Surya Endpoint / Joiner · Mover · Leaver

People ready on day one. Access right through their last.

Microsoft-native identity and device lifecycle, connected to your HR and service desk systems.

Keep your JML logic when your service desk changes.

A defined Surya Endpoint implementation: your HR platform stays the source of employment truth, Microsoft Entra and Intune do the identity and device work, your chosen service desk carries the tasks and evidence, and the Surya RTP Distribution Center prepares the laptop. Optional ongoing operation is scoped separately.

  • Joiners

    Account, access and a prepared laptop from the approved HR record, ready for the start date.

  • Movers

    Old access removed and new approved access added, so permissions follow the role.

  • Leavers

    Access disabled on the authoritative HR event, devices recovered and evidence recorded.

Map your JML workflow Explore the workflow

/ 01 The lifecycle

Three events. One rule set. Evidence every time.

Choose a scenario to see how an HR event becomes identity, access, device and service desk work.

Illustrative workflow - no live connections

Trigger: An approved hire with an effective start date in your HR platform.

  1. 01 · HR source

    Approved hire

    HR record with effective date reaches the integration.

  2. 02 · Validation

    Validate

    Worker ID, role, site and manager checked against the agreed rules.

  3. 03 · Microsoft

    Identity

    Entra account, groups and license assignment from the role policy.

  4. 04 · Device / RTP

    Device

    Intune profile assigned; laptop prepared at RTP for the start date.

  5. 05 · Service desk

    Ready check

    Onboarding checks pass; evidence written to your service desk.

Guardrails

  • A missing approval pauses the workflow and raises an exception; nothing is created on assumption.
  • Start-date corrections reschedule the work instead of duplicating it.
  • Rehires are matched to the existing worker record before any new account is considered.

What you get

  • Joiner rule set mapped to your roles and sites
  • Account, group and license policy
  • Device profile and RTP preparation task
  • Day-one readiness evidence in your service desk

The architecture

HR platform

Authoritative for employment status

Integration and validation

Rules, required fields, approvals

Microsoft execution plane

Entra identity and access

HR provisioning, Lifecycle Workflows, Graph, Logic Apps

Intune / Windows Autopilot

Device profile, enrollment, apps

Your service desk

ServiceNow, Jira Service Management or native Microsoft workflow. Outside the Microsoft plane.

Physical execution

Surya RTP Distribution Center

People prepare, ship and receive devices

Teams agent

Employees, managers and IT ask in Teams

Permission and approval gate

Authenticated user, authorized data, logged actions. No direct admin access.

Into the Microsoft plane above

Text equivalent: your HR platform sends the event and an integration validates it against your rules. Inside the Microsoft execution plane, Entra (HR provisioning, Lifecycle Workflows, Graph, Logic Apps) updates identity and access, and Intune with Windows Autopilot handles the device. Tasks, status and evidence flow to and from your chosen service desk, which sits outside the Microsoft plane. Physical device tasks go to Surya people at the Surya RTP Distribution Center. A Teams agent sends requests through a permission and approval gate, which calls only approved Microsoft workflows.

/ 02 Integrations

Connect your HR platform. Keep your service desk.

Each route is labelled for what it is. Prebuilt where Microsoft provides it; scoped API work where it does not.

HR platforms

  • Workday

    Microsoft prebuilt HR provisioning

    Microsoft Entra prebuilt inbound provisioning

    Cloud-only or hybrid Active Directory target is a design choice made in assessment.

  • SAP SuccessFactors

    Microsoft prebuilt HR provisioning

    Microsoft Entra prebuilt inbound provisioning

    Attribute mapping and scoping agreed per tenant.

  • Rippling

    API integration scoped to your tenant

    Vendor worker API to Entra API-driven inbound provisioning

    Edition, API scopes and event coverage confirmed before build.

  • Deel

    API integration scoped to your tenant

    Vendor HRIS API and worker webhooks to Entra API-driven provisioning

    Webhook versus polling confirmed per account.

  • BambooHR

    API integration scoped to your tenant

    Vendor API and webhooks to Entra API-driven provisioning

    Field coverage and webhook entitlements confirmed.

  • ADP

    API integration scoped to your tenant

    Vendor HCM APIs to Entra API-driven provisioning

    Product line and API access confirmed with ADP.

  • UKG

    API integration scoped to your tenant

    Vendor developer APIs to Entra API-driven provisioning

    Partner and developer-policy access confirmed.

  • Oracle Fusion Cloud HCM

    API integration scoped to your tenant

    Vendor workers REST API to Entra API-driven provisioning

    Scopes and change-detection method confirmed.

Service desk platforms

  • ServiceNow

    Connector / REST workflow

    Power Platform connector or REST

    Requests, tasks, approvals and status mapped to your instance.

  • Jira Service Management

    Connector / REST workflow

    Jira Service Management REST API

    Request types and approvals use the service desk API, not a generic Jira connector.

  • Freshservice

    Connector / REST workflow

    Vendor REST API

    Subject to plan and API access.

  • BMC Helix ITSM

    Connector / REST workflow

    Vendor REST API

    Subject to version and access.

  • Ivanti Neurons for ITSM

    Connector / REST workflow

    Vendor supported APIs

    Subject to edition and access.

  • ManageEngine ServiceDesk Plus

    Connector / REST workflow

    Vendor REST API

    Cloud or on-premises edition confirmed.

  • Native Microsoft route

    Connector / REST workflow

    Teams + Power Automate / Logic Apps + governed Dataverse or SharePoint task records

    A scoped JML workflow record, not a full replacement service desk product.

  • A documented vendor API shows a route exists. It is not a finished Surya integration; each one is confirmed and built for your tenant.
  • Change detection is near real time only where the platform sends events; otherwise it runs on an agreed polling schedule.
  • HR stays authoritative for employment status. Only the minimum worker data the workflow needs is carried; no payroll or health data goes into AI prompts.

/ 03 In Teams

Ask in plain language. Change only what is approved.

Employees, managers and IT ask the same agent. Each sees only what they are authorized to see, and nothing consequential happens without approval in the authoritative approval UI.

Illustrative workflow - no live connections

Chat with Dale (JML agent)

Synthetic data

Signed in: Alex Rivera, joining Monday (synthetic)

  • Is my laptop ready for Monday?

  • Your laptop is prepared and out for delivery to the Raleigh site. One item is still open.

    Readiness - Alex Rivera

    1 dependency open
    Work account
    Created
    Laptop
    Prepared at RTP, shipped
    Core apps
    Assigned
    Engineering drawing app
    Waiting on manager approval

  • I've let your manager know. I can't approve access myself.

Proposed implementation: a Teams agent built in Copilot Studio with authenticated end users and configured tools that call approved Power Automate or Logic Apps flows. Information shown is limited to what the signed-in person is authorized to see; actions are logged; approvals come from the authoritative approval UI, not natural-language say-so.

/ 04 The device

From HR role to a ready laptop.

  1. 1

    HR role

    The approved role and site select the device standard.

    HR

  2. 2

    Device profile

    Approved hardware model, apps and Intune policy for that role.

    Surya standard

  3. 3

    RTP preparation

    Surya people prepare, label and dispatch the laptop on the agreed schedule.

    Surya people at RTP

  4. 4

    Employee sign-in

    The joiner signs in with their new work account.

    Employee

  5. 5

    Autopilot and Intune

    Enrollment, configuration and apps applied by Windows Autopilot and Intune.

    Microsoft

  6. 6

    Readiness check

    Compliance and app checks pass; evidence recorded.

    Surya / service desk

Sequence: HR role, approved device profile, RTP preparation and dispatch by Surya people, employee sign-in, Windows Autopilot and Intune enrollment with configuration and apps, then a readiness check with evidence.

Windows Autopilot is Microsoft's device provisioning technology, not an AI agent. Classic Autopilot pre-provisioning and Windows Autopilot device preparation are different modes; the supported mode is chosen after the Windows version, join type and prerequisites are validated. Hybrid-joined paths are scoped separately.

/ 05 Service desk change

Changing service desks? Keep the lifecycle.

Moving from ServiceNow to Jira Service Management or a native Microsoft workflow does not have to mean rewriting who gets what. The JML rules move into the Microsoft execution plane; the service desk becomes where tasks and evidence land.

  1. / 01

    Inventory

    Current rules, customizations, approvals and their owners.

  2. / 02

    Map

    Each rule to Microsoft execution and your target service desk.

  3. / 03

    Shadow test

    Synthetic and shadow runs with one writer per system, so nothing is provisioned twice.

  4. / 04

    Pilot

    A cohort covering joiners, movers, leavers, rehires, late and cancelled events, and a failed API call.

  5. / 05

    Cut over

    Reconciled results, signed cutover and a written rollback.

  6. / 06

    Retire

    The old integration is switched off only after verification.

This covers the JML lifecycle. A full ServiceNow migration is not included.

/ 06 How you buy it

From your current workflow to a tested JML service.

  1. Step 1

    Scope assessment

    Produces the integration map, role and access catalogue, licensing dependencies and a fixed scope.

  2. Step 2

    Configure and build

    Your selected HR source, your chosen service desk, your Microsoft tenant and the approved scenarios.

  3. Step 3

    Accept and hand over

    Acceptance tests against the agreed scenarios and documented handover.

  4. Optional

    Optional operation

    24/7 Surya Endpoint operation of the workflow, scoped and purchased separately.

You own

HR data accuracy, employment decisions, access approvals and retention policy.

Surya delivers

The configured integrations, runbooks and monitoring you purchase.

Licensing check

  • Microsoft Entra inbound HR provisioning
  • Microsoft Entra ID Governance for Lifecycle Workflows
  • Microsoft Intune and Windows licensing
  • Azure Logic Apps consumption
  • Copilot Studio and Power Automate
  • HR and service desk vendor API entitlements

Base Microsoft 365 does not include all of these. Third-party licensing and API fees are confirmed separately during assessment.

Questions

Can we start with JML without replacing our service desk?

Yes. JML is a defined Surya Endpoint implementation that connects to the service desk you already run, so tasks, approvals and evidence keep landing where your team works today. Ongoing 24/7 operation is optional and scoped separately.

Do you support every HR platform natively?

No. Workday and SAP SuccessFactors use Microsoft's prebuilt provisioning. Other platforms use their documented APIs, confirmed and built for your tenant during scope.

Can the AI agent grant access?

Only by calling an approved workflow. Consequential access needs approval in the authoritative approval UI, and the agent cannot create permissions outside the catalogue.

Is revocation instant everywhere?

No. Disable and session revocation run through the configured Microsoft controls; reach and timing in other apps depend on each integration in scope.

What does it cost and how long does it take?

Both come out of the scope assessment. Pricing is shared privately in a written offer.

Architecture references · Reviewed 15 October 2026

These document what each platform supports. They are not a certification of Surya compatibility.

Keep your JML logic when your service desk changes.

Map your JML workflow Back to Surya Endpoint