New Employee Onboarding Access Setup

Overview

New Employee Onboarding Access Setup is an automated flow that fires the moment a new starter is added to the HR onboarding SharePoint list. It picks up the new employee's profile (name, email, manager, start date, department), adds them to a default Office 365 security group via Microsoft Graph, sends the new hire a personalized welcome email with links to onboarding resources, notifies their manager that the team has a new starter, sends an admin summary so IT/HR can audit the run, and finally writes back to the list item to mark the onboarding access setup as Complete. The flow is designed as a single, low-touch automation that replaces the manual checklist IT typically runs on a new hire's first day.

Use Case

Most onboarding processes still rely on a checklist that bounces between HR, IT, and the new hire's manager — security-group membership gets missed, welcome emails go out late, and there's no single record that the access step was actually completed. This flow gives HR and IT a one-step, repeatable onboarding pattern: the new starter goes into the SharePoint list, and within minutes they have baseline group access, a welcome email in their inbox, their manager is in the loop, and the audit trail is written back to the list. It is a good fit for organizations that want a lightweight, auditable Day-1 access provisioning workflow without standing up a full identity-governance product.

The flow is ideal for teams that:

• HR and IT teams that share responsibility for new-hire Day-1 access provisioning.
• Small and mid-size organizations that want a lightweight alternative to a full identity-governance tool.
• Companies using a SharePoint-based onboarding tracker as the system of record for new hires.
• Managers who want an automatic 'your new starter is provisioned' notification with no manual follow-up.

Flow Architecture

Environment Variables

Connectors & Connections

Note — All connections are referenced as solution connection references; the flow is portable between environments as long as a connection is mapped at import time.

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

Add role-based group assignment

Instead of a single default security group, branch on the new hire's Department or Role column and add them to a department-specific group (Sales, Engineering, Finance). Store the mapping in a small SharePoint list or in additional environment variables so HR can update the mapping without editing the flow.

Include license assignment

Extend the Graph branch to call POST /users/{id}/assignLicense after the group add, so the new hire also gets the right Microsoft 365 license SKU on Day 1. Read the SKU id from a new flowlibs_DefaultLicenseSkuId environment variable.

Schedule the welcome email for start date

Replace the immediate welcome email with a Delay until action keyed off the new hire's Start Date so the email lands the morning they actually begin, not the day HR created the record.

Post a Teams welcome message

Add a Teams 'Post message in a chat or channel' action after the welcome email to post an introduction in the team's 'general' channel, tagging the new hire and their manager. Keeps the rest of the team in the loop without HR having to remember.

Retry the Graph call on transient failures

Wrap the group-membership HTTP action in a Scope with a Configure run-after that retries on 429 / 5xx responses before falling through to the failure branch. Microsoft Graph occasionally throttles bulk onboarding runs.

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

{ "@odata.id": concat(parameters('flowlibs_GraphApiBaseUrl'), '/directoryObjects/', triggerOutputs()?['body/EmployeeUserId']) }

concat(parameters('flowlibs_GraphApiBaseUrl'), '/groups/', parameters('flowlibs_DefaultSecurityGroupId'), '/members/$ref')

if(equals(outputs('Add_user_to_default_O365_security_group')?['statusCode'], 204), 'Complete', 'Failed - Review')