Four kinds of work.
Automate the requests that keep coming back
Licence assignments, mailbox creation, shared mailbox access, distribution list changes, new hire setup. PowerShell workers pick up the task, do the work in Active Directory, Exchange and Entra, re-verify the real state on both sides, write a note the requester can read, and close the ticket. Ambiguous cases stay open with an explanation instead of being guessed.
What changes- A new hire starts Monday with their account, mailbox, licence, access groups and workstation already set up, without a technician touching any of it.
- A shared mailbox access request closes in minutes instead of two days, with the permission verified on premises and in the cloud before the ticket is closed.
- Incoming tickets route themselves to the right queue based on the request type, so nobody triages by hand every morning.
- A legal name change follows the person everywhere: account, address, aliases and the address book, in every forest.
Consolidate identities after a merger
Script-driven cross-forest migration with SIDHistory preserved, ServiceNow profile repair, duplicate detection, password sync across forests. The multi-forest traps are not in the documentation: Kerberos and FQDNs, replication and domain controller round-robin, Exchange attributes that read wrong through the AD module, duplicate Entra objects after a failed soft match. I have hit all of them.
What changes- Two merged companies see each other in one address book and can book each other's meeting rooms, long before the forests themselves are merged.
- Accounts move with their SIDHistory, so file server access still works the next morning and nobody spends a month re-permissioning shares.
- The commercial migration tool is replaced by script, and its licence is not renewed the following year.
- Migrated employees keep working in ServiceNow because their profiles are repaired automatically, not one at a time by the service desk.
Account lifecycle, without an IGA platform
From the HR system through to Active Directory, Entra ID and Exchange Online. Joiners, movers, leavers, dormant accounts. Routing by site and department, shadow contacts across forests so the manager hierarchy and the address book keep working, capped disablement waves with manager approval.
What changes- A departure triggers the disable, the removal from cloud groups and distribution lists, the address book hide and the licence release, the same day rather than the next quarter.
- Licences paid for on dormant accounts come back, with the manager approving in a SharePoint list instead of a spreadsheet by email.
- The manager hierarchy stays correct between forests that cannot see each other, so approval workflows stop breaking.
- HR stays the single source of truth: a change made in the HR system reaches Active Directory and Microsoft 365 without a ticket.
Bring an existing script fleet up to standard
If you already run forty PowerShell scripts in production with passwords inside them and nobody knows which ones ran last night: centralized configuration, encrypted secrets, structured logging with retention, failure alerts, and a watchdog that checks the fleet actually ran. Thirty-one scheduled scripts moved onto that foundation in a single day.
What changes- No cleartext password left in a script, and no service account credential passed around in a text file.
- An email arrives when a scheduled task fails, instead of a user reporting it three days later.
- A watchdog confirms every morning that last night's jobs all ran, so silence stops meaning success.
- Changing a server, a group or an endpoint happens in one configuration file instead of forty scripts.