This guide explains how to leverage Microsoft automation tools to establish a streamlined new hire on boarding process which is part of Identity Lifecycle Management (ILM). An on boarding process is always a stable in any company. For this particular lab setup – our requirements for onboard is as followed:
- Hybrid environment (must be able to create users in AD first)
- Once user is created, synced to Entra environment.
- Add user to group membership (AD+Entra).
- Any failure during provision steps requires notification of email to IT.
Before diving into the integration steps, let’s review the specific Microsoft tools available for this purpose. Every tool serves a specific purpose for what we are trying to do.
Microsoft Power Platform branch:
| Tool | Core Function | Onboarding Application Example |
| Power Apps | Low-code custom business apps | Employee onboarding interface, IT ticketing app |
| Power Automate | Workflow & task automation | Syncing user data, automated file alerts, leave approvals |
| Power BI | Dashboards & data visualizations | IT compliance reports, new hire training progress tracking |
| Power Virtual Agents | Internal & external chatbots | IT/HR helpdesk chatbot, lab safety FAQ bot |
| Microsoft Dataverse | Secure data storage layer | Centralized repository for all app and workflow data |
Azure automation branch:
Azure Automation Runbooks (Scripted infrastructure automation)
Runbooks are scripts (PowerShell or Python) used to automate administration and infrastructure tasks. Often used by IT admins, this script-based automation can run on hybrid workers (cloud or on-premises).
- Think: Infrastructure automation using scripts.
- Best For: Azure resource automation, scheduled IT tasks, patch management, and account maintenance.
- Example: Runbook can be run against arc enabled servers to manage Active directory in hybrid environment.
Azure Functions (Serverless code execution)
Azure Functions allow you to execute small, event-driven pieces of code without managing servers. This is a code-first (C#, Python, JavaScript, etc.) serverless environment designed to auto-scale.
- Think: Serverless code execution.
- Best For: Light microservices, API back-end logic, webhooks, and event processing (blobs, queues, timers, HTTP).
- Example: Use Functions for real-time data processing. They can be instantly triggered by an HTTP webhook from an onboarding app or when a new hire’s large training data set is uploaded.
Logic Apps (Workflow and integration automation)
Logic Apps is a low-code workflow automation service designed to connect applications and services, featuring a visual designer and hundreds of built-in connectors.
- Think: Workflow automation and system integration.
- Best For: Enterprise integration, business process automation, SaaS platform connectivity, and approval workflows.
- Lab Application: Logic Apps excel at system integration. They can bridge complex gaps, such as connecting an external SaaS platform (HR) to internal databases, while handling automated email/Teams notifications throughout the onboarding lifecycle.
Which tool to use for front end?
For this lab setup - I will proceed with Microsoft list form in order to get user details and save them into sharepoint. It is enough to get the job done and very easy to learn.
* https://techcommunity.microsoft.com/blog/spblog/microsoft-lists-forms-whats-new/4374037
* https://lists.handsontek.net/microsoft-lists-forms-vs-microsoft-forms-use/
Other great option is – power apps.
Power apps is powerful tool to create interface in order to gather details for new hire onboard/off-boarding. I recommend learning and using this tool for more advanced UI integration.
Power Apps bridges the gap between your users and your cloud data architecture. It features native, secure connectors into:
- Microsoft Entra ID (Azure AD): Automatically reads user profiles, department data, and reporting hierarchies to personalize the app experience.
- Microsoft Graph & SharePoint: Can instantly pull or push data into SharePoint lists, Exchange calendars, or Excel sheets without configuring complex API endpoints.
- Azure Resources: Seamlessly acts as a front-end trigger for Azure Automation Runbooks or Logic Apps workflows.
Which tool to use for back end orchestration?
Power automate VS Logic app?
Power Automate is optimal for end-user and citizen-developer-driven flows. It is ideal for streamlining repetitive office tasks and simple business processes. For on-boarding, this means quickly connecting applications within your immediate control (e.g., MS Forms, Teams, and standard Office 365 services) without requiring deep technical knowledge. It is fast to deploy and manage for straightforward user lifecycle events.
Azure Logic Apps is optimal for IT professional and developer-driven automation. It is ideal for complex enterprise integration and robust system connections. For on-boarding, this means handling deep-level account provisioning in Azure Active Directory, resource allocation across multiple subscriptions, and connecting diverse line-of-business (LOB) or on-premises systems via complex API logic. It offers granular control, scalability, and enhanced security management.
Logic Apps provides an excellent alternative due to its flexible RBAC (Role-Based Access Control), allowing us to seamlessly grant resource permissions to other team members. While its pricing models—offering either a Consumption (pay-per-trigger) or Standard (flat-rate) plan—can carry a premium compared to Power Automate, the operational benefits thoroughly justify the investment.
Logic Apps introduces enterprise-grade features including native version control, robust runbook integration, Centralized Auditing & Logging (Logic Apps funnels its execution logs directly into Azure Log Analytics and Log Workspace) and support for User-Assigned Managed Identities. For future scalability, Lifecycle workflows like user off-boarding and cross-departmental transfers can be easily integrated into this framework. Crucially, this ensures the entire orchestration layer remains fully under IT control and ownership.
For power automate, the orchestration flow is tied to a single account requiring power automate license. There are premium license for custom connectors for PA.
Conclusion:
The requirements for what is needed in this lab should be satisfy by integrating azure logic app along with Microsoft list form. I want to keep this project simple following KISS method. Maybe in the future, I can review implementation of source of truth from HR system and connecting the org account to third party platforms that supports SCIM.
High level process:
1. User submits details on Microsoft list form.
2. The details on AD user info get saved to sharepoint list.
3. Create sharepoint trigger in Azure logic app - [Any new items added to sharepoint] ---> fire the trigger
4. Once the trigger fires ---> call Azure runbook to deploy powershell script targeting on premise servers (Arc enabled)
5. The scripts will provision, sync and modify group membership for the user.
**Any failures will be logged and email will be sent to IT.
6. At the end of the flow, the account is setup in both on premise EAC and entra with group membership configured.
Steven’s Knowledge Base 