TS-019: Temporary Finance Assistant onboarding and offboarding

Coordinated the onboarding phase of a time-limited Microsoft 365 request through Service Desk triage, least-privilege escalation and administrator-led provisioning, then placed the ticket on hold for controlled offboarding after the placement.

Scenario

Mia Taylor requested temporary Microsoft 365 access for Tom Walker, who was due to provide Finance Assistant holiday cover from 20 July 2026 to 31 July 2026. Tom required a member account, a Microsoft 365 Business Premium licence, an Exchange Online mailbox and Finance read/write access through GG_FIN_RW. No administrative roles were required.

Priority reasoning: Impact was set to 3 - Low because the request affected one temporary employee. Urgency was set to 2 - Medium because the account had to be prepared for the next working day. Under the priority matrix, Low impact plus Medium urgency produced 4 - Low.

ServiceNow Ticket

The request was received by email and assigned to Chloe Bennett in the Service Desk. It was classified as Request / Admin > Onboarding and linked to the Identity & Access Management service, User Provisioning service offering and Microsoft Entra ID configuration item. The description recorded the authorised access and instructed the Service Desk to place the ticket on hold after onboarding so the same record could track scheduled offboarding.

ServiceNow incident INC0010025 classified for temporary Finance Assistant onboarding and offboarding — Figure 1The request was classified, prioritised and assigned to the Service Desk with the temporary access requirements and placement dates documented.

Investigation and Escalation

I first tested the request through Chloe Bennett's delegated Service Desk account. Chloe could view users in Microsoft Entra ID, but the Create new user option was unavailable. This demonstrated that internal user creation remained outside the first-line permission boundary.

Microsoft Entra admin centre showing Chloe Bennett unable to create a new internal user — Figure 2Chloe's Service Desk account could view users but could not create a new internal user, confirming the intended least-privilege boundary.

Chloe documented the permission limitation, recorded the authorised account, licence and Finance-access requirements, and reassigned INC0010025 to Kristian Nietzold for administrator completion.

ServiceNow work note documenting escalation from Chloe Bennett to Kristian Nietzold — Figure 3The Service Desk documented the authorised requirements and reassigned the ticket to the Microsoft 365 administrator.

Provisioning

Using the administrator account, I prepared Tom Walker as an enabled internal member with the sign-in name [email protected]. The profile recorded his Finance Assistant job title, Finance department, temporary employee type, Mia Taylor as manager and United Kingdom usage location. Membership of GG_FIN_RW was selected while the roles field remained empty.

Microsoft Entra review page for Tom Walker before user creation — Figure 4The identity, employment properties, manager, usage location and Finance group assignment were reviewed before creation, with no administrative role assigned.

After the user was created, I assigned Microsoft 365 Business Premium. The licence was shown as active, directly assigned and providing all 53 enabled services.

Tom Walker with an active Microsoft 365 Business Premium licence — Figure 5Microsoft 365 Business Premium was active for Tom Walker with all included services enabled through a direct assignment.

I then verified the post-creation group state. Tom appeared as a direct member of GG_FIN_RW, confirming that the approved Finance read/write access had been applied through group-based access control.

GG_FIN_RW direct members list showing Tom Walker — Figure 6Tom Walker was confirmed as a direct member of the approved Finance security group.

The Exchange admin centre showed that licensing had provisioned a user mailbox for [email protected]. The mailbox was visible in the address list and had Outlook on the web and the standard Exchange client protocols available.

Exchange admin centre showing Tom Walker's provisioned user mailbox — Figure 7The Exchange Online user mailbox was provisioned with the correct address and was available to the organisation.

Service Desk Validation

I recorded the completed administrator actions in ServiceNow and returned the ticket to Chloe Bennett. The hand-back confirmed the enabled account, Business Premium licence, Exchange Online mailbox, Finance group membership and absence of administrative roles.

ServiceNow administrator work note and reassignment back to Chloe Bennett — Figure 8The administrator documented successful provisioning and returned the ticket to the Service Desk.

Chloe reviewed the administrator evidence, confirmed that the account was ready for Tom's start date and recorded that Mia Taylor had been informed. Because Tom had not yet started work, no advance user sign-in was required. The incident was changed from In Progress to On Hold until the final working day on 31 July 2026.

ServiceNow onboarding validation and state change to On Hold for scheduled offboarding — Figure 9The onboarding phase was reviewed by the Service Desk and the ticket was placed on hold until the scheduled offboarding date.

Current Status

Onboarding complete; offboarding pending. The account, licence, mailbox and Finance access are provisioned, and INC0010025 is on hold until 31 July 2026. The ticket will be completed after the authorised access is removed and the offboarding outcome is documented.

Summary

I logged and classified a time-limited onboarding request with clear start and end dates.
I demonstrated the Service Desk permission boundary using Chloe Bennett's delegated account.
I documented the escalation and reassigned the privileged work to the Microsoft 365 administrator.
I created [email protected] as an enabled member with the correct temporary Finance profile.
I assigned Microsoft 365 Business Premium and verified the active service entitlement.
I confirmed direct membership of GG_FIN_RW and successful Exchange Online mailbox provisioning.
I returned the ticket to Chloe for Service Desk review and requester communication.
I placed the incident on hold so the same record can track controlled offboarding on 31 July 2026.