance and app assignments, and wire Autopilot device targeting to the same model: a ZTDId or group-tag dynamic group for classic Autopilot, or the assigned device group Autopilot device preparation requires. If Intune is not set up yet, that is our Intune and Autopilot setup services first, and this service afterwards.

Then the first thing you get is a precise list of how bad, which is worth having on its own. The matching dry run in week one shows every user with no HR record, every HR record with no user, every duplicate employee ID and every missing manager or location. HR fixes what only HR can fix, and populations go live as their data becomes clean. The pipeline itself never guesses: a record that fails validation stops in quarantine with an alert, and nothing is created or deleted on a hunch. The service that fixes HR data is not this one — it is HR's process, and we tell them exactly where to look.

Once the identity is HR-driven, pushing it onward is the easier half: Entra ID's outbound provisioning to SCIM-capable applications, or group-based assignment to the apps you already federate, both hang off the groups this service creates. Outbound provisioning is quoted per application on top of this service, because each vendor's SCIM implementation has its own habits. If a specific application is the reason you are doing this, tell us in the scoping call and we price it together.

Your admins, from the runbook — it is written for the person who was not on the project: how a record travels, where the logs are, how to rerun a failure, add a task, onboard a department, handle a rehire, and what to do when HR gets it wrong. Organizations that buy their Microsoft licensing through IT Partner get unlimited break-fix support during business hours for the delivered configuration as part of that relationship. If you would rather someone else kept the directory clean month to month — stale accounts, access-review campaigns, privileged-role checks — that is our managed identity-hygiene service, and it starts where this one ends. There is no lock-in either way: everything is built in your tenant with Microsoft's tools, and you can stop using our services at any time.