- Group-based licensing means one add-to-group action handles the license.
- A Power Automate flow watches the HR list and creates the account.
- User creation and group actions need premium connectors and Entra rights.
- Bake MFA enrollment into the day-one welcome email.
This guide is for an IT admin or operations lead at a small business who still creates new-hire accounts by hand every time HR sends an email. By the end, you'll have an automated flow that watches your HR list, creates the Microsoft 365 account, assigns a license, adds the person to the right groups, and kicks off a welcome sequence. We'll cover two approaches and flag what needs a premium connector or a paid Entra ID tier.
Before you start
You'll need a Microsoft Entra (formerly Azure Active Directory) admin role that can create users and manage groups (User Administrator or higher), a place where HR records new hires (a SharePoint list or Microsoft List works well), and a Power Automate license that includes premium connectors, because the Entra/user-management actions are premium. If you plan to use the lifecycle workflows approach in Step 1b, you'll need Microsoft Entra ID Governance, which is a paid add-on.
Step 1: Pick your approach
There are two solid paths. Pick one.
1a. Power Automate flow (most flexible, works for most SMBs). A flow watches your HR list and does each step. You build it, so you control every detail. This is the path the rest of this guide follows.
1b. Microsoft Entra lifecycle workflows (built-in, less custom). If you have Entra ID Governance, lifecycle workflows can run "joiner" tasks automatically based on a user's hire date, like generating a temporary password and sending a welcome email. It's cleaner but less flexible, and it assumes the user record already exists in Entra. Many small businesses still prefer the Power Automate route for the control it gives.
Step 2: Set up group-based licensing
Before you build anything, set up group-based licensing so you never assign licenses one at a time again.
- In the Microsoft 365 admin center or the Entra admin center, create a security group, for example "M365 Business Premium Users."
- Assign the license to the group (in Entra: Groups > [your group] > Licenses > Assignments).
- From now on, anyone added to that group automatically inherits the license. Your flow just needs to add the new hire to the group.
This one step removes a whole category of manual work and licensing mistakes.
Step 3: Build the trigger
In Power Automate (make.powerautomate.com), create a new automated cloud flow.
- Trigger: "When an item is created" on your HR SharePoint list. Now every new hire row starts the process.
- Add a short delay or an approval step if you want a human to confirm the hire before provisioning. For sensitive environments, a one-click approval is worth the extra second.
Step 4: Create the user account
Add the Entra/Office 365 Users action Create user (sometimes shown under the Microsoft Entra ID or Office 365 Users connector). Map fields from the HR list:
- Display name, first and last name, and the user principal name (usually first.last@yourdomain.com).
- Job title, department, and manager if your list captures them.
- Set Force change password on next sign-in to true, and generate a strong temporary password.
The user-creation and group-management actions run on premium connectors, so the flow's owner needs a Power Automate license that covers premium use. The flow also needs permission to create users, so run it under an account with the right Entra role. If creation fails silently, this is almost always why.
Step 5: Assign the license and add to groups
Now wire up access:
- Add the new user to your licensing group from Step 2 using the Add member to group action. The license attaches automatically.
- Add the user to their department and role groups the same way (Finance, the Sales distribution list, the shared mailbox group, and so on). Pull the right groups from a column on the HR list so the flow stays generic.
This is where group-based licensing pays off: one "add to group" action does the licensing and the access at once.
Step 6: Send the welcome sequence
Add the steps that get the person productive on day one:
- Send a welcome email (to a personal address from the HR list, or to their manager) with the temporary password, sign-in instructions, and a link to set up multifactor authentication (MFA).
- Post a message in a Teams onboarding channel so IT and the manager know the account is ready.
- Optionally, include links or instructions to install the Microsoft 365 apps and enroll their device.
Bake MFA enrollment into the welcome email, not a later reminder. The easiest time to get someone set up securely is before they've started leaning on the account. A new hire who enrolls MFA on day one never becomes the unprotected account you have to chase down later.
Step 7: Test with a fake hire
Don't test on a real person. Add a test row to your HR list ("Test User") and watch the flow run. Confirm the account was created, the license attached (check the user in the admin center), the group memberships are right, and the welcome email arrived. Then sign in as the test user once to confirm the password-reset and MFA prompts work. When it all checks out, delete the test user and turn the flow on for real.
What to do next
Start with account creation and licensing, the two steps that save the most time, and add the welcome and group steps once that core works. Keep the HR list tidy, because the flow is only as good as the data feeding it. When you're ready, an offboarding flow that reverses all of this (disable the account, reclaim the license, remove from groups) is the natural next build. If you'd like help wiring any of this up, that's work we do often. Let's talk it through.