Microsoft 365 user onboarding and offboarding from a PSA ticket — in minutes, per client

How it runs, step by step

1. 1

   A PSA ticket with the onboarding type, an email to the service desk or the client's form starts the run. An agent extracts the fields and checks them against the client's role templates (sales, finance, field); anything missing is asked back in the ticket.

2. 2

   The client's authorized contact gets an approval with the summary — new user, role, licences, cost. Nothing is created before the approval; the answer is logged with who and when.

3. 3

   The workflow calls Microsoft Graph with the client's tenant credentials: create the user, set the manager, assign licences from the template, add to groups, enable the mailbox and Teams, apply the MFA policy. Each call's result is recorded; failures roll back what was created.

4. 4

   Credentials are delivered through the client's agreed secure channel, never in the ticket; the documentation platform gets the new user record, and the PSA ticket is closed with the steps taken and time spent for billing.

5. 5

   Offboarding runs the reverse list — block sign-in, revoke sessions, convert to shared mailbox, forward, remove licences, OneDrive handover to the manager — and produces the audit record the client's compliance asks for.