Home · Solutions · Other solutions
Solution · Other solutionsA sponsor, an end date and an exit that runs by itself for every external account
Contractor access that ends when the contract ends
One engagement register, reconciled daily with purchase orders and Entra ID, gives every contractor account a sponsor, an end date and an automatic exit in Entra and in the systems outside it.
Executive summary
Procurement closes the purchase order. Nobody tells IT. The contractor keeps the VPN for a year.
The design starts from a register rather than from a workflow.
External access ends with the contract, because the end date lives in the directory and the register rather than in someone's memory.
Microsoft Entra ID accounts, groups and licences; trial management system; laboratory system
Business problem
Identity & access
Contractors come in through several doors: an agency, a consultancy, a direct contract, a vendor's support team. Each door creates accounts in its own way, a guest invitation here, a member account "like an employee" there, a shared vendor login somewhere else. None records an end date, because the engagement "might be extended", and the sponsor is a person rather than a role, so when that person changes job the contractor is orphaned.
Three functions each hold a third of the picture. Procurement knows when the money stops, IT knows which accounts exist, HR knows neither, because contractors are outside its system. Removal therefore depends on someone remembering, usually former colleagues, who have no reason to. Extensions are agreed by email and never reach the directory.
The problem survives because it sits between departments and its cost is invisible until an audit or an incident makes it visible. A CISO asked how many external people can reach the systems today has to launch an investigation first.
How it works today
- PersonA business sponsor engages a contractor through an agency, a consultancy or a vendor, and emails IT for "the usual accounts"
- SystemProcurement raises a purchase order in SAP with an end date; IT creates the Entra ID account, the VPN profile and the system logins without one
- PersonOver the engagement, colleagues add the contractor to SharePoint sites, distribution lists and the trial system as the work requires
- WaitingThe purchase order closes; nobody informs IT, because the person was never in the HR system
- Risk of errorMailbox, VPN certificate, site ownership and logins stay live while the sponsor moves on and becomes unreachable
- PersonMonths later an access review flags the account; IT asks around, waits, then disables it
- Risk of errorA quarterly clean-up catches some orphans; licence and exposure are carried the whole time
Why the current process costs more than it appears
Nobody planned this work; it accumulated.
- Every orphaned account is external access to internal systems, held by someone the company no longer pays, may not be able to contact, and who may now work for a competitor.
- Licences and mailboxes stay assigned for as long as nobody notices, typically a quarter and sometimes a year.
- Access reviews turn into investigations: the reviewer cannot approve or reject a name until somebody establishes whether that person still has a contract.
- In regulated work, an external person who can still reach trial or patient data after their confidentiality obligation lapsed is a reportable matter, and the easiest audit finding there is.
Cost of inaction
Contractor numbers move with projects and skills gaps rather than with headcount plans, and each new engagement adds accounts with no end date. Orphans accumulate at the rate of endings nobody reports, which is most of them, less what the quarterly clean-up catches. Sponsors move on, so the share of accounts nobody can vouch for grows, and each access review takes longer.
The rows above price the hours. What they cannot price is the day an orphaned account is used by someone other than its holder, when the incident report, or an inspector, asks why an account with a closed purchase order was still active.
A plausible organisation with realistic proportions. The figures are there to be recalculated on your data; they are not a client result.
A pharmaceutical services company with 1,900 employees and about 600 active contractors from 40 vendors: monitors, statisticians, developers and vendor support staff. Microsoft Entra ID, purchase orders in SAP, a trial management system and a laboratory system outside Entra.
About 144 contractor events a month, 78 starts and 66 endings; accounts exist as guests and as members; quarterly clean-ups of orphaned accounts take about 30 hours each.
Sponsors email IT for accounts, IT creates them with no end date, purchase orders close in SAP without any signal to IT, and orphans surface at access reviews and the quarterly clean-up.
About 55 minutes of manual work per start or ending across IT and the sponsor, and no date in the directory that could end an account; the last review found accounts active a year after their purchase orders closed.
One engagement register in UiPath Data Fabric, reconciled daily against SAP and Entra ID; requests and IT approval in Microsoft Teams; the end date written to the directory at creation; sponsor cards before the date; lifecycle workflows and robots removing the access on the day.
In the modelled case three in four events run without manual work, about 99 hours a month are released, the quarterly clean-up becomes a daily exception list, and an orphan is found within a day instead of within a year. Illustrative figures, not a client result.
Proposed solution
The design starts from a register rather than from a workflow. Every external engagement becomes one record in UiPath Data Fabric: contractor, vendor, sponsor role, purchase order, systems, start and end date, and every later decision about it. A UiPath Robot loads it from the existing spreadsheet and the open purchase orders, then reconciles it daily against SAP and against contractor and guest accounts in Microsoft Entra ID, so that every external account either maps to an open engagement or lands on an exception list.
Creation runs from the register, not around it. The sponsor fills a short request in a Microsoft List pinned in the IT channel in Teams; IT approves the profile as a task inside Teams; the robot creates the account with the start and end dates written to the directory, records the engagement and creates the logins in the trial management and laboratory systems.
Ending is the default; extending is a decision with a name on it. Before the end date the sponsor receives a card in Teams: extend, which needs a purchase order extension, or end; no answer means end. On the day, the leaver lifecycle workflow disables the account and removes groups, Teams membership and licences, and its custom task extension in Azure Logic Apps starts the robot that cleans the systems outside Entra, each step recorded against the engagement.
Microsoft Entra ID Governance lifecycle workflows (joiner and leaver templates on the hire and leave dates; custom task extension through Azure Logic Apps); Microsoft Lists as the request form in Teams; UiPath Action Center tasks completed in Microsoft Teams; UiPath Orchestrator schedules, queues, credential store and audit; UiPath Data Fabric entities; UiPath Integration Service connectors for SAP, SharePoint lists and Microsoft Teams
The register and the standard profiles, the initial inventory and the daily reconciliation, the request flow and IT approval task, the sponsor cards, the robots for the systems outside Entra and for guest accounts, exception routing, the monthly report
Read-only purchase-order lookups through the SAP BAPI or SAP OData connector; accounts, attributes, groups and guests through the UiPath connector still named "Microsoft Azure Active Directory" and Microsoft Graph; the administration interfaces of the trial management and laboratory systems
How the automated process works
- PersonThe sponsor submits a request in the Microsoft List in the IT Teams channel: vendor, purchase order number, profile, systems; IT approves it as a task inside Teams
- AutomationThe robot reads the purchase order in SAP, records the engagement with its end date, and creates the account with the hire and leave dates in the directory
- SystemRobots create the logins in the trial management and laboratory systems from the same profile; the joiner lifecycle workflow adds the standard groups and Teams
- AutomationFourteen and three days before the end date the sponsor receives a card in Teams: extend, with a purchase order extension required, or end; no answer means end
- PersonThe sponsor decides; an extension moves the end date only once procurement has extended the purchase order
- AutomationOn the end date the leaver lifecycle workflow disables the account and removes groups, Teams membership and licences; its task extension starts the robot that cleans the other systems and disables guest accounts, one timestamped record per step
- AutomationEvery morning the reconciliation compares purchase orders, register and directory; an account without an open engagement becomes an exception task for IT and the sponsor's manager, and a monthly report goes to the CISO and procurement
Human-in-the-loop model
Automation handles
- The daily reconciliation against purchase orders and the register, and the exception list it produces
- Provisioning of the standard profile in Entra and outside it, with the end date written at creation
- Reminding the sponsor before the end date and recording the answer, or the absence of one
- Disabling, removing groups and licences, cleaning the other systems on the date, the monthly report
People decide
- Approval of the initial profile and of any access beyond it, by IT in Teams
- The extend-or-end decision, by the sponsor, backed by a purchase order
- Exceptions: orphaned accounts, accounts with no sponsor, removals that failed in a target system
- Re-assignment of sponsorship when a sponsor leaves or moves
Before and after
Systems and integrations
Everything below runs on licences and systems you already hold, or would need anyway.
Inputs
- SAP purchase orders
- contractor and guest accounts in Microsoft Entra ID
- the vendor-management spreadsheet for the initial load
- requests from the Microsoft List in Teams
Automation layer
- UiPath Orchestrator
- UiPath Robots
- UiPath Data Fabric
- UiPath Integration Service
- UiPath Action Center
- Microsoft Entra ID Governance lifecycle workflows
- Azure Logic Apps
Target systems
- Microsoft Entra ID accounts, groups and licences
- trial management system
- laboratory system
- VPN profile
- the engagement register
Human touchpoints: the request list in Teams; IT approval tasks; sponsor cards; exception tasks; the monthly report in a Teams channel
Technologies used
joiner and leaver templates on the hire and leave dates: groups and Teams on start; disable, remove groups, Teams and licences on the end date; task extension into UiPath
Athe engagement register: contractor, vendor, sponsor role, purchase order, systems, dates, decisions, audit trail
Adaily reconciliation, provisioning and removal outside Entra, schedules, queues, audit
Apurchase-order lookups, the request list trigger, Teams notifications, accounts, lifecycle dates, groups, guests
Athe IT approval task, the sponsor's extend-or-end card and the exception tasks, inside Teams
Athe task extension that hands the end-date event to a robot; secrets of the service accounts
AIllustrative economic model
A model, not a promise.
Volume is the one input adjusted before it enters the calculator: of 144 starts and endings a month, three in four are assumed to run without manual work, so the first row prices 108. Fifty-five minutes per event is the combined IT and sponsor effort today; €49 is a fully loaded IT specialist cost. The four quarterly clean-ups of about 30 hours each, another 120 hours or roughly €5,880 a year, stay outside the calculator because they disappear as a whole rather than per event. Nothing here comes from a client, and the result is capacity, not headcount.
Run the numbers on your data
An illustrative estimate from your own inputs. It models released capacity; it is not a promise of savings.
Business benefits
- External access ends with the contract, because the end date lives in the directory and the register rather than in someone's memory
- An orphaned account is found within a day by the reconciliation, not within a year by an access review
- Every contractor has a sponsor role, so a sponsor's departure triggers a re-assignment instead of an orphan
- Extensions require a purchase order, which keeps procurement, IT and the sponsor on one date and puts a name on every decision
- Licences and mailboxes are released on the day, a small saving that repeats 66 times a month, and audit questions about external access are answered from the register in minutes
The management view
- A number that did not exist before: how many external people can reach which systems today, and how many will lose access this month
- Procurement can put spend next to access and see the contracts that ended while the access carried on
- HR gains a view of the contingent workforce without bringing contractors into the HR system
- Workload becomes predictable: starts and endings by month, vendor and system
Board-level KPIs
Security and governance
An auditor should be able to reconstruct every decision.
- Contractor accounts are created only from the register, under a standard profile with the least access the role needs and always with an end date in the directory; only a recorded sponsor decision backed by a purchase order moves that date
- Robots operate the trial management and laboratory systems under service accounts limited to user administration; secrets sit in Azure Key Vault or the Orchestrator credential store, every action is logged against an engagement, and nothing is ever written to a purchase order
- Personal data in the register is limited to what the engagement needs and retained under your Microsoft Purview policy; the register runs in the EU region of UiPath Automation Cloud and directory data stays within the Microsoft 365 EU Data Boundary
- Segregation of duties is built in: the sponsor who requests access does not approve it, and exceptions go to a named IT owner, never closed silently
Why now
Regulators and clients now ask how external access is controlled, not only employee access: Directive (EU) 2022/2555 lists supply-chain security and the relationships with direct suppliers and service providers among the minimum risk-management measures
The end date already exists in the purchase order, and Microsoft Entra ID Governance lifecycle workflows can act on it once it is written to the directory, so the whole gap is the hand-over, which a daily reconciliation robot closes
In the modelled company the manual handling alone is worth about €4,851 a month before a single licence is released, and the trigger is usually a specific finding or a vendor breach in the sector
Relevant executive roles
External access ends with the contract, and the number of external people who can reach each system is known every day rather than estimated at the review
The contingent workforce becomes a governed part of the identity lifecycle instead of a standing exception to it
Spend and access reconcile, and extensions run through the purchase order rather than around it
A view of the contingent workforce exists without bringing contractors into the HR system
Common questions and objections
They can, but each extension needs a purchase order and carries the sponsor's name and date, which is more accountability than today's silence. The monthly report shows extensions by sponsor, and a pattern is visible within a quarter.
They manage their staff; you manage access to your systems. The register records only what your systems already grant and asks the vendor for nothing but an accurate end date.
Lifecycle workflows need a Microsoft Entra ID Governance or Microsoft Entra Suite licence for every user in scope, and that belongs in the business case openly. Where it is not justified, the same sequence can run from UiPath against Microsoft Graph: less native tooling, more that we build.
When this is not the right solution
- Fewer than a few dozen contractors, all managed by one person who knows every contract and end date
- Contractors already flow through the HR system with end dates and the leaver process covers them; extend the employee lifecycle instead
- No purchase order or contract system holds engagement dates; the register can still work, but its feed would be manual and the reconciliation would have nothing to check
A question for the next management meeting
Name the external accounts in our directory whose purchase orders have already closed: is that a list this company can produce today, or a finding it will receive at the next audit?
Implementation approach
The first week looks the same at every client: we look at the data.
We deliver
- An inventory of contractor and guest accounts reconciled against open purchase orders, with the first orphan list within days
- The register and the standard contractor profiles, agreed with IT, procurement and information security
- Configuration of the lifecycle workflows and the Azure Logic Apps task extension into UiPath
- Robots for the daily reconciliation, for provisioning and removal outside Entra, and for guest accounts
- The request list in Teams, the IT approval task, the sponsor cards, the exception routing and the monthly report
We need from you
- Read access to purchase orders in SAP and an export of contractor and guest accounts from Entra ID
- A Microsoft Entra ID Governance or Microsoft Entra Suite licence position for the contractors in scope
- Administration accounts in the trial management and laboratory systems, limited to user administration
- A policy decision on what happens when a sponsor does not answer, and who inherits sponsorship when one leaves
Stages
Discovery
The reconciliation itself: accounts matched to purchase orders, orphan list, volumes by vendor and system
Design
Register model, standard profiles, sponsor rules, the no-answer policy, security model
Build
Lifecycle workflows, task extension, robots, the Teams request and cards, the report
Validation
Dry runs on historical endings; every automated removal reviewed by IT in the first weeks
Go-live
One vendor group and one non-Entra system first, then the remaining vendors
Optimisation
Exception patterns feed the profiles; response rates and removal timeliness tracked
Quick win. Effort is driven by the number of systems outside Entra and their administration interfaces, the number of distinct profiles, and the quality of the purchase-order data.
Your directory holds 600 external accounts and not one of them carries an end date.
Send us the export of contractor and guest accounts from Entra ID and the list of open purchase orders. Within about a week we return the first orphan list and a written note on what the register would need from your systems.
Send us your contractor account exportThe neighbouring process usually has the same problem
New starters wait days for access; leavers keep theirs for weeks. Both are the same missing handover.
View solution HR & peopleContractor hours from timesheet to agency invoiceYou approve the hours in one place and pay the agency invoice in another, and nothing checks that the two agree.
View solution Other solutionsApplication access granted by policy in minutes, with proofAccess is granted from interpreted emails, approvals are chased, and the auditor finds the evidence missing.
View solutionIndustries we deliver this in most oftenManufacturing & industryTransport & logisticsServices & ITShared services