Internal IT workflow automation consulting for onboarding, offboarding and everything in between
A new starter needs an account, a licence, the right groups, a laptop, a mailbox, access to three systems and a welcome email. Someone usually does all of it by hand, from a checklist that's slightly out of date. Automating that isn't glamorous, but it's where the hours go and where the mistakes happen.
/ Fit check
Best for
HR and IT teams with regular joiners and leavers on Microsoft 365 or Google Workspace
Not for
Processes that change every week and have no agreed owner
Deliverables
Process map, automated workflows, approval steps, audit logging and runbooks
/ Direct answer
What does internal IT workflow automation consulting cover?
Internal IT workflow automation consulting maps repetitive internal processes, such as onboarding, offboarding, role changes, access requests, device assignment and licence management, and replaces the manual steps with scripted, cloud-based workflows. Each workflow has a trigger, approval points, error handling and an audit trail, so the work is done the same way every time and you can prove it was done.
- Triggered from HR data, not emails
- Approvals where access goes beyond the role
- Every step logged with a timestamp
/ 01
What does an automated joiner, mover and leaver process look like?
It starts in the HR system, or a structured form if there isn't one. A new starter record triggers account creation, licence assignment, group membership by role, mailbox and Teams setup, device assignment and a welcome pack, with manager approval for anything beyond the role's standard access. A role change adjusts groups. A leaver record triggers offboarding on the right date.
Trigger
New record, role change or leaving date in HR, or a submitted form.
Standard access by role
Groups and licences come from the role, not from copying another user.
Approval for extras
Anything beyond the standard goes to the manager or system owner.
Device and welcome
A laptop is assigned and the new starter gets sign-in instructions for day one.
Log and confirm
Every step is logged, and IT is told only if something fails.
/ 02
What should an IT offboarding checklist include, and which steps can be automated?
Block sign-in and revoke active sessions straight away, remove MFA methods, group memberships and app access, convert the mailbox to shared or set forwarding as agreed, give the manager access to OneDrive, wipe or recover the device, remove licences, and log every step with a timestamp. Offboarding is where manual processes leak access, so it's usually the first workflow we automate.
In Google Workspace the equivalent first steps are suspending the user, signing them out of all sessions and resetting their sign-in cookies, then transferring Drive ownership to the manager with the data transfer tool.
$upn = "leaver@contoso.com"
Update-MgUser -UserId $upn -AccountEnabled:$false # block new sign-ins
Revoke-MgUserSignInSession -UserId $upn # invalidate existing sessionsIn production this runs unattended in Azure Automation under a managed identity with only the permissions it needs, not an admin's saved password.
/ 03
How do you automate onboarding in Google Workspace?
The same way as in Microsoft 365, with different tools. A new starter record triggers a script that creates the user through the Admin SDK, places them in the right organizational unit and groups, assigns the licence and shares the right shared drives. Apps Script or a small cloud function runs it, and groups carry most of the access, so a role change is one group move.
/ 04
Which tools do you use for internal automation?
Mostly what you already license. Power Automate and Logic Apps handle approval flows, PowerShell with Microsoft Graph handles identity and licence changes, and Azure Automation or Azure Functions run scripts on a schedule under a managed identity. Entra ID lifecycle workflows are an option where licensing covers them. For Google Workspace, Apps Script and the Admin SDK play the same roles.
/ 05
Where does HR fit into IT automation?
HR should be the source of truth for who works here, in what role, and from when. If HR data drives the workflow, IT stops re-typing details from emails, and start dates, role changes and leaving dates trigger the right actions on the right day. Where the HR system can't connect directly, a structured form is the fallback. A free-text email never is.
/ 06
How do you keep automated workflows safe?
With least-privilege service identities (managed identities rather than stored passwords), approval steps for anything beyond standard access, logs that go somewhere people actually look, alerts when a run fails, and a manual runbook for when the automation is down. A workflow that fails silently is worse than a paper checklist.
/ 07
How do you decide what to automate first?
We count. We look at which processes happen most often, take longest by hand, or cause the most damage when done wrong, and start with the one that scores highest across all three. For most businesses that's offboarding, then onboarding, then access requests.
Frequently Asked Questions
Sometimes. Standard connectors are covered by most Microsoft 365 plans, but premium connectors and some HR system integrations need extra licensing. We check this before designing anything, so the workflow fits what you already pay for where possible.
Then a structured form or a scheduled export becomes the trigger. It's less elegant, but it still removes most of the manual work and the re-typing errors.
Yes, combined with Windows Autopilot and Intune. The workflow assigns the device, and the laptop sets itself up when the new starter signs in.
You can own them using the runbooks we hand over, or we maintain them under a support agreement. Either way, every workflow is documented: what triggers it, what it changes, who approves, and how to do it by hand.
Mostly scripting and workflow tools, because onboarding needs to be exact, not creative. AI helps at the edges, like reading a free-text request and filling in the right form, but the actions themselves run on rules.
/ Next step
Want this reviewed against your own environment?
Share your users, tools and the problem you are trying to solve. We will tell you plainly whether this service fits, and what we would look at first.