Identity Lifecycle Automation: Provisioning & Deprovisioning

In an organization with over 1,000 employees and continuous turnover typical of the aviation sector, manual account creation and dismissal operations represent a concrete operational risk: long timelines, human errors, orphan accounts with residual access.

At Neos Air — Alpitour World's airline — the process was handled manually via tickets: IT received an email request, created the Active Directory account, assigned Microsoft 365 licenses, configured groups and notified the manager. Dismissal — the most critical case from a security perspective — required interventions across multiple systems without a standardized procedure and without centralized traceability.

Design and implementation of an end-to-end system composed of two distinct layers:

The first layer is the automation pipeline orchestrated by n8n (custom image with PowerShell + Kerberos for WinRM), managing the entire user lifecycle: AD creation, Entra ID sync, M365 license assignment, group and Teams configuration, notifications and secure deprovisioning.

The second layer is itprov, an operational web dashboard (Python Flask + PostgreSQL + oauth2-proxy) accessible exclusively through corporate Entra ID SSO. It allows IT operators to monitor the onboarding queue, assign devices, generate TAPs, reset AD passwords and produce delivery documentation — all tracked with the operator's identity.

The workflow trigger is a webhook receiving user data (name, surname, department, role, manager) from the HR system.

Step 1 — Input validation

n8n validates the payload: required fields, email format, department existence in the configured mapping. Errors trigger a notification to the requester.

Step 2 — AD on-prem account creation

The custom n8n image includes PowerShell and Kerberos support for WinRM authentication. A PowerShell script creates the account in the correct Active Directory OU, sets display name, UPN, internal number and forces password change on first login.

Step 3 — Entra ID synchronization

The workflow waits for AAD Connect sync propagation (polling on the Graph API with retry) and verifies user availability in Entra ID before proceeding.

Step 4 — License assignment

Via Microsoft Graph API, the Microsoft 365 license configured for the department is assigned. License profiles are mapped in a Set node updatable without modifying the workflow.

Step 5 — Groups and Teams configuration

The user is added to security groups, distribution lists and Microsoft Teams based on their department.

Step 6 — Report and handoff

n8n automatically sends a report via email to the IT team with a summary of all provisioning operations performed. In parallel, an email is sent to the new employee's manager with temporary credentials and the onboarding checklist.

Dismissal is the most critical process: an active account of a former employee is an immediate security risk.

Step 1 — Trigger and scheduling

The flow starts from a dismissal request with effective date. If the date is future, n8n automatically schedules execution. The IT manager receives notification with a 2-hour cancellation window.

Step 2 — Immediate access block

Via Graph API: random password reset, revocation of all active sessions (revokeSignInSessions), Entra ID account disablement. Access to all cloud services is interrupted within seconds.

Step 3 — AD on-prem disablement

PowerShell script that disables the account, moves it to the "Dismissed" OU and adds a note with date and operator in the Description field.

Step 4 — License and group removal

Removal of all M365 licenses (freeing seats), removal from security groups, Teams and distribution lists.

Step 5 — Report and audit trail

Upon completion, n8n generates and sends a report to the IT team with a summary of all operations: disabled account, revoked sessions, removed licenses, deleted groups. Every operation is also recorded in the provisioning_audit PostgreSQL table with timestamp and operator.

itprov is a separate web application (Flask + PostgreSQL) protected by oauth2-proxy with Microsoft Entra ID SSO. Access is limited to a specific corporate security group — every action is tracked with the authenticated operator's identity.

Architecture

Browser → Caddy (TLS) → oauth2-proxy (Entra ID SSO) → Flask/Gunicorn.

Real-time KPIs

The dashboard shows: total records, pending ready for execution, scheduled pending, completed, errors, day hires, assigned devices, prepared PCs, signed delivery receipts.

Device assignment

The operator enters the laptop service tag from the dashboard. The request is written to the asset table with employee ID, hire date, service tag, operator and timestamp.

TAP — Temporary Access Pass

From the dashboard, operators can generate a TAP (Entra ID Temporary Access Pass) to allow the user first access without a password.

Delivery receipt

The dashboard automatically generates a PDF (ReportLab) with employee data, assigned device and delivered accessories, ready for signature at company entry.

The workflow implements error handling on every critical step:

- Automatic retry with exponential backoff on Graph API operations (rate limits, timeouts)

- Manual fallback: if a step fails after retries, the operation is suspended and IT is notified with intervention instructions

- Idempotency: each step checks state before acting, avoiding duplications on re-execution

- Partial rollback: if license creation fails, the workflow notifies and maintains the account without licenses rather than deleting it

- The itprov dashboard shows errors in a dedicated tab with exception detail and failed step

The system was designed considering applicable regulatory requirements.

GDPR (EU Reg. 2016/679)

- Art. 5 — Storage limitation: accounts are disabled and licenses revoked at end of employment, leaving no active access beyond what is necessary.

- Art. 25 — Privacy by design: dashboard access limited to a named security group, separate DB users with minimum permissions per function.

- Art. 32 — Security of processing: SSO authentication with mandatory MFA via Entra ID, no anonymous access, end-to-end TLS encryption.

NIS2 (EU Dir. 2022/2555)

The air transport sector is classified in Annex I of the directive as an essential sector.

- Art. 21 — Risk management measures: automatic deprovisioning with access revocation in less than 60 seconds dramatically reduces the post-employment exposure window.

- Audit and logging: structured log on PostgreSQL provides the operational evidence required for inspections or incident response.