Zendesk Onboarding Ticket Provisioning

Overview

This flow turns onboarding-type Zendesk tickets into automated, role-based account provisioning. When a new ticket is created and carries the configured onboarding tag, the flow creates a Microsoft Entra ID account, grants the role's group memberships and license, writes an audit record to Dataverse, updates the Zendesk ticket, posts a public comment to notify the requester, and posts progress to a Teams channel.

Why it matters: Manual onboarding is slow and inconsistent. Driving it from the ticket speeds time-to-productivity and leaves a complete audit trail keyed by a correlation id.

Status: Built via API-first deployment (workflow-table path). Ships Off — going live requires only connection authorization and environment-variable configuration.

Use Case

IT receives onboarding requests through Zendesk and wants standardized accounts provisioned automatically, with every run recorded for audit and the requester kept informed on the ticket.

Flow Architecture

Environment Variables

Connectors & Connections

Connector	API name	Actions used
Zendesk	shared_zendesk	GetOnNewItemsV2 PatchItem
Microsoft Entra ID	shared_azuread	CreateUser AddUserToGroup
Microsoft Teams	shared_teams	PostMessageToConversation
Microsoft Dataverse	shared_commondataserviceforapps

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

Map real ticket data

Replace the demo subject-parsing and default-role logic with the onboarding ticket's custom fields (new hire name, role, department) once the Zendesk form schema is known.

Approval gate

Add an Approvals StartAndWaitForAnApproval before Create_User for manager sign-off.

Hardware / assets

Branch to an asset-request action after provisioning.

Offboarding twin

Build a reverse flow that disables the account and removes group/license on departure.

Role map

Extend flowlibs_RoleGroupMap with more roles, each listing its Entra group ids and license SKU id.

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

@contains(toLower(string(coalesce(triggerOutputs()?['body/tags'],''))), toLower(variables('varOnboardTag')))

@json(variables('varRoleGroupMap'))?[variables('varRole')]

@coalesce(variables('varRoleConfig')?['groups'], createArray())

@{concat(variables('varMailNickname'),'@',parameters('EnvVar_NewUserDomain'))}

{ "addLicenses":[{ "disabledPlans":[], "skuId": "@variables('varRoleConfig')?['licenseSkuId']" }], "removeLicenses":[] }

@outputs('Create_User')?['body/id']

Customize & download