One Form, Nine Tasks: Employee Onboarding That Runs Itself in Microsoft 365

Onboarding tickets are where technician hours go to disappear, and every manual step is a chance for someone to fat-finger a job title or forget a group. The fix does not require buying anything: Microsoft Forms collects the request, Power Automate does the work, and the whole thing lives inside the customer's own tenant.

Here is everything the flow handles from a single form submission:

• Creating the user in Microsoft
• Assigning a license to the user
• Assigning a manager
• Adding attributes like job title, department, mobile number, employee hire date, and location
• Mirroring the group access of another user
• Adding the user to groups (tied to SharePoint sites, Teams, and so on)
• Adding the user to business systems
• Creating a ticket in your PSA with all of the details
• Sending the employee a welcome email with instructions for setting up Microsoft Authenticator

One thing to be clear about up front: this is a form you create on a per-tenant basis. It is not set up for multi-tenancy. If you want your PSA's self-service portal as the front end instead, we built that variant too: onboarding through HaloPSA and a webhook. A downloadable template for this build is linked at the end of the article.

Set up the tenant before you build the flow#

Four pieces of groundwork make the flow itself simple:

• A service account to own the flow. You can build the flow under a regular user to save a license, but we recommend a dedicated service account licensed with something basic like Business Basic or Business Standard, so nothing breaks if that user leaves. The account needs the User Admin and Group Admin roles to perform the steps in the automation.
• A shared mailbox as the sender. For the emails the automation sends, something like support@domain.com or employeelifecycle@domain.com reads better than a personal address.
• Group-based licensing. The flow assigns the license by adding the user to a group, something like "Microsoft 365 Business Premium Users," which licenses its members automatically. Microsoft documents it here: Assign licenses to a group (opens in new tab).
• A tidy Entra. Clean up as much as you can first, with dynamic groups for membership and SSO where possible, so the automation has fewer steps to take.

Build the form#

Microsoft's guide covers form creation basics: Create a form (opens in new tab).

The form itself can be tailored to any business. The fields shown above are what the template absorbs; the video at the end walks through the full setup.

Import the flow template and make it yours#

You can import a ready-made template into a tenant and customize from there: get the free template (opens in new tab). The full tutorial video below shows how each action is created.

When a user submits the form, the flow dynamically pulls out the submitted values to drive each action.

A quick note on the password specifically:

• The flow uses a sensitivity label to encrypt the email that carries the user's password.
• A Temporary Access Pass would be the more elegant answer, but it requires a much more advanced configuration.
• The Twilio connector is an option if you would rather send the password to the user over SMS.

For mirrored access, the flow checks the various group types before adding memberships, because copying them blindly causes failures.

The switch statements are where you customize: each branch can carry its own actions for specific business systems, so the same form drives different downstream steps depending on what was selected.

Watch the full build#

The complete walkthrough, from blank form to finished flow, is on video: watch the onboarding automation tutorial on YouTube (opens in new tab).