Service catalog and onboarding/offboarding automation

Designed and operate the IT service catalog inside Freshservice (25+ structured service items with forms, approvals, and routing) plus the onboarding and offboarding workflow infrastructure that sits behind it. 1,089 onboarding tickets and 469 offboarding tickets processed since Freshservice went live, with user provisioning time compressed from 2 hours to 15 minutes through scripting and automation.

The service catalog

25+ structured items in production. Top items by lifetime request volume:

• Windows Laptop (975): the standard endpoint-provisioning workflow.
• User account Entra ID Edit (600): update existing-user attributes / group membership / licensing.
• Offboarding (279): full termination workflow.
• 24" Monitor (270).
• Mailbox Access (212): delegated mailbox grants.
• User account Entra ID Create (175): new-user provisioning kickoff.
• Email Distribution List (167): new DL creation with owner/member design.
• Dell HD22Q Dock (163): standard dock procurement.
• Wireless Keyboard and Mouse (149).
• Group in Entra ID Add (129): group creation with naming-standards compliance.
• Email Forwarding (67): internal-only by default; external requires security review.
• Teams Phone License (28).
• Out of Country Access (21): time-bounded Conditional Access exception for international travel.

Catalog covers the full request surface: hardware (laptops, desktops, monitors, docks, peripherals, chargers, printers), identity (user create/edit/delete, group add/edit, mailbox access, email forwarding, distribution lists), software (Adobe Acrobat Standard/Pro, Teams Phone License), and policy exceptions.

The multi-ticket onboarding cascade

New-hire onboarding flows through a deliberately structured multi-ticket cascade rather than a single monolithic ticket. Documented in three KB articles.

1. HR-initiated HR submits the new-hire notice via the HR Onboarding Teams App, which raises the IT ticket and pre-populates the user's role, department, manager, start date, and region.
2. Ticket #1 New Affinity User Creation Provisions the Entra ID user with the correct UPN, attributes (Department, Division, Region per the naming standards), license assignment via dynamic-group membership, security-group enrollment.
3. Ticket #2 New Employee Handles per-person deliverables (laptop, dock, monitor, peripherals from the service catalog), local account setup, role-specific software.
4. Downstream automation Dynamic groups assign the correct M365 license tier, Conditional Access policies scope per region/department, PrinterLogic deploys the right printer set, distribution lists pick up the new member automatically.

1,089 onboarding tickets have flowed through this cascade since Freshservice went live, processing roughly one new hire per business day across the 1,000-plus-employee company.

The offboarding workflow

Mirror process documented in the Offboarding - Steps to Terminate a User and How to terminate an employee in Entra ID / Office 365 KB articles. 469 offboarding tickets processed to date.

• Immediate session revocation and password reset.
• License removal (with retention-window grace period for shared mailbox conversion).
• Group membership cleanup.
• Mailbox-access delegation to the manager.
• OneDrive content preservation.
• Hardware return tracking.
• Eventual hard-delete after the documented retention window.

Power Automate flows tying it together

• HR Onboarding Teams App (Power Apps front end) for HR to submit new-hire records.
• Cloud flow: Check for new employee and send email triggers off the HR form to alert the right IT contact and create the cascade tickets in Freshservice.
• Cloud flow: new-employee submission to the outgoing MSP pushes new-hire info to the outgoing MSP so the legacy support workflow stays in sync during the MSP-transition window.
• Darwinbox to CRM email notification flow (in design): once Darwinbox is live, lifecycle events relevant to the sales team's CRM get a structured email notification, decoupling CRM awareness from the Freshservice queue.
• Plus the broader Power Automate workflow library: user provisioning / deprovisioning tied to HRIS / manager approval, SMS broadcast approval routing, HPSCAT vendor data ingestion notifications, Freshservice ticket routing and escalation.

Two hours to fifteen minutes

User provisioning time compressed from approximately 2 hours per new user to roughly 15 minutes via:

• Pre-built service catalog forms that capture all required information up front.
• Naming-standards-driven attribute auto-population (Region + Department + Job Title flows directly into dynamic-group rules, license assignment, Conditional Access scoping).
• Power Automate flows propagating the new-hire record across systems.
• KB articles documenting the per-step procedure so the work runs the same way every time.
• Standardized AD security-group templates (_TEMPLATE-RDSUser, _TEMPLATE-QBUser, _TEMPLATE-ServiceAccount) so template-account copy-and-modify replaces from-scratch creation.

What this demonstrates

• ITIL service-catalog design at the level of detail that actually changes how a multi-region IT operation runs: 25+ structured items with forms, approvals, routing, and KB-documented procedures.
• Workflow automation discipline 1,089 onboarding tickets processed at the same procedural rigor as the first one.
• Cross-system integration via Power Automate HR Onboarding Teams App + Freshservice + the outgoing MSP + the company CRM. The flows are the connective tissue.
• Measurable provisioning improvement 2 hours to 15 minutes is the concrete outcome that hiring managers respond to.
• Naming-standards leverage The Entra ID Department attribute and the standardized region codes do most of the work; the catalog just routes the request correctly and lets downstream automation pick up.
• Service catalog as a policy-exception surface The Out-of-Country Access item is a great example. International-travel users get a documented, time-bounded Conditional Access exception via a structured request rather than ad-hoc admin intervention.