Workplace & access

Microsoft Entra ID

Connect an approved request or employee change to accounts, groups and access in Entra ID. Return the outcome or exception to the service ticket.

From product to process

How to use the integration

Approved account changes

Connect approved requests to supported user and group changes.

Join, move & leave

Use employee changes to coordinate agreed account, equipment and service tasks.

Exceptions → tasks

Route missing information or discrepancies to the team responsible for follow-up.

Combine into one controlled process

Data → rules → execution

Combine
Employee + current access + equipment
Determine & check
Determine desired state; act after approval
Execute & report back
Update accounts and groups · Start equipment tasks · Report execution

Check sources and rules, test changes and track the outcome. Manual tasks get an owner and confirmation.

Build visually. Manage easily.

Reuse building blocks, adapt your process and test the change. Manage it yourself, together with us or let Scope4mation take care of it.

More process examples & technical details

The work between your applications

Change requested.
Who handles the next steps?

Service Automation Suite connects Microsoft Entra ID with your other applications, people and rules. Keep data aligned, work moving and outstanding actions visible.

A change, request or alert

Service Automation Suite

Data, people, assets and relationships on one foundation.

Compare: What exists? What should exist?
Determine what is needed: Matrix · policy · legal requirements
Coordinate the next steps: Checks · tasks · approvals · actions

Execution ↔ feedback

Your people and tools

Microsoft Entra ID

For example. Also with other teams, suppliers and applications.

Verify. Inform. Report.

What is complete? Who needs to act? Which exception needs attention?

Start with one integration, register or check. Build on the same data and rules.

Onboarding

From employee change to a complete start.

Service Automation Suite connects IAM to the wider employee workflow. Use a matrix in Service Automation Suite to relate roles to access, assets and tasks, for example. Combine those rules with current HR and TOPdesk data and agree who maintains the matrix. This determines the changes and actions needed.

Service Automation Suite · Central coordination

Lifecycle matrix, form & exceptions

Combine the data with your policy, risk assessments and checks. Request information or a decision where needed, track actions and record the outcome.

Sources & context

Employee, date & current situation

Execute & report back

Microsoft Entra ID

Microsoft Intune

Activities, accounts, handover & signing

Combine available information
Use the HR change and current person, access and asset data. Forms or reviews supply missing information and exceptions.
Let the matrix define the route
Service Automation Suite applies role profiles, conditions and effective dates. Start or update the TOPdesk change with appropriate activities for HR, IT and facilities.
Execute, confirm and update
Connect account and group actions to asset handover and confirmation. Include ValidSign signing and file storage where needed. Return outcomes to the activities.
Complete the loop with HR
Once the account is created, write agreed account data or status back to AFAS or the chosen HR source. The TOPdesk activity receives the same outcome. HR and IT no longer need to copy or chase confirmation separately.

View the complete employee lifecycle

Connected HR data, Service Automation Suite lifecycle matrix, TOPdesk change and activities, accounts, assets, ValidSign, file storage and feedback.

Role change

A different role. An appropriate new setup.

Service Automation Suite · Central coordination

Lifecycle matrix, form & exceptions

Combine the data with your policy, risk assessments and checks. Request information or a decision where needed, track actions and record the outcome.

Sources & context

Employee, date & current situation

Execute & report back

Microsoft Entra ID

Change, activities, accounts & assets

Combine available information
Use the HR change and current person, access and asset data. Forms or reviews supply missing information and exceptions.
Let the matrix define the route
Service Automation Suite applies role profiles, conditions and effective dates. Start or update the TOPdesk change with appropriate activities for HR, IT and facilities.
Execute, confirm and update
Connect account and group actions to asset handover and confirmation. Include ValidSign signing and file storage where needed. Return outcomes to the activities.
Complete the loop with HR
Return confirmed changes or revocations to TOPdesk activities and, where agreed, the HR source. Employee records, execution and follow-up stay aligned.

Offboarding

Departure known. Access and assets follow through.

Service Automation Suite · Central coordination

Lifecycle matrix, form & exceptions

Combine the data with your policy, risk assessments and checks. Request information or a decision where needed, track actions and record the outcome.

Sources & context

Employee, date & current situation

Execute & report back

Microsoft Entra ID

Change, activities, accounts & assets

Combine available information
Use the HR change and current person, access and asset data. Forms or reviews supply missing information and exceptions.
Let the matrix define the route
Service Automation Suite applies role profiles, conditions and effective dates. Start or update the TOPdesk change with appropriate activities for HR, IT and facilities.
Revoke, recover and complete
Connect revocation of access and groups to asset returns. Update relationships and records, keeping open activities visible until their outcome is known.
Complete the loop with HR
Return confirmed changes or revocations to TOPdesk activities and, where agreed, the HR source. Employee records, execution and follow-up stay aligned.

IAM & auditability

From access decision to demonstrable execution.

A closed ticket does not explain why access was granted or what actually happened. Connect the IAM decision to approval, TOPdesk activities and outcomes from the systems involved. Support auditability and accountability, including within BIO2.

Service Automation Suite · Central coordination

Applied rules, actions & exceptions

Combine the data with your policy, risk assessments and checks. Request information or a decision where needed, track actions and record the outcome.

Decision & context

Person, request, reason & approval

Demonstrate execution

Microsoft Entra ID

Activities, outcome & follow-up

Record the decision with the request
Connect the person, reason and required approval to the requested access or assets.
Connect activities to actual outcomes
Return system actions and manual confirmations to the TOPdesk change and activities. A sent command does not prove successful execution.
Keep exceptions actionable
Show what was executed, what differs and who must act. This supports controls and reviews; compliance also requires appropriate policies and operations.

Align access

A TOPdesk request. Access follows under control.

Connect an approved request or employee change to accounts, groups and access in Entra ID. Return the outcome or exception to the service ticket.

Service Automation Suite · Central coordination

Combine data and apply rules

Combine the data with your policy, risk assessments and checks. Request information or a decision where needed, track actions and record the outcome.

Information & trigger

Microsoft Entra ID

Relevant data or workflow status

Follow-up & feedback

Update, execute and record outcomes

Connect people and sources
Choose the authoritative existing record, for example in HR or TOPdesk, and use Service Automation Suite to connect it to the right Microsoft Entra user and groups.
Grant or revoke access
Service Automation Suite can map approved changes to accounts and group memberships through Microsoft Graph. Security controls remain part of your configuration.
Maintain relationships and outcomes
Have Service Automation Suite update agreed person and asset relationships, for example in TOPdesk, and return the result or error to the original request.

Employee lifecycle

One employee change. The right next steps.

Connect onboarding, role changes and departures to access, assets and service tasks. HR remains the source; each team receives its own follow-up.

Service Automation Suite · Central coordination

Combine data and apply rules

Combine the data with your policy, risk assessments and checks. Request information or a decision where needed, track actions and record the outcome.

Information & trigger

Microsoft Entra ID

Relevant data or workflow status

Follow-up & feedback

Update, execute and record outcomes

Identify the event
Use the relevant employee, role and effective date from the agreed source.
Coordinate the follow-up
Connect approvals, accounts, handovers and manual tasks to the same employee workflow.
Track the outcome
Show what is complete and what still needs attention, including role changes and departures.

Coordinate actions

Turn a decision into completed work.

Connect a request or discrepancy to a workable process. Let people decide where needed and systems execute the agreed actions.

Service Automation Suite · Central coordination

Combine data and apply rules

Combine the data with your policy, risk assessments and checks. Request information or a decision where needed, track actions and record the outcome.

Information & trigger

Microsoft Entra ID

Relevant data or workflow status

Follow-up & feedback

Update, execute and record outcomes

Define the starting point
Choose the request, change or discrepancy that needs follow-up and who decides.
Connect people and systems
Coordinate approvals, manual tasks and available system actions.
Record the result
Record which steps are complete and where someone still needs to act.

Under the hood

How to connect, test and manage the integration.

For administrators who want to understand how it works: connect Microsoft Entra ID to your other applications, map the data and use the response in the next step. Configure it centrally in Service Automation Suite.

Example configuration · shaped by your process

Execute and verify an account or group action

Connect and test
API Composer
Choose the API method, URL and authentication. Manage the host and credentials in an environment. Test a request in Discovery and inspect the fields actually returned by the API.
Combine and compare
Data Flow Composer
Select fields, translate codes and relate records using shared data. Compare source and target to identify new, changed or incomplete records.
Execute and use the response
API Composer
Build the request body from validated data and inspect Body Preview before testing. Use the result ID in Data Context for the next request or save output to an entity. Configure write-back separately.
Recognise errors and follow up deliberately
API Composer
Configure error rules by HTTP code and/or message. A temporary API failure can use bounded retries. A missing relationship or rejection needs another route: record the cause and configure a verification task for the appropriate team, for example.

Which data do you maintain?

An example configuration, not fixed field names or a mandatory combination.

Person reference and account ID: Connect the source person to the correct account using verified identifiers.
Approved role and desired groups: Compare the agreed matrix with available account data and configure additions and revocations separately.
Account action result: Use the API response and configured follow-up check to report back to HR or TOPdesk, for example.

Sent ≠ processed. Use the response and agreed validation to determine the next step.

Need to publish data yourself?

Use Endpoint Composer to publish a configured Service Automation Suite data object. Choose read and write methods and security profiles so a customer can retrieve agreed service data or a supplier can submit information, for example. Configure data selection and subsequent processing separately.

Endpoint Composer

From data to a complete process?

Combine the integration with a form, a shared matrix, a review or collaboration between service teams. For example, an approved request leads to execution in Microsoft Entra, a ValidSign signature request and feedback in TOPdesk. Your process determines the steps needed; not every use case requires all these components.

Explore the connected building blocks

Beyond the first integration.

Use the same data and rules in your next process.

Start with one use case. Connect customer, employee and asset data, for example, and agree which source is authoritative. Reuse those relationships, a matrix where needed and configured actions in the next workflow. Agree who maintains the data and rules. Expand without repeatedly connecting and maintaining the same information.

Signature declined. Keep the process moving.

A request awaits a ValidSign signature. Declining, expiry and technical failure each need different handling.

Combine: Link the request, signing request and document. Read the available status and apply agreed conditions to determine the next action.
The outcome determines what follows: Signed: process the document and confirm the activity. Declined: route the reason to the owner. Temporary technical failure: retry only under the configured error rule.
The benefit: Appropriate follow-up for each outcome without counting a sent signing request as completed work.

A replacement laptop without losing context.

An employee receives a replacement device. The old asset, new record and open service or security tickets must remain connected.

Combine: Use the central relationship between owner and device identifiers. Combine handover, technical inventory and return with existing tickets.
The outcome determines what follows: Receipt confirmed: update ownership and relationships. Old device missing or uncertain match: start a targeted review instead of overwriting historical records.
The benefit: Current records and a traceable handover even when a management tool uses different names.

Temporary access, with the end handled too.

Additional access is approved for a limited period. A checkbox alone does not preserve why, for whom and until when.

Combine: Connect identity, approval, expiry date and the available access action. Reuse the same data for a scheduled follow-up check.
The outcome determines what follows: Revocation confirmed: record the result. Extension requested: ask for a new decision. Not revoked: raise the exception with the authorised group rather than silently completing it.
The benefit: Fewer forgotten exceptions and a traceable relationship between approval and actual access.

Your process needs more than a standard action?

Configure the missing API request, input and output in API Composer. Use its response in the next step and combine it with data tables, forms and automations. Extend the same product and reuse the configured building blocks.

Use Service Automation Suite to update a ticket in TOPdesk, for example, with fields available through its API, such as category, priority, status and support group. For another application, configure its request and field mapping. The outcome determines the next action: confirm, add information or request review, not merely check whether the request arrived.

Build it yourself: explore the technical approach

Need to publish data or let others submit it? Endpoint Composer exposes a configured Service Automation Suite data object with selected methods and security profiles. Other building blocks handle subsequent processing.

From product to workflow