User Onboarding

User Onboarding creates a new starter’s account in the client’s tenant, assigns licences, adds them to groups, grants shared mailbox access and sends them a welcome email. Use it for every new starter. It needs Microsoft 365 connected, and the desktop agent for a client that syncs on-premises Active Directory. For the full set-up, see Configure User Onboarding.

User Onboarding in 49 seconds: what it asks, what it does and what you get.

What the form asks

Field
First name, Last name	Required, always on
Work email (UPN)	Required, always on. Generated from the name in your username format, or typed in when the format is Custom
Job title, Department	Optional by default. Set on the new account
Start date	Required by default. Used by Start date scheduling
Reporting manager	Optional by default. Sets the account’s manager
Domain	Only when Domain is set to Show options on form
Who should receive the password?	Only when Email the credential is on: Me, or Me and someone else

What it does

Creates a ticket in your PSA, if Ticketing is on.
Waits for approval, if Approval is Internal or External.
Waits until close to the start date, if Start date scheduling is on.
Create User: creates the account with a temporary password that must be changed at first sign-in. For a client that syncs on-premises AD, the account is created in AD and synced to Microsoft 365.
Assign Licenses, after buying a seat at your distributor if auto-buy is on and none is free.
Add To Group, for each group.
Grant Mailbox, for each shared mailbox: full access, then send as.
Sends the temporary password, if Credential delivery emails it or logs it to the ticket.
Send Welcome Email, to the new account.

With Log actions to the ticket on, each action also adds a note to the ticket.

Configure it

Go to Config and click User Onboarding.

Configure User Onboarding: every option, step by step (1:29).

Setting	Where	What it does
Availability	Header	Internal only, Public form only, Internal + public or Disabled. List on homepage needs a public form. Base config only
Standard fields	Form config	Set Job title, Department, Start date and Reporting manager to Hidden, Optional or Required. Can differ per client
Add field, Add section	Form config	Your own questions. They’re saved with the request and can go in ticket templates, but aren’t sent to Microsoft. Add client section asks one client only
Username format	Email & username	first.last, flast, firstlast, first_last, f.last, first.l, last.first, first, or Custom (typed on the form and checked against the client’s users, aliases and groups)
Domain	Email & username	Primary domain uses the client’s primary domain from Clients. Show options on form adds a Domain picker; at a client’s scope you can set its default and hide domains
Usage location	Email & username	The country set on every new user, which Microsoft needs before it assigns a licence. Defaults to United States (US)
Approval	Approval	None runs on submit. Internal waits for a teammate or group; External waits for the client’s approver, set on each client. Conditional overrides use a different approval when the answers match
Ticketing	Ticketing	Create a PSA ticket for each run, with its type, priority, status, subject and body. Log actions to the ticket adds an internal or public note as each action completes
User directory filters	User directory filters	Which users the Reporting manager picker offers: licensed, active, no guests, and not in the Entra roles you exclude. Exclude specific users at a client’s scope
Start date scheduling	Start date scheduling	Wait until close to the start date holds the account until the number of days you set before the start date (0 is on the day). The ticket is still raised straight away
Credential delivery	Credential delivery	A temporary password is always generated and shown once to the technician. Send it as a Secure link (PwPush) or Plain text, by email (the submitter, anyone they add and Always send to) or as a ticket note
On-premises AD	A synced client	Create users in OU, Default AD groups and Default AD properties for accounts created in AD
Base access	A client	The licences, groups and shared mailboxes every new starter gets. Send as grants send-as rights; Full access and Member grant full access
Conditional rules	A client	Extra groups, mailboxes and licences when the form’s answers match. A rule’s licences add to or replace the base licences
Distributor licenses	A client	Maps each licence to your distributor subscription. With Auto-buy seats on, buys a seat when none is free. See Licences and distributors

Email & username, Approval, Ticketing, User directory filters, Start date scheduling and Credential delivery are set on Base config and apply to every client unless you override them for one. For how Base config and client overrides work, see How configuration works.

Troubleshooting

“Work email: … is already in use. Choose another.”

Someone in the client’s tenant already has that sign-in name, alias or group address. Pick another address under Work email (UPN).

“No primary domain is set for …, so the work email can't be generated”

Set the client’s primary domain on Clients, or choose Show options on form under Domain.

Get started

Use Core

Workflows

Manage Core

Reference

What the form asks

What it does

Configure it

Troubleshooting

​What the form asks

​What it does

​Configure it

​Troubleshooting

​Related

What the form asks

What it does

Configure it

Troubleshooting

Related