Automating HR Changes Without Losing Control

Overview

Employee information changes regularly as people join the company, move between departments, receive new titles, change managers, or leave the organization. ADP remained the authoritative source for many of those updates, but reflecting them accurately in Active Directory required manual review and repetitive administrative work.

I designed an automation workflow that processes employee update files from ADP, compares the incoming data with Active Directory, and produces a preview of the proposed changes before anything is applied. The workflow then sends the report through an approval process, allowing an authorized reviewer to approve or reject the update.

The goal was not to remove people from the process entirely. It was to automate the repetitive work while preserving oversight over identity changes that could affect accounts, access, and downstream Microsoft 365 services.

What I Built

• File Intake

  Created a SharePoint-based intake process that automatically detects newly submitted ADP employee update files.

• Preview Engine

  Built a PowerShell process that compares ADP data with Active Directory and generates a preview of the proposed changes.

• Desktop Automation

  Used Power Automate Desktop to securely execute the preview and apply operations within the on-premises environment.

• Approval Control

  Added a human approval checkpoint so no Active Directory changes are applied without review and authorization.

• Reporting

  Published the preview report to SharePoint and generated a secure link for reviewers to inspect before making a decision.

• Outcome Handling

  Created separate approved and rejected paths with file archiving, reviewer comments, and clear notifications to HR.

How It Works

When HR uploads an ADP employee update file, the cloud flow retrieves the file and passes it to a Power Automate Desktop flow running inside the trusted environment. The desktop flow executes the PowerShell script in preview mode, compares the ADP information with Active Directory, and generates a report describing the proposed updates.

The report is uploaded to SharePoint, and the flow creates a link that is included in an approval request. The reviewer can inspect the summary, open the full report, and decide whether the proposed changes should proceed.

If approved, the workflow runs the apply process, archives the original file, and sends HR a confirmation containing the reviewer, completion date, report link, and any comments. If rejected, the file is moved to a rejected location, no Active Directory changes are made, and HR receives the reviewer’s comments so the source file can be corrected and resubmitted.

Why the Approval Step Matters

Identity automation can save significant time, but automating production directory changes without safeguards creates unnecessary risk. A malformed source file, an unexpected field value, or an incorrect employee record could affect account attributes and downstream services.

The preview-and-approve design allows the system to handle comparison, reporting, and execution while leaving the final decision with an authorized reviewer. This provides the efficiency of automation without turning the workflow into an uncontrolled process.

What I Learned

This project reinforced that good automation is not always fully autonomous. For high-impact changes, the most durable design may be one that combines automation with a deliberate human checkpoint.

It also showed the value of separating preview and apply operations. Using the same underlying logic in two controlled modes made the workflow easier to test, review, and troubleshoot while reducing the chance of unintended changes.

The strongest result was not simply that the process became faster. It became more consistent, reviewable, and traceable from the original ADP file through the final approval decision.