- Make notifying IT a required step inside the HRIS onboarding checklist so HR cannot finish onboarding someone without it, removing the 'nobody told me' failure mode.
- The same new-hire trigger can auto-create the Microsoft 365 account, assign the right license, and kick off a password, MFA, and app-install welcome sequence.
- A nightly Power Automate job can read the HR termination list, disable accounts, reclaim licenses, and convert mailboxes to shared so history stays without paying for a seat.
- Pairing the workflow with Intune and Windows Autopilot lets a new laptop be drop-shipped and self-configure on first sign-in with no IT hands required.
This past winter, the one-person IT shop at an aviation-services company told us something we hear constantly: sometimes he learns a new hire started on the day they walk in, and sometimes he learns someone left ten days after their access should have been shut off. "Sometimes I find out ten days later to shut down their email," he said. That gap is a security hole and a daily headache, and it's very fixable.
The broken state most SMBs live in
The common pattern: IT sits outside the HR process. They get told about new hires and departures by ad-hoc email, often late, sometimes through a batch report days after the fact. In the meantime, a new employee has no accounts on day one, and a departed employee still has a live mailbox and open access to company data. Both are bad, and both are normal.
Start in the HR system, not in IT
The fix begins where the event actually happens: the HRIS, your HR information system. Make notifying IT a required step in the onboarding checklist, so HR literally cannot finish onboarding someone without it. That one change removes the "nobody told me" failure mode.
From there, you can go further than a heads-up. The same trigger that says "new hire" can automatically create the Microsoft 365 account, assign the right license, and start a welcome sequence: set your password, enroll in MFA, install your apps. The new person is ready before they sit down.
Offboarding is where the real risk lives
Departures are the dangerous half, and here automation pays off in security, not just convenience. A scheduled job, built with Power Automate (Microsoft's workflow tool) and a small script, can read the HR termination list each night, disable the accounts, reclaim the licenses, and convert mailboxes to shared so the team keeps the history without paying for a seat. The manual window where a former employee still has access just closes.
One note for smaller teams: if you only onboard a few people a year, the payoff here is consistency and security, not big time savings. The value is that nothing falls through the cracks, every time, and the same setup scales cleanly if your hiring ever speeds up.
This pairs naturally with zero-touch device setup. With Intune and Windows Autopilot (Microsoft's device-management tools), a new laptop can be drop-shipped straight to the employee and configure itself the first time they sign in, with no IT hands required.
If your IT team is finding out about hires and departures by email, after the fact, that's worth tightening up. We can map your HR-to-Microsoft-365 handoff and automate the parts that keep biting you. Let's talk it through.