IT & Security package

Microsoft 365 / Entra account provisioning

A themed IT form requests a new starter account; the manager approves, then Graph creates the Entra user, assigns the licence and adds the department group.

Connects to Microsoft 365Microsoft Entra ID

OfficialStarts from a formIntermediate~30 min setupv1.0.0
Download .utpkg 22 KBHow to install

About this package

What it does

Microsoft 365 / Entra account provisioning replaces the new starter ticket and the copy-paste in the Entra admin centre. IT fills in a branded form: name, job title, employee id, personal email, start date, office, the approving manager and the department, picked from the Departments table, which fills in the Microsoft 365 licence SKU, the Entra group, the usage location and the mail domain.

The workflow builds the user principal name, checks with Microsoft Graph that it is free (adding a number when it is not) and gives the manager an approval task with Approve and create / Reject buttons.

On approval, Graph creates the user (POST /users), assigns the department's licence (POST /users/{id}/assignLicense), adds the user to the department group (POST /groups/{id}/members/$ref) and issues a Temporary Access Pass for day one. The starter gets a welcome email at their personal address with their sign-in name, and the manager gets the pass to hand over.

Starts from a form

Starts from a form page: IT opens the New starter account request form (/f/<id>); submitting it starts the workflow.

Someone fills in a form to start it: the workflow start form (Run dialog in the app, or your own portal posting to the API) or a standalone form page (/f/<id>) whose Form submitted trigger starts the workflow. People complete User Task forms along the way.

The flow

Step by step

  1. 1

    IT requests the account

    The themed form collects the starter's details; the Departments lookup fills the licence SKU, group, usage location and domain.

  2. 2

    Build and check the UPN

    first.last@domain is built and checked with GET /users?$filter=userPrincipalName eq ...; a number is added if it is taken.

  3. 3

    Manager approves

    The approving manager (a Person field on the form) gets Approve and create / Reject buttons.

  4. 4

    Create in Entra ID

    POST /users, POST /users/{id}/assignLicense, POST /groups/{id}/members/$ref and a Temporary Access Pass.

  5. 5

    Welcome

    The starter gets their UPN at their personal email; the manager gets the pass for day one.

Entra account provisioning — IT submits the new starter form; the UPN is built and checked in Entra ID, the manager approves, then Microsoft Graph creates the user, assigns the department licence, adds the department group and issues a Temporary Access Pass. The starter gets a welcome email with their UPN. The same canvas you get in the designer after installing.

Forms

The start form and the task forms

People start it from a form page (/f/<id>) with its own header, theme and buttons; submitting it starts the workflow. User Tasks show their fields and outcome buttons to the assignee.

Form page · /f/<id>

New starter account request

New starter account · 2-column grid · own header and theme · Its own page: share the link or open it on a tablet

First name * given_name · text
Last name * surname · text
Job title * job_title · text
Employee id employee_id · text
Personal email * personal_email · emailname@company.com
Start date * start_date · dateYYYY-MM-DD
Office * office_location · choice
AucklandWellingtonSydneyMelbourneRemote
Department * department · lookup
Licence licence_name · text
Group group_name · text
Licence SKU id licence_sku_id · text
Group object id group_id · text
Usage location usage_location · text
Mail domain mail_domain · text
Approving manager * manager · user
Manager email * manager_email · emailname@company.com
Notes for IT notes · textarea
Request account

User Task

Manager approval

Approve account for {{form.given_name}} {{form.surname}} ({{dept_name}}, starts {{form.start_date}}) · 2-column grid · own header and theme

The sign-in name is right upn_ok · boolean
The licence is right licence_ok · boolean
Extra access needed later extra_access · text
Comments comments · textarea
Approve and createReject

From your code

Start a run over the API

Every workflow can be started over REST, MCP or the CLI, whatever its trigger, with the sample input below. Runs start straight away on the published version; replace <workflow id> with the id the install created.

REST

shell
curl -X POST "$USERTASKS_URL/api/v1/workflows/start" \
  -H "Authorization: Bearer $USERTASKS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"workflow_id":"<workflow id>","variables":{"given_name":"Ana","surname":"Lopez","job_title":"Financial Analyst","employee_id":"E10492","personal_email":"ana.lopez.home@example.net","start_date":"2026-11-09","office_location":"Auckland","department":"FIN","licence_name":"Microsoft 365 E3","group_name":"SG-Finance","licence_sku_id":"05e9a617-0261-4cee-bb44-138d3ef5d965","group_id":"b320e1c4-7a4f-4d0e-9c1e-2f5a7d1e9a01","usage_location":"NZ","mail_domain":"contoso.example.com","manager":"$owner","manager_email":"finance.manager@example.com","notes":"Needs access to the month-end shared mailbox (separate request)."}}'

CLI

shell
usertasks workflows inputs <workflow id>          # the start form: keys, types, required
usertasks workflows run <workflow id> --input given_name=Ana --input surname=Lopez --input job_title="Financial Analyst" --input employee_id=E10492 … --wait

What's included

12 assets, ready to adapt

TypeNameDetails
Email templateAccount request not approvedSent to the manager email on the request when the account is not approved.
Email templateNew starter sign-in detailsSent to the approving manager: the UPN and the Temporary Access Pass to hand over on day one.
Email templateWelcome: your Microsoft 365 accountSent to the new starter's personal email with their sign-in name once the account exists.
Data tableDepartmentsEach department's Microsoft 365 licence (SKU id), its Entra group and defaults. The new starter form looks the department up here and fills the licence and group in.
IntegrationMicrosoft GraphMicrosoft Graph v1.0 for Microsoft Entra ID and Microsoft 365. Use an app registration with application permissions User.ReadWrite.All, GroupMember.ReadWrite.All, LicenseAssignment.ReadWrite.All (and UserAuthenticationMethod.ReadWrite.All for Temporary Access Passes); the token is a client-credentials bearer token.
API referenceAdd group memberPOST /groups/{{group_id}}/members/$ref — Add the user to the department's security / Microsoft 365 group (POST /groups/{id}/members/$ref with an @odata.id of the directory object). Graph answers 204 No Content.
API referenceAssign licencePOST /users/{{user_id}}/assignLicense — Assign the department's Microsoft 365 licence (POST /users/{id}/assignLicense with addLicenses[].skuId). Returns the user.
API referenceCreate Temporary Access PassPOST /users/{{user_id}}/authentication/temporaryAccessPassMethods — Create a Temporary Access Pass for the first sign-in (POST /users/{id}/authentication/temporaryAccessPassMethods). Needs the TAP authentication method policy enabled.
API referenceCreate userPOST /users — Create the Entra ID account (POST /users) with a forced password change at first sign-in. Returns the new object id and userPrincipalName.
API referenceFind user by UPNGET /users — Check whether the user principal name is already taken (GET /users?$filter=userPrincipalName eq '...'&$select=id,displayName,userPrincipalName).
formsNew starter account requestIT's form for a new Microsoft 365 / Entra ID account: starter details, department (licence and group fill in), start date and the approving manager.
WorkflowEntra account provisioning24 steps — IT submits the new starter form; the UPN is built and checked in Entra ID, the manager approves, then Microsoft Graph creates the user, assigns the department licence, adds the department group and issues a Temporary Access Pass. The starter gets a welcome email with their UPN.

Departments · 5 sample rows

CodeDepartmentLicenceLicence SKU idGroup object idGroupUsage locationMail domainCost centre

Requirements

What you connect it to

Credentials never travel in a package. The install wizard asks for what your environment must provide, or installs it incomplete until you finish setup.

Needs

  • REST API — A REST API integration: set its base URL and credentials on install.
  • Email — Email delivery configured for the instance (EMAIL_PROVIDER), used for notifications.

After installing

  1. Microsoft Graph integration: base URL https://graph.microsoft.com/v1.0 and a bearer token for an app registration with User.ReadWrite.All, GroupMember.ReadWrite.All, LicenseAssignment.ReadWrite.All and UserAuthenticationMethod.ReadWrite.All application permissions (admin consent). Use the client-credentials flow (token endpoint login.microsoftonline.com/<tenant>/oauth2/v2.0/token).
  2. In the "Add to department group" step, change the directory object URL from graph.microsoft.example.com to https://graph.microsoft.com/v1.0/directoryObjects/{{user_id}}.
  3. Replace the Departments rows with your departments, licence SKU ids (GET /subscribedSkus), group object ids and mail domains.
  4. Enable the Temporary Access Pass authentication method policy in Entra ID (the step continues on error if it is off).
  5. Email: configure EMAIL_PROVIDER so the welcome and manager emails are delivered.

Asked for on install

  • Integration “Microsoft Graph”Required

    • Tokenconfig.auth_config.token
    • Base urlconfig.base_urldefault https://graph.microsoft.example.com/v1.0· optional

Install

Install it in your workspace

Works on UserTasks cloud and on any self-hosted instance. Installing creates the assets above; nothing runs until you complete setup and start it.

In the app

  1. Download entra-account-provisioning-1.0.0.utpkg.
  2. Open Automations → Packages and drag the file onto the page (or choose Import package). Browse gallery there lists every gallery package without downloading by hand.
  3. Pick the file. The wizard verifies the checksum, every file hash and the signature, and shows the readme.
  4. Review the changes (what is created) and the data rows.
  5. Fill in the requirements, or tick Keep incomplete and finish later with Complete setup.
  6. Done: the workflow is published and active once setup is complete.

With the CLI

shell
curl -fLO https://usertasks.com/gallery/entra-account-provisioning-1.0.0.utpkg
usertasks packages inspect entra-account-provisioning-1.0.0.utpkg       # offline: checksum, hashes, signature
usertasks packages install entra-account-provisioning-1.0.0.utpkg --dry-run
usertasks packages install entra-account-provisioning-1.0.0.utpkg       # prompts for each requirement
usertasks packages install entra-account-provisioning-1.0.0.utpkg --keep-incomplete --yes   # in CI; finish with:
usertasks packages complete entra-account-provisioning -f values.yaml

Verify the download

File SHA-256
97d8a2e8277739adca0bbb259cc27f7fa45bfe2ec8c6a50caf5a63c03003ad06
Package checksum (what is signed)
sha256:f6b92010d79ae0be1bbac9fb46db32c3e4b61d4d21020635048a21a0081981dd
Signer
Unsigned preview build — compare the SHA-256 above

shasum -a 256 entra-account-provisioning-1.0.0.utpkg should print the file SHA-256. How gallery packages are signed.

Versions

Version 1.0.0

  1. v1.0.02026-10-28First release.

Installing a newer version upgrades in place: local credentials and requirement values are kept, and changes you made are flagged first. How packages work

More packages

Related

Browse the whole gallery