Skip to main content
User Onboarding creates a new starter’s Microsoft 365 account from a form. Set it up once on Base config, then per client once you’ve added your clients. Connect Microsoft 365 first, and your PSA if you want tickets.

Your first new starter: set up User Onboarding, run it for a client and follow it in Executions (1:25).

Set up User Onboarding

1

Open it

Go to Config and click User Onboarding. It starts as Internal only; to offer it to clients, see Share your forms.
The Config page with a Search workflows box, All, Lifecycle, Accounts & Access, Mailboxes and Groups filters, and Lifecycle cards for User Onboarding, User Offboarding and Re-enable Terminated Account, each marked Active.
2

Set the questions

On Form config, set each optional field to Hidden, Optional or Required. Add field and Add section add your own questions.
The Form config tab on Base config, with First name, Last name and Work email (UPN) set to Always on, Job title, Department and Reporting manager set to Optional, Start date set to Required, and Add field and Add section buttons.
3

Set what it does

On Execution config, choose the Username format, Domain and Usage location, and who approves under Approval (see Approvals). Tick Wait until close to the start date to create the account shortly before the start date instead of at approval.
The Execution config tab on Base config, showing the Email & username card with Username format first.last, Domain set to Primary domain and Usage location United States (US), and the Approval card with None, Internal and External.
4

Create a ticket for each run

Under Ticketing, turn on Create a PSA ticket for each run and pick the ticket type, priority and status (plus the board or queue for ConnectWise PSA and Autotask). Halo PSA rejects a ticket with a required field blank, so set those under Ticket fields.
The Ticketing card with Create a PSA ticket for each run turned on, Ticket type New Starter, Priority Medium, Status New, a Subject template, Ticket body set to From form, Ticket fields showing Required & unset: Impact, Urgency with an Add rows button, Custom fields, and Log actions to the ticket ticked with Note visibility Internal note.
5

Deliver the password

Under Credential delivery, choose Secure link (PwPush) or Plain text. An Anonymous link uses pwpush.com unless you’ve connected your own Password Pusher; Org’s PwPush account needs it connected with an API token. Tick Email the credential to send it to the submitter; a public requester is never emailed a plain-text password.
The Credential delivery card with Format set to Secure link (PwPush), Anonymous selected, expiry after 7 days or 5 views, and Email the credential and Log the credential to the ticket checkboxes.
6

Save

Click Save changes. One save covers Base config and every client you changed, and ticks the step off on Home.

Settings for each client

Base config is the default every client gets. To change something for one client, choose that client in the scope dropdown next to the tabs.

How configuration works: Base config, inheriting, and overriding a card for one client (1:26).

  • Inheriting default: the card follows Base config, including later changes to it.
  • Override: gives the client its own copy of the card. From then on, changes to Base config don’t reach that card for that client. Reset deletes the copy when you save, and the client follows Base config again.
  • These cards can be overridden: Email & username, Approval, Ticketing, User directory filters, Start date scheduling and Credential delivery. Availability and List on homepage are set on Base config; the API can also set availability for one client.
  • On Form config, a client can set each field to Hidden, Optional or Required, show or hide a section, and set its own options for a dropdown with a manual list. Add client section adds questions only that client is asked. Always on fields can’t change.
  • One Save changes saves Base config and every client you changed. Other clients aren’t touched.

Change the form for one client: a field made required and a question only Acme Corp is asked (1:22).

Preview form shows Base config only. To check a client’s form, open Run a workflow for that client.
The scope dropdown on Execution config open, listing Base config, then Acme Corp and Initech marked Approval overridden, Globex, Umbrella Industries, Stark Industries and Wayne Enterprises.
Some cards are client-specific: each client sets its own on the Config page.

Settings for one client: base access, a conditional rule and an override for Acme Corp (1:20).

  • Base access: the licences, groups and shared mailboxes every starter gets. Without licences, accounts are created unlicensed. The assistant’s setup (or the API) can also set default licences and groups for all clients: a client whose Base access is empty gets them, and anything you add on its card replaces them.
  • Conditional rules: extra access when the form’s answers match. Click Add rule, choose a field and a value, then add groups, mailboxes or licences under Then grant. A rule’s licences can add to or replace the base licences, and its mailboxes are granted with full access. On a synced client, Create in picks where a matching request’s account is created: Client default, Entra only or On-prem AD + sync. For example, Custom username is Yes → Entra only keeps typed usernames cloud-only; generated ones keep the client default. A rule every new starter matches, set to Entra only, is how a client migrating to Entra goes cloud-first.
  • On-premises AD: Create users in OU for synced clients, through the desktop agent.
  • Distributor licenses: see Licences and distributors.
The Base access card for Acme Corp with a Microsoft 365 Business licence, the groups All Staff, VPN Users, Microsoft 365 Users and Acme VIP, and three shared mailboxes with Member, Send as and Full access.
For External approval, set each client’s approver on its Approval card; a run for a client without one is blocked at submit. Other workflows on Config use the same page, showing only the cards that apply.

Test it for a client

Click Test for a client, choose a client and click Run test. It checks what a run needs for that client, using your saved settings, without creating or changing anything: Each problem links to the page that fixes it. Test again until it says Ready. Core runs the same checks for every client each night, shortly after you save a workflow, and when you click Recheck. Home shows the result, User Onboarding is ready for N of M clients, with what’s stopping the rest grouped by cause, so one fix often clears several clients. Click Ask the assistant to fix these to work through them in chat.

Troubleshooting

Set the client’s primary domain on Clients, or choose Show options on form under Domain.
Set Default PSA in Settings > General, then reopen the workflow. See Connect your PSA.
No account was created. Free or buy a seat in the client’s tenant, or turn on auto-buy, then submit again.
Update the client’s licences under Base access and Conditional rules.
The link is set to Org’s PwPush account. Connect Password Pusher with an API token, or choose Anonymous.
Choose Secure link (PwPush), or add an Always send to address under Email the credential.
Next: Add your clients.