MSPs can automate user onboarding and offboarding inside their PSA, whether that's ConnectWise Manage, Autotask, or HaloPSA. This guide covers the four-step onboarding process (structured intake through Pia SmartForms, classification by AI Triage, automated provisioning with PiaPacks, and directory sync across Microsoft Entra ID and Active Directory), the four-step offboarding process (scheduled intake, access revocation, license and data handling, and a documented audit trail), and how versioned pre-built automations compare with homegrown PowerShell scripts.
You already know onboarding and offboarding tickets are repetitive. What's less obvious is how good a first automation candidate they are.
No two clients onboard exactly the same way. But every onboard has the same core sitting underneath it: create the account, assign a license, build the mailbox, set group membership, sync the directory. What changes from client to client is everything around that core. The line of business apps, the hardware, the access that only makes sense at one site.
That core is the part you automate. For your more straightforward clients it covers the whole onboard. For the complicated ones it covers most of it, and the technician picks up a far smaller job than they had before. Either way it's the same automation doing the work, which is why lifecycle management is usually where MSPs get their first real automation win rather than their first automation headache.
Here's how to do it inside your PSA.
Most PSA macros still need a technician to open the ticket and kick the process off. That's fewer keystrokes and the same amount of work.
What you want is a platform that can take a request from intake to resolution on its own where that's safe, and stop for a person where it isn't. Whether your service desk runs on ConnectWise Manage, Autotask, or HaloPSA, the goal is the same: the process runs the same way every time, regardless of who is on the board.
Getting to a hands-off onboarding workflow means connecting your ticketing system to the rest of your stack. Pia, a service delivery automation platform built for MSPs, does this by working inside your PSA rather than beside it.
Here are the four steps Pia takes to resolve an onboarding ticket from start to finish.
Pia SmartForms let your client supply the details up front: the new user's name, department, manager, license type, and application access.
Fields pull live data from the client's own tenant, so the options presented are real groups and real license availability rather than a list someone maintained by hand six months ago. Inputs are validated as they're entered, which means the request arrives complete instead of arriving and then generating three emails.
Where your client submits it is your choice. SmartForms runs as a white-labeled portal, embeds directly in Microsoft Teams, or plugs into a tool like CloudRadial. If you want your clients to have a full conversational service desk, Pia Chat gives them one inside Teams, with SmartForms living inside it. A request that starts as a message still arrives as the same structured, validated submission. Whichever surface your client uses, the automation behind it runs the same way.
As tickets arrive in ConnectWise, Autotask, or HaloPSA, Pia's AI Triage reads the request, classifies it as an onboarding task, stamps the priority, and applies your dispatch rules to get it to the right board and team.
Processing delays are built in deliberately, so Pia doesn't collide with your PSA or another tool making changes to the same ticket at the same moment.
Once the ticket is classified, Pia runs the matching automation. Pre-built automations are packaged as PiaPacks: creating the account, assigning Microsoft 365 or Google Workspace licenses, building the mailbox, and adding group memberships.
You decide how much of that runs unattended. Each automation can be set to zero touch, where Pia completes the request without a technician touching it, or to require approval, where a named technician signs off before anything is written to the client environment. The setting is per automation and per client, so a license assignment can run on its own while a privileged group membership waits for a person.
Pia syncs the new account across the client directory, whether that's Microsoft Entra ID (still widely known as Azure AD), on-premises Active Directory, or a hybrid of both, and applies the group permissions that carry the user's actual access.
When the work completes, Pia resolves the ticket inside your PSA and updates the client.
Offboarding carries more risk than onboarding, because the failure is silent. A missed step on a manual onboard produces a complaint by lunchtime. A missed step on a manual offboard produces a former employee with a live login that nobody finds until an audit, or until something worse happens first.
Offboarding follows the same path as onboarding: structured intake, triage, automated execution, ticket resolution. What changes is the order of operations and, often, the timing.
An offboarding request arrives through the same channels as anything else: a SmartForms submission, an email that AI AutoReply redirects to the right form, or a ticket raised by your own team. Triage classifies and routes it exactly as it does an onboard.
Offboards are usually known days in advance, which is where Schedule for Later earns its place. Rather than holding the ticket in someone's head until Friday afternoon, you set the departure date and Pia pauses the automation until then, resuming at the date and time you specified. How the scheduled work relates back to the original ticket is a setting you control. The termination that was going to get forgotten runs on the day it should.
On execution, Pia signs the user out of active sessions, resets the account password, and blocks sign-in across the client environment, so any session or credential already in play stops being useful.
PiaPacks handle the background work that usually gets deferred: converting the departing employee's mailbox to a shared mailbox, delegating archive access to HR or the user's manager, and releasing software licenses so your client stops paying for a seat nobody occupies.
Pia writes account changes, group membership changes, and password resets to the ticket in ConnectWise, Autotask, or HaloPSA as they happen, giving you a clear record of what was done, in what order, and by which automation.
For Tech Assist automations, audit notes are on by default and you control how much detail gets written. Passwords are never shown in plain text unless you deliberately switch that on. For Pia Chat, audit notes are opt-in, so you decide whether the conversation is written back to the ticket at all.
Plenty of MSPs have already automated onboarding with their own PowerShell. It usually works, right up until the person who wrote it leaves, or a vendor changes an API and nobody notices for two weeks.
The problem is ownership. There's no version history, no test, no notification when the thing they depend on changes, and no obvious way to roll back when an update breaks a client at 4pm.
Custom code still has a place on Pia. PiaPacks are maintained and versioned by us, so when one is updated you get a notification, release notes with a side-by-side comparison, and the choice to apply it when you're ready or roll it back if it misbehaves. When you need something that doesn't exist yet, you can build it with Pia's automation editor, the Pia API, or Pia Source in VS Code, and it runs on the same platform with the same logging and the same approval controls as everything else.
Pia also works inside the tools your service desk already uses:
Pia is a service delivery automation platform built by MSPs, for MSPs, and it exists to automate the workflows that eat your service desk.
With AI Triage and 100+ pre-built automations designed for the realities and edge cases of real service desks, Pia helps MSP teams close more tickets, manage more endpoints, and deliver more consistent client experiences.
See what that looks like on a real desk: Rarity Solutions took ticket resolution from 75 minutes to 8. Read the case study, or estimate the impact on your own service desk.
Book a 30-minute discovery call to talk through automating onboardings, offboardings, and a great deal more.
Yes. Pia integrates natively with all three using APIs and in-ticket overlays. That lets Pia read incoming tickets for intent, provision accounts in Microsoft 365 or Google Workspace, sync directory and group access, and resolve the ticket without a technician stopping what they're doing.
Manual offboards are prone to human error, and the error is usually invisible until someone audits it. Automated offboarding runs the same revocation sequence every time: active sessions ended, password reset, sign-in blocked, licenses released, with each step written back to the ticket as it completes.
PiaPacks are pre-built, out-of-the-box automation workflows designed specifically for MSP service desks, covering repetitive tasks like user creation, license optimization, and mailbox delegation. They're maintained and versioned by Pia, and because Pia has a native integration layer they execute the same way whether your service desk runs on ConnectWise Manage, Autotask, or HaloPSA.
Automated workflows need structured data to run smoothly. To stop technicians having to chase incomplete client emails, MSPs use tools like Pia SmartForms or Pia Chat at the client intake level, so the client supplies exact parameters such as legal names, departments, and specific app access at the point they make the request.
Yes, for onboarding. Google Workspace user creation runs as a Tech Assist automation and as an extension to the standard Staff Onboarding automation, and is available for cloud, cloud hybrid, and semi-hybrid clients. See the configuration guide.
Yes. Every automation can be configured for zero touch or for approval, set per automation and per client. Approval requests go to named users, user groups, or roles, and escalate if nobody responds, so nothing sits waiting indefinitely on one person.