Service catalog and onboarding/offboarding automation

I designed and operate the IT service catalog in Freshservice, plus the onboarding and offboarding workflow behind it. Structured requests, approvals, routing, scripting, and downstream automation handle the company's full employee-lifecycle volume and compress user provisioning from hours to minutes.

The service catalog

Structured items in production, ordered here by lifetime request volume:

• Windows Laptop: the standard endpoint-provisioning workflow.
• User account Entra ID Edit: update existing-user attributes / group membership / licensing.
• Offboarding: full termination workflow.
• 24" Monitor.
• Mailbox Access: delegated mailbox grants.
• User account Entra ID Create: new-user provisioning kickoff.
• Email Distribution List: new DL creation with owner/member design.
• Dell HD22Q Dock: standard dock procurement.
• Wireless Keyboard and Mouse.
• Group in Entra ID Add: group creation with naming-standards compliance.
• Email Forwarding: internal-only by default; external requires security review.
• Teams Phone License.
• Out of Country Access: time-bounded Conditional Access exception for international travel.

Catalog covers the full request surface: hardware (laptops, desktops, monitors, docks, peripherals, chargers, printers), identity (user create/edit/delete, group add/edit, mailbox access, email forwarding, distribution lists), software (Adobe Acrobat Standard/Pro, Teams Phone License), and policy exceptions.

The multi-ticket onboarding cascade

New-hire onboarding flows through a deliberately structured multi-ticket cascade rather than a single monolithic ticket. Documented in three KB articles.

1. HR-initiated HR submits the new-hire notice via the HR Onboarding Teams App, which raises the IT ticket and pre-populates the user's role, department, manager, start date, and region.
2. Ticket #1 New User Creation Provisions the Entra ID user with the correct UPN, attributes (Department, Division, Region per the naming standards), license assignment via dynamic-group membership, security-group enrollment.
3. Ticket #2 New Employee Handles per-person deliverables (laptop, dock, monitor, peripherals from the service catalog), local account setup, role-specific software.
4. Downstream automation Dynamic groups assign the correct M365 license tier, Conditional Access policies scope per region/department, PrinterLogic deploys the right printer set, distribution lists pick up the new member automatically.

Every onboarding has flowed through this cascade since Freshservice went live, at a pace of roughly one new hire per business day across the 1,000-plus-employee company.

The offboarding workflow

Mirror process documented in the Offboarding - Steps to Terminate a User and How to terminate an employee in Entra ID / Office 365 KB articles.

• Immediate session revocation and password reset.
• License removal (with retention-window grace period for shared mailbox conversion).
• Group membership cleanup.
• Mailbox-access delegation to the manager.
• OneDrive content preservation.
• Hardware return tracking.
• Eventual hard-delete after the documented retention window.

Power Automate flows tying it together

• HR Onboarding Teams App (Power Apps front end) for HR to submit new-hire records.
• Cloud flow: Check for new employee and send email triggers off the HR form to alert the right IT contact and create the cascade tickets in Freshservice.
• Cloud flow: new-employee submission to the outgoing MSP pushes new-hire info to the outgoing MSP so the legacy support workflow stays in sync during the MSP-transition window.
• HRIS-to-CRM email notification flow (in design): once the HRIS is live, lifecycle events relevant to the sales team's CRM get a structured email notification, decoupling CRM awareness from the Freshservice queue.
• Plus the broader Power Automate workflow library: user provisioning / deprovisioning tied to HRIS / manager approval, SMS broadcast approval routing, HPSCAT vendor data ingestion notifications, Freshservice ticket routing and escalation.

Hours to minutes

User provisioning time compressed from a couple of hours per new user down to minutes via:

• Pre-built service catalog forms that capture all required information up front.
• Naming-standards-driven attribute auto-population (Region + Department + Job Title flows directly into dynamic-group rules, license assignment, Conditional Access scoping).
• Power Automate flows propagating the new-hire record across systems.
• KB articles documenting the per-step procedure so the work runs the same way every time.
• Standardized AD security-group templates (_TEMPLATE-RDSUser, _TEMPLATE-QBUser, _TEMPLATE-ServiceAccount) so template-account copy-and-modify replaces from-scratch creation.

What this demonstrates

• ITIL service-catalog design at the level of detail that actually changes how a multi-region IT operation runs: structured items with forms, approvals, routing, and KB-documented procedures.
• Workflow automation discipline Every onboarding processed at the same procedural rigor as the first one.
• Cross-system integration via Power Automate HR Onboarding Teams App + Freshservice + the outgoing MSP + the company CRM. The flows are the connective tissue.
• Measurable provisioning improvement Hours to minutes is the outcome the rest of the workflow exists to protect.
• Naming-standards leverage The Entra ID Department attribute and the standardized region codes do most of the work; the catalog just routes the request correctly and lets downstream automation pick up.
• Service catalog as a policy-exception surface The Out-of-Country Access item is a great example. International-travel users get a documented, time-bounded Conditional Access exception via a structured request rather than ad-hoc admin intervention.