What’s a practical way to automate onboarding and offboarding for 700 users?

Before shopping, map the handoffs that are actually failing. If HR sends incomplete or late details, an automation platform won’t fix that by itself. Use a required intake form with a manager or HR approval, and make the agreed source of truth for names, roles, start dates, and access explicit.

Then automate the repeatable parts in stages: account creation and baseline groups first, application and equipment tasks next, and offboarding with a clear trigger and checklist. A ticketing system you already use may be enough to orchestrate the approvals and work, with Microsoft identity tools handling account actions. That can be cheaper and easier to maintain than buying a full identity-governance product, but check the licensing and integration details for your setup.

If you already have a service desk platform, check its workflow features before adding another vendor. A starter request can collect the required information, route approvals, and create separate tasks for IT, application owners, and equipment. For offboarding, route a confirmed departure through a checklist so access removal and asset recovery aren’t left to memory.

Keep the workflow boring and visible. Log who approved what, define what happens when a start date changes, and make exceptions land with a person instead of silently failing. The main cost may be staff time to build and test it, so compare that against the subscription price rather than looking only at the monthly bill.

There’s a real tradeoff here. A dedicated identity lifecycle product may save work, but setup, maintenance, and licensing can make a low sticker price misleading. At 700 users, I wouldn’t assume a tool is good value just because it is under budget.

Ask vendors to demonstrate your actual cases: a standard hire, a role change, a delayed start, and an urgent termination. Get specifics on which Microsoft 365 and Azure actions are automated, what needs manual approval, how errors are reported, and what implementation support costs. If those answers are vague, that’s a warning sign.

Don’t overlook the option of building a small workflow with tools you already pay for. A ticket can be the request record, while Microsoft’s built-in identity capabilities handle the parts they support. That can be a sensible starting point if your process is fairly consistent and someone on the team can own the automation.

Just avoid creating a mystery script that only one person understands. Document the inputs, permissions, failure handling, and manual fallback. If your app access is complex or changes often, a specialist tool may be worth the extra cost.

For me, the first win would be getting the data clean and the process consistent, not trying to automate every edge case on day one. Make HR or the hiring manager provide a complete, approved request, then automate the common path and leave unusual cases for review.

Track time spent, correction rates, and missed steps for a month or two. That gives you a much better basis for deciding whether to expand an internal workflow or pay for a dedicated service.