From $2,500 per build · One-time · Fixed written quote
Every new hire set up the same way. Every departure closed the same day.
Scripted joiner and leaver workflows for Microsoft 365, Entra ID and Active Directory, built in PowerShell and Microsoft Graph, documented, and owned by you.
The problem.
-
Microsoft's own guidance says a reasonable window for an inactive account is 90 to 180 days. An account nobody closes keeps its license, its mailbox and its access the whole time.
Source, Microsoft Learn -
When a user is deleted, their OneDrive is kept for 30 days by default and then removed. Someone has to move the files first, every time.
Source, Microsoft Learn -
A checklist with eleven steps gives you eleven chances to miss one. A script gives you one.
-
At a managed service provider I run onboarding and offboarding for more than a hundred client organizations, including archiving each departed user's OneDrive into SharePoint before the account closes. This service is that process, scripted for your tenant and owned by you.
What I do.
Scope on a call.
How a new hire is requested today, where identity lives (Entra ID only, hybrid with Entra Connect or Cloud Sync, or on-premises Active Directory), the license mix, the groups, mailboxes, Teams, device enrollment with Intune and Autopilot, and the shared drives each role needs.
Build onboarding.
A Microsoft Form or ticket intake feeds a PowerShell script that uses the Microsoft Graph PowerShell SDK (and the Active Directory module where needed) to create the account to your naming standard, assign licenses through group-based licensing, add security and Microsoft 365 groups from role templates, set manager and department, provision the mailbox and Teams, and send first-day instructions. Every run writes an audit entry.
Build offboarding.
From an HR or ticket trigger, the script revokes sign-in sessions, disables the account, resets the password and MFA methods, converts the mailbox to shared and delegates it to the manager, sets the auto-reply your policy requires, copies the OneDrive to a SharePoint "Departed users" library with manager access, removes group and distribution list memberships, reclaims the license, retires or wipes devices in Intune, and logs each step.
Add mover handling and reporting.
In the Full Lifecycle bundle. A role change updates groups, licenses, manager and shared drives. A monthly orphaned-account report lists accounts with no sign-in in 90 days, licensed accounts for departed people and mailboxes without an owner.
Run it where it fits.
Azure Automation, a scheduled task on a management server, or a Rewst or n8n trigger if you already have one. Credentials use an app registration with least-privilege Graph permissions and a certificate, all documented.
What you get.
- The onboarding script set and the intake form.
- The offboarding script set with the OneDrive-to-SharePoint archive step.
- A runbook for the person who runs it after me, plus the app registration and permissions documented.
- An audit log of every run so a compliance officer can see who was created or removed and when.
- A two-hour handover session and a 30-day warranty on the build. You own the code.
How long it takes.
- Scoping call
- 90 minutes, with a screen share of the tenant. Written quote the next business day.
- Build
- With test users or a test OU, 1 to 2 weeks. Role templates agreed with HR and IT.
- Pilot
- Two or three real hires and one real departure, 1 week, with me on the call.
- Handover session
- 2 hours. The 30-day warranty starts.
- Typical total
- 3 to 5 weeks for a single Entra tenant. Hybrid Active Directory or multiple tenants add 1 to 3 weeks and are quoted after scoping.
Pricing.
You own the scripts. There is no per-user, per-month fee.
-
Onboarding automation
Intake form, account creation, licenses, groups, mailbox and Teams, first-day instructions, audit log.
$2,500 per build -
Offboarding automation
Session revocation, account disable, mailbox conversion, OneDrive-to-SharePoint archive, license reclamation, device retirement, audit log.
$2,500 per build -
Full Lifecycle bundle
Both flows, mover handling and the monthly orphaned-account report.
$4,200 per build -
Included
Scoping, build, pilot, runbook, handover, 30-day warranty.
-
Extra
Hybrid Active Directory, multi-tenant or multi-forest environments, quoted after scoping. Integration with a third-party HR system, quoted. Changes after the warranty at my hourly rate (see Fractional senior engineer).
Every quote is fixed in writing before work begins.
Questions.
We have on-premises Active Directory and Entra Connect. Does this still work?
Yes. The script creates the account in Active Directory, waits for sync, and completes the cloud-only steps afterward. Hybrid builds are quoted after scoping because the sync rules differ in every environment.
Who runs it after you leave?
Your IT staff or your MSP, from the runbook. Day to day it runs from the intake form, and nobody needs to read PowerShell to use it. I hand it over, walk through it, and you own it.
What happens to a departed person's files?
The OneDrive is copied to a SharePoint library with access for the manager before the account is removed. The mailbox is converted to shared and delegated. Retention follows your policy.
We already have an MSP. Will this step on them?
No. The scripts document exactly what happens at each step, and the MSP usually keeps running the ticket flow. They get the runbook too.
Scoping is a 90-minute call. The written quote arrives the next business day.
When the script needs a change six months from now, the fractional senior engineer retainer covers it.