From the HR record to the right access.
Field notes on Microsoft Entra ID Governance and HR-driven provisioning, from real hybrid deployments. What each stage does, what breaks, and how to fix it.
Articles are filed by where they sit in the pipeline. New here? Start with the overview, which follows one new starter through every stage.
Frost Eagle also sets this up for mid-sized businesses. See how we work.
Latest articles
How to automate onboarding and offboarding from your payroll system with Microsoft Entra
What it takes to let your HR or payroll system create, change and remove Microsoft 365 accounts on its own: the Entra pieces involved, the licences each one needs, and where most of the effort really goes.
628 users in AD, 180 in Entra, and one account that belonged to two people
Two small mistakes in a lab provisioning pipeline: a UPN expression that left spaces in, and an employee ID shared by two people. One hid most of my users. The other quietly merged two identities.
Moving custom attributes from Connect Sync to Cloud Sync? Check which app they belong to
A custom AD attribute synced into Entra ID gets a name that includes the ID of an app. Change sync engines and you can end up with a new app, a new name, and every rule that used the old one quietly pointing at nothing.
Why your Logic App can't set a hybrid user's first password
Graph will happily change a synced user's password from automation. The change just never reaches Active Directory, and the new starter is left with a password that doesn't work.
The 204 that does nothing: resuming Lifecycle Workflows from a second Logic App
A Lifecycle Workflows resume call can come back 204 No Content and still leave the task waiting. If a different identity is sending the callback, that is very likely why.
Following a new starter from payroll to Entra ID, one hop at a time
A walk through a hybrid HR-driven provisioning pipeline: what each hop does to a person's record, and where each one tends to break.