A new nurse sits through orientation without a working login because IT heard about the hire from a form that arrived late. During the wait described above, the paperwork moved between Human Resources and IT with no way to track it. Look for the lost days in the handoffs before looking inside any one department, and automate the handoff that every later step waits on first: once the HR record, not a form or a ticket, triggers account creation, the paperwork, the account and the day-one access set stop waiting on each other. Below are the three handoffs where the days go, in the order i3solutions recommends taking them, what Microsoft documents for each, and the two cases where that order is wrong.
The paperwork handoff between HR and IT
A signed offer that lives on paper or in an inbox is the first stall: no one can see which signature it is waiting on, so IT cannot plan the account. The fix in this case study was a SharePoint workflow: electronic forms and digital signatures, routed automatically to each approver, with reminders whenever an action sat pending or overdue. Where the forms already live in Microsoft 365, Microsoft documents the same routing pattern in Power Automate; its page “Get started with Power Automate approvals” (last updated April 29, 2026) says: “With the approvals capability in Power Automate, you can automate sign-off requests and combine human decision-making for workflows.” Speed is not the only return from this step. It leaves a complete, signed HR record on a known date, with the status of each signature visible in the workflow tracking, and the next step depends on that record.
The account itself: created from the HR record, not a ticket
When IT creates accounts from tickets, the account waits for the ticket and the ticket waits for someone to notice the hire. The alternative is to let the HR record trigger the account, and Microsoft documents two routes to it. For a cloud HR system, “Plan cloud HR application to Microsoft Entra user provisioning” (last updated July 24, 2025) says: “Microsoft Entra user provisioning service offers integration with cloud-based human resources (HR) applications. Examples of applications include Workday and SuccessFactors.” The same page sets the license: “you require a valid Microsoft Entra ID P1 or P2 license and a license for the cloud HR app, such as Workday or SuccessFactors.” For an HR system outside that list, “API-driven inbound provisioning concepts” (last updated August 20, 2026) says: “With API-driven inbound provisioning, the Microsoft Entra provisioning service now supports integration with any system of record.” The decision rule i3solutions applies: the HR system decides the route, and whichever route it is, the HR record replaces the ticket as the trigger for the account.
Day-one access: what is ready before the first shift
An account with no password, no license and no group memberships still leaves a new clinician waiting on the first day. Microsoft’s “What are lifecycle workflows?” (last updated April 14, 2026) describes the joiner as the point “When an individual enters the scope of needing access” and gives, as an example workflow, “sending a manager an email seven days before the value in the employeeHireDate attribute of new employees”. Its task reference, “Lifecycle Workflows tasks and definitions” (last updated July 29, 2026), lists tasks that include “Generate Temporary Access Pass and send via email to user’s manager”, “Request user access package assignment”, “Assign licenses to user”, “Add user to groups” and “Send onboarding reminder email”, and notes: “The user’s employee hire date is used as the start time for the Temporary Access Pass.” The overview page states: “Using this feature requires Microsoft Entra ID Governance or Microsoft Entra Suite licenses.” For the licensing and audit-evidence side of that decision, see Microsoft Entra ID Governance for Regulated Enterprises: Product Scope, Licensing, and Audit-Defensible Implementation.
When this order is wrong
Two situations reverse it. If hire dates and job codes reach the HR system late or wrong, automating account creation first provisions accounts on bad data, and an account with access no one approved is exactly what an access review is meant to find. In that case the paperwork and data-quality handoff comes first, and the HR record becomes the trigger only once it is right on the day it is entered. And if the delay sits inside one clinical application’s own access process, identity automation alone will not close it: the account can be ready on day one while that application still waits on its own request.