jack archbold
← Projects

Staff Lifecycle

live

Onboarding and offboarding automation on SharePoint

for
A client's office. Client work, so they aren't named.
started
21 July 2026
in
One SharePoint record for a starter or a leaver
out
A dated task list, and the account and printer changes made for them

When someone joins or leaves a client’s business, one record in SharePoint starts everything that has to happen, and nothing falls through the gap between HR and IT.

  • Fans out the tasks. A new starter or a leaver becomes a list of 20-odd tasks, each with its own due date counted from their start or finish day.
  • Nags until they’re done. A digest is built every morning at 7:30, and anything overdue escalates to a manager. The reminders are still in test mode, so for now they all land in a test mailbox.
  • Does the safe parts itself. It creates the new starter’s Microsoft 365 account, and on a leaver’s last day it blocks sign-in, resets the password and signs them out everywhere. A short never-touch list means directors and IT can’t be disabled by automation, whatever a record says.
  • Keeps the printers in step, adding and removing people in the scan-to-email address book, and reading the book back to prove it.
  • Watches itself. A watchdog alerts if any workflow goes quiet, because a stopped workflow throws no error.

It started as a Graph app scoped to one SharePoint site and one mailbox, and has since been given the right to create and block accounts: getting that scope right, and the day three systems reported success for nothing.

An internal tool, so there’s no public link, and the client isn’t named.

Stack

n8n
Runs every workflow. The fan-out, the morning digest, the account and printer changes, and the watchdog.
Microsoft Graph
How the workflows reach Microsoft 365. It reads and writes the lists, creates and blocks accounts, and sends the mail.
SharePoint
The only part anyone sees. One form to fill in, the task list, and the checklist itself kept as rows.
Exchange
An access policy there limits the app to sending from one mailbox.
Uptime Kuma
Takes a heartbeat for each workflow and raises the alert when one goes quiet.

Build log

  1. New starters get their file server account made for them, with read or write set by their department. The first real one was checked on the server itself, not from the workflow's own report.

  2. It starts doing things. It creates a new starter's Microsoft 365 account, cuts off a leaver's access, and keeps the printers' scan-to-email address book in step. A watchdog goes in the same day.  Read →

  3. One-click Done and N/A buttons on every task, stamping who clicked and when.

  4. The first two workflows go in, in test mode. One turns a record into dated tasks, the other sends a 7:30 digest of what's due and overdue. The app behind them ends the day able to write to one SharePoint site and send from one mailbox.  Read →

  5. Started. The form and the lists are built in SharePoint, with the checklist kept as rows, not code, so a task can change without touching a workflow.

Writing