Identity Lifecycle Automation: Onboarding & Offboarding

Manual identity management creates delays, inconsistent configurations and residual access. The previous process required separate actions across directories, mail, groups and communications without one operational queue. The platform brings hires, terminations, fixed-term contracts and rehires into a traceable flow. Events originate in the HR database: IT does not create or disable accounts manually in the ordinary path.

A self-hosted platform combines n8n, PostgreSQL, PowerShell over Kerberos and Microsoft Graph. Every event has a state, timestamps and a last error; retries and idempotency allow safe resumption without duplication. GROUND follows a hybrid Active Directory and Exchange path; CREW is cloud-only in Entra ID. The IT dashboard complements identity automation and manages device preparation, delivery, signature and return with explicit feature states.

An HR database procedure returns hires, terminations and fixed-term expiry. n8n normalizes the data, selects the GROUND or CREW branch and writes PostgreSQL queues with explicit pending, done, skipped or error states. Hiring events are imported with a configurable lead time before the start date, allowing account and workstation preparation before the employee’s first day. The disablement phase starts at termination. Duplicate events update the same logical key rather than creating parallel operations.

GROUND — Kerberos-authenticated PowerShell Remoting creates the AD user and Remote Mailbox in the correct OU, sets organizational attributes and account expiry for fixed-term contracts. An idempotent step applies default groups.

CREW — Microsoft Graph creates the user directly in Entra ID after role validation. Flying-staff membership is assigned and verified with retries; other groups may be dynamic.

After success, the corporate address is synchronized back to HR and temporary credentials are delivered through one-time links without dashboard persistence.

A rehire within the configured operational window, in the same branch, reactivates the existing identity. GROUND restores the OU and groups from the snapshot; CREW re-enables the cloud account and attributes.

Phase 1 — at termination, the account is disabled immediately and GROUND group memberships are removed after saving a snapshot. CREW accounts are disabled in Entra ID.

Phase 2 — after an observation period from the termination date, and only after a live-state check, GROUND accounts are moved to the OU dedicated to dismissed identities, while CREW accounts are deleted from Entra ID.

The minimum recovery window covers the period between disablement and final removal, plus Microsoft’s native mailbox recovery period. The GROUND AD object is not automatically deleted.

The Flask dashboard is protected by Entra ID SSO and records the operator on each write. Available: onboarding queue, checklist, PC preparation, GROUND password reset, TAP, delivery/return, signature, PDF, SharePoint archive, returned devices and spare PCs. In development: dynamic conditions, classification of new devices, missing-return notifications and in-app guidance. Planned: rapid reassignment, returned-device reports and assisted technical cleanup with human confirmation. The dashboard complements the lifecycle but is not the source of identity events.

The system checks live state before destructive actions, excludes every reactivated identity from removal and isolates errors per record. TEST_MODE and dry-run use mirror tables, verification recipients and simulations. Evidence includes phase timestamps, group snapshots, HR synchronization results, daily reports and n8n history. Periodic read-only reconciliation compares HR, AD and Entra ID to expose anomalies without forcing actions.

The project was developed within an ISO 27001-certified IT department and was included among the operational evidence assessed during the certification audit. Control value comes from the HR source, privilege separation, explicit states, deferred removal and execution evidence. The dashboard and workflows support audit and asset management without exposing internal operational details on the public site.