Skip to content
finn.
Integrations Microsoft Entra ID

Integration · IT and identity

Microsoft Entra ID + Finn.

Microsoft Entra ID integration with Finn. Microsoft Entra ID manages workforce identities, application access, and authentication.

Discuss this integration Explore the workflows

The work behind the connection

What you can do with Microsoft Entra ID.

Microsoft Entra ID manages workforce identities, application access, and authentication.

Give a new employee the approved access for their role

Finn completes the identity setup behind an approved hire, turning the HR record into the right account and application assignments before reporting the recorded provisioning results.

Typically handled byIdentity onboarding administrator

Starts when

Workday confirms a hire and the effective start date.

What Finn handles

  1. Match the approved employee details to the correct Microsoft Entra ID identity and create the account when required.
  2. Apply the role's authorized security-group memberships and enterprise-application assignments, requesting a decision for access outside the established role.
  3. Follow the connected applications' provisioning results and send enrollment instructions through the verified employee channel.
  4. Record account and assignment outcomes in ServiceNow, keeping any actual application failure attached to its owner.

The result

The employee's approved identity setup is completed with evidence of the account and application results.

Change access when an employee changes jobs

Finn handles the identity work behind a department or role change, adding the approved new access and removing access the employee is no longer authorized to keep.

Typically handled byIdentity lifecycle operations team

Starts when

An approved Workday transfer changes the employee's role, manager, or department.

What Finn handles

  1. Compare the settled new role with the employee's current Microsoft Entra ID profile and application access.
  2. Obtain the designated owners' decisions for any overlapping or exceptional access that needs separate approval.
  3. Update the approved profile and security-group memberships and enterprise-application assignments, then follow the resulting application provisioning operations.
  4. Notify the employee and record the completed additions, removals, and genuine downstream exceptions in ServiceNow.

The result

The identity reflects the approved job change, with a traceable record of which application access changed.

Complete account offboarding at the approved departure time

Finn executes the identity portion of an authorized departure and records what each connected system actually completed, keeping data-retention decisions separate from access removal.

Typically handled byIdentity offboarding administrator

Starts when

HR provides a confirmed departure event and its effective time.

What Finn handles

  1. Identify the employee's Microsoft Entra ID account, assigned applications, and the approved access-removal scope.
  2. At the authorized time, disable or suspend sign-in and revoke the provider sessions supported by Microsoft Entra ID.
  3. Remove the approved application assignments and follow connected provisioning results rather than assuming every application session ended.
  4. Record completion and remaining application-specific work in ServiceNow, preserving accounts or data required by the retention decision.

The result

The approved identity changes are completed and evidenced, with separate application-session or retention obligations clearly recorded.

Fulfill an application-access request

Finn takes an employee's application request through its required approval and the assignment, then confirms the result instead of stopping after sending an approval notification.

Typically handled byApplication access fulfillment team

Starts when

An employee requests a business application through the service catalog.

What Finn handles

  1. Identify the verified employee, requested application, required access level, and documented business reason.
  2. Collect the manager or application owner's decision through the existing ServiceNow approval process.
  3. Apply the approved security-group memberships and enterprise-application assignments in Microsoft Entra ID and follow the connected application's provisioning response.
  4. Send the employee the access result and complete the service request with the recorded approval and assignment details.

The result

The employee receives the authorized access, and the request contains evidence of both the decision and fulfillment.

Manage contractor access through its agreed end date

Finn carries a contractor's approved access period through renewal or removal, giving the sponsor a concrete decision and ensuring the account follows that decision at the agreed time.

Typically handled byContractor identity coordinator

Starts when

A contractor's recorded access expiration is approaching.

What Finn handles

  1. Match the contractor's Microsoft Entra ID account and assignments to the approved sponsor and end date in the HR record.
  2. Ask the sponsor to confirm an authorized extension or the existing expiration decision.
  3. Apply the approved extension or disable the account and remove the specified access at its effective time.
  4. Follow the application results and record the sponsor's decision, account state, and remaining exceptions in ServiceNow.

The result

Contractor access ends or continues according to a recorded authorization, without an unresolved reminder replacing the action.

Restore sign-in through the approved recovery process

Finn resolves a routine lockout by following the organization's identity-verification and account-recovery controls, then checks the resulting sign-in state before closing the support request.

Typically handled byIdentity help desk

Starts when

An employee reports a locked account or forgotten sign-in credential.

What Finn handles

  1. Complete the organization's approved verification process before initiating any Microsoft Entra ID recovery action.
  2. Inspect the recorded account state and identify the recovery action for that specific lockout.
  3. Initiate Microsoft Entra's self-service password reset or the organization's account-recovery flow through the verified employee channel; never collect passwords in chat.
  4. Confirm the resulting account state and the employee's access, then document the outcome in the connected service desk.

The result

A verified employee regains access through the normal controls, with the performed recovery action recorded.

Replace a lost or changed sign-in device

Finn manages the complete recovery journey when an employee cannot use their registered authentication device, preserving verification requirements while bringing the approved replacement into service.

Typically handled byMultifactor authentication support team

Starts when

A verified employee reports a lost phone or an approved device replacement.

What Finn handles

  1. Complete the organization's approved identity-verification and device-recovery process before changing authentication registrations.
  2. Review the employee's Microsoft Entra ID factors and apply only the removal or reset authorized for the reported device.
  3. Guide enrollment of the approved replacement using the provider's own activation and verification steps.
  4. Check the recorded enrollment result and confirm the employee can complete sign-in before resolving the service request.

The result

The employee has a working approved authentication method and the previous device's treatment is documented.

Carry an access review through the approved removals

Finn organizes application-access evidence for the responsible owner and then executes the owner's decisions, turning a periodic review into completed access changes and a usable record.

Typically handled byApplication owner and identity review coordinator

Starts when

A scheduled review covers a defined application's users or access groups.

What Finn handles

  1. Retrieve the Microsoft Entra ID assignments and connect them to employee roles and account owners.
  2. Present the access list and context to the designated reviewer through the established review process.
  3. Apply only the explicitly approved removals or corrections to the security-group memberships and enterprise-application assignments.
  4. Follow downstream provisioning and record the decisions, completed changes, and unresolved connector work in ServiceNow.

The result

The review produces implemented access decisions and evidence, rather than a spreadsheet that remains disconnected from the live assignments.

Execute approved containment for a compromised identity

Finn carries out the identity actions authorized by the security response procedure, records the result, and keeps restoration under the incident owner's control.

Typically handled bySecurity operations and identity response team

Starts when

The security team confirms an account-containment action for a named employee.

What Finn handles

  1. Match the incident to the correct Microsoft Entra ID identity and its explicitly approved containment scope.
  2. Disable or suspend the account and revoke supported identity-provider sessions according to the incident procedure.
  3. Track application-specific session actions separately where the connected application must perform them.
  4. Write the action results and remaining dependencies to the security case; restore access only after the owner authorizes recovery.

The result

The approved account containment is executed with a precise record of provider and application-level results.

Correct directory information that blocks routine work

Finn fixes an identity record using an approved authoritative change, then checks the downstream assignments affected by that update so a simple HR correction does not remain an IT backlog item.

Typically handled byDirectory administration team

Starts when

HR confirms a correction to an employee's name, manager, department, or other managed directory attribute.

What Finn handles

  1. Match the approved source change to the correct Microsoft Entra ID account and identify the fields owned by that source.
  2. Apply the permitted profile update without changing separately governed access or authentication settings.
  3. Follow any established mappings that update security-group memberships and enterprise-application assignments and check their returned application results.
  4. Notify the employee or requesting administrator and record the source change and completed correction in ServiceNow.

The result

The directory reflects the approved information and any resulting application updates have a outcome.

Connection setup

Set up the connection around your work.

Contact Finn to discuss the records your workflow needs and the actions you want it to perform.

Your team chooses what Finn can access, what agents can change, and when a person must approve the work. The connection needs the appropriate account access and permissions from Microsoft Entra ID.

Visit Microsoft Entra ID

The Finn platform

Finn Agents

Help customers. Work with your team. Finish the job.

Explore Agents

Finn Systems

Business apps for the work behind the conversation.

Explore Systems

Finn AI Gateway

Control connected AI apps, models, access, and spending.

Explore AI Gateway

Meet Finn

Put your Microsoft Entra ID integration to work.

Tell us which records, actions, and teams the connection needs to support.

Discuss your workflow Get started