Custom account creation (Entra) for 1st/2nd Line
Hi, We're looking for a way to give our 1st/2nd line teams a simple way to create user accounts. They already have the permissions to do so via the Entra/Azure portals, but they sometimes get things wrong and we also want to set some custom attributes…
Hi, We're looking for a way to give our 1st/2nd line teams a simple way to create user accounts. They already have the permissions to do so via the Entra/Azure portals, but they sometimes get things wrong and we also want to set some custom attributes automatically that aren't available in these portals. What we're looking for is a way of giving them a simple form/web page where they can put in the basic details of the user, click 'go' and the rest will be done automatically. A Powershell script could work, but is a bit unfriendly. AI suggests a Microsoft Form, backed by a Power Automate flow, which is (probably) do-able, and I've also considered Powershell Universal (but would involve a lengthy approval and procurement process). Does anyone have any suggestions what else is available before we re-invent the wheel? It would be sooo nice if you could create custom Azure/Intune pages for this sort of thing. Many thanks, Iain
Collected discussion
Are user accounts managed anywhere currently outside of Entra? There's this if you also have an HR system: https://learn.microsoft.com/en-us/entra/identity/app-provisioning/what-is-hr-driven-provisioning
This, i agree with ;)
This ^^^^^100% .. F all of that manual work
Thanks, yeah - that's coming. How quickly it's coming is another matter!
Yep, it's in the pipeline. At the moment we don't have that level of access to our HR system. Long story!
You could go old school - Poweshell script with a GUI frontend. That will give you full flexibility on what they can and cannot do.
I think Forms into PowerAutomate is the way to go. The way mine is set up, it asks all the specific questions so there's nothing missing, then there needs to be approval from both HR and IT teams before an account actually generates so any mistakes are caught. Then a few more things but ah well.
Form > Power Automate flow is trivial to set up and something we've done for a lot of customers. Although, that's more aimed at presenting a UI for non-technical users. The root issue is that your IAM process involves manual account creation in the first place. You should zoom out and try and fix that. Ideally, you just hook into the API of your HRIS, and whenever someone gets hired and HR onboards them, boop, they get provisioned in your systems.
A small front end that calls an approved automation path is usually the right pattern here. For Microsoft 365 / Entra, I would keep the helpdesk-facing part very simple: required fields, manager, department, license/profile type, start date, and any location-specific choices. Behind that, have the automation do the risky bits consistently: UPN generation, duplicate checks, attribute stamping, group assignment, license assignment, mailbox settings, and logging. A few guardrails make a big difference: Use a service principal or managed identity with only the Graph permissions it needs. Put the actual account creation in Azure Automation, an Azure Function, or a controlled PowerShell endpoint, not on someone’s workstation. Validate inputs before calling Graph. Write an audit record with requester, approved template, and created object ID. Use templates for common roles instead of letting 1st/2nd line pick every group manually. Power Apps + Power Automate can work if you already license it, but for tighter control I prefer a minimal internal web form calling an Azure Function / runbook.
Previous org we had a powerapp page which was a gui to create the user, it just created a CSV which I had a script to run a batch job daily on prem. If you're completely in entra you'd be able to skip the last step and create the account instead of the export.
M365 manager for managenegine / ad manager. Make templates
i work for agentui.... we have integration with the entire office 365 suite, you could try that