The 7 automations every clinic should run in Microsoft 365

Most clinics already pay for Microsoft 365. Very few use the automation muscle inside it. The result is a practice manager spending hours a week on IT chores that software should be doing — and security gaps that only surface at audit time.

These are the seven automations we turn on first for every practice we manage, roughly in order of payback.

1. New-hire onboarding

A new medical assistant should walk in on day one to a working account, the right group memberships, an EHR shortcut, and a configured laptop. Automated provisioning creates the M365 account, assigns licenses, adds security groups by role, and enrolls the device in Intune — from a single form your office manager fills in.

What it saves: 2–4 hours per hire, and the week-one 'I can't log in to anything' tickets.

2. Ten-minute offboarding

Offboarding is where clinics get burned. A departed employee with a live account is a HIPAA finding waiting to happen. Automation disables sign-in, revokes sessions, converts the mailbox to shared, forwards mail to a supervisor, removes group access, and wipes the device — in minutes, with an audit trail.

3. MFA enforcement and drift alerts

Turning MFA on once isn't enough; new accounts, exceptions, and 'temporary' exclusions accumulate. A weekly automated check compares every enabled user against MFA registration and flags the gap before an attacker finds it.

4. License cleanup

Unassigned and orphaned licenses quietly cost clinics hundreds per month. A monthly job reconciles licenses against active users and flags what can be reclaimed. This one usually pays for the whole automation program.

5. Shared mailbox and distribution list requests

Front-desk teams live in shared mailboxes (referrals@, billing@, records@). Making creation self-service — request, auto-approve within policy, provision — turns a multi-day IT ticket into a same-day change.

6. Device compliance watch

Intune knows which PCs are unencrypted, unpatched, or out of policy. The missing piece is someone looking. An automated digest surfaces non-compliant devices weekly so the fix happens before the incident.

7. Stale account detection

Accounts that haven't signed in for 60–90 days are either forgotten offboarding (see #2) or unused licenses (see #4). Either way, you want a list on your desk, automatically, every month.

Where to start

If you only automate one thing this quarter, make it offboarding — it's the highest-risk manual process in practice IT. If you want the full list running without building any of it yourself, that's exactly what ClinicOps does: all seven ship as managed automations in our portal, with approvals and an audit log.