Every new employee needs the right system access, but when someone leaves, that access must be removed. We built a Gen AI-based employee onboarding and offboarding platform for LS Technologies to automate this process. It connects Jira with Microsoft 365 to manage employee requests, create or disable accounts, update access, and send email notifications.
Using GoML’s proprietary AI Matic platform, LS Technologies implemented an AI-driven system for managing employee onboarding and offboarding. Amazon Bedrock processes JIRA tickets to identify requests, while AWS Step Functions coordinates the required tasks. The solution handles Microsoft 365 account setup, permission changes, and account deactivation across five tenants, supporting access management for LS Technologies’ five legal entities.
The challenges in employee onboarding and offboarding
Employee onboarding and offboarding involve multiple IT tasks that must be completed in the correct order. For LS Technologies, managing these processes across five separate Microsoft 365 tenants created several challenges:
- Manual IT processes: Creating accounts, assigning licenses, configuring application access, and removing permissions required multiple steps across different systems.
- Request tracking and coordination: Monitoring progress, identifying incomplete tasks, and ensuring each step was completed correctly requires additional effort from IT support teams.
- Multi-tenant access management: Each of LS Technologies’ five legal entities have its own Microsoft 365 tenant, requiring the IT team to identify the correct environment and apply the appropriate access settings.
- Delays due to missing information: Incomplete employee details, unavailable licenses, and unclear access requirements slowed processing and increased communication between IT support and other teams.
- Exceptions requiring human review: Possible rehires, existing account conflicts, and unavailable resources prevented some requests from being processed automatically, requiring additional checks before the workflow could continue.
How GoML automated onboarding and offboarding across five Microsoft 365 tenants
GoML built an automated workflow connecting JIRA with Microsoft 365 to process employee onboarding and offboarding requests. The system identifies the request type, extracts employee details, and applies predefined rules to manage account and access changes.
Amazon Bedrock and a Strands agent interpret JIRA tickets and retrieve the information needed to process each request. The system classifies tickets such as onboarding, offboarding, or unknown requests and extracts details such as the employee’s name, email, department, manager, dates, and requested applications. Amazon Bedrock AgentCore Gateway connects the agent to JIRA through MCP tools, while Python code handles account operations and access checks based on defined rules. Requests with unclear details or missing information are flagged for human review.
For onboarding, the system creates a Microsoft 365 account, assigns an available license, and configures access to the required security groups, Microsoft Teams, SharePoint, OneDrive, and supported business applications. Access is based on the request details and the relevant entity settings.
For offboarding, the workflow disables the employee’s account and removes supported licenses, group memberships, collaboration access, and enterprise application roles. The account is retained rather than permanently deleted, preserving its record while blocking access.
LS Technologies has five legal entities, each with its own Microsoft 365 tenant. The system uses the employee’s email domain to identify the relevant entity and connects to the appropriate tenant through separate Microsoft Graph credentials. Before making account or access changes, it checks license availability, group configurations, and application access requirements to identify resources or requests that need further review. This shared workflow supports access management across all five entities while keeping their tenant connections and settings separate.
Amazon DynamoDB stores request details and status updates as the workflow progresses, helping track completed steps and identify issues. The system also updates JIRA tickets with the latest status, giving IT support teams visibility into request progress and outstanding tasks.
Handling exceptions with human review and email notifications
Some onboarding and offboarding requests require additional checks before they can be processed. Missing employee information, unavailable licenses, unsupported access requirements, account conflicts, or possible rehires can prevent automatic completion. In these cases, the platform pauses the workflow and flags the request for human review.
The support team receives an email describing the issue and the steps needed to resolve it. After the JIRA ticket is updated and marked as resolved, the workflow can recheck the request and resume processing where possible, without requiring the entire process to start again.
Amazon Simple Email Service (SES) manages notifications such as welcome emails, offboarding confirmations, review requests, and system error alerts. The platform tracks sent notifications to reduce duplicate emails when a workflow retries after an error.
This review process helps prevent incorrect account changes and incomplete access removal, reducing potential security risks during employee transitions.
The AWS infrastructure and DevOps solution delivered by GoML
GoML built the platform using AWS services, infrastructure as code, and automated deployment practices to support reliable operations, secure integrations, and easier maintenance. The delivery covered the following areas:
- AWS architecture and monitoring: AWS Step Functions coordinates workflows, Amazon DynamoDB stores request details and status updates, and AWS Lambda handles notifications. Amazon EventBridge Scheduler triggers workflows at set intervals, Microsoft Graph manages employee accounts and access, and Amazon CloudWatch monitors errors and performance.
- Infrastructure as code: AWS CDK v2 in TypeScript defines the infrastructure across five modular stacks covering Amazon ECR container images, the AgentCore Gateway, DynamoDB tables, the AgentCore runtime, and the Step Functions workflow. This allows components to be deployed and updated independently while maintaining consistent configurations across environments.
- CI/CD pipeline: GitLab CI/CD automates code testing, builds, and deployments. Changes to the agent, access rules, and infrastructure follow the same pipeline before reaching production, reducing manual deployment steps and configuration errors.
- Security and credential management: AWS Secrets Manager stores JIRA credentials and credentials for each Microsoft 365 tenant. Fine-grained IAM permissions control access to secrets at runtime, while AWS KMS encrypts DynamoDB tables using a customer-managed key. TLS protects connections to external services, including Microsoft Graph and JIRA.
- Scalability and resilience: Serverless services support changing workloads, with AWS Lambda scaling automatically based on request volume and DynamoDB using on-demand capacity to handle fluctuations in onboarding activity. Continuous point-in-time recovery protects DynamoDB data. Step Functions retries failed API calls with increasing wait times and routes requests for human review through JIRA if retries fail.
- Testing and parallel run: Before launch, the team tested end-to-end workflows across connected systems, including edge cases, escalation paths, and individual and batch onboarding requests. The platform also ran alongside the existing vendor process, so the team could compare accuracy, turnaround time, and failure rates before transitioning workflows in stages.
- Documentation and handover: The nine-week delivery included architecture and integration documentation, a user guide for monitoring the agent, and support of runbooks covering common issues and escalation procedures.
AI-powered employee onboarding and offboarding outcomes
- Up to 70% less manual work
- 50% faster request processing
- Centralized access management across five tenants
- 60% less time spent tracking requests
How GoML streamlined IT onboarding and offboarding for LS Technologies
GoML used its proprietary AI Matic platform to simplify the development of LS Technologies’ IT onboarding and offboarding systems. Building these workflows from scratch can require significant effort to connect ticketing systems, automate account operations, manage access permissions, and handle exceptions securely.
AI Matic helped bring these components together with Amazon Bedrock for interpreting JIRA requests and AWS Step Functions for coordinating workflows. The solution also supports five separate Microsoft 365 tenants, allowing LS Technologies to manage employee access across its five legal entities.
With automated account provisioning, access updates, offboarding, and human review for exceptions, the system reduces the need for manual intervention in routine IT tasks.
Explore more production-grade AI solutions in our AI case studies, or connect with our team to discuss your enterprise AI requirements.
