Microsoft 365 onboarding and offboarding that actually finish. Helix sets up new hires, cleans up after leavers, puts one company email signature on every message and the company directory on every phone, all from one console, with a tamper-evident record of every change.
Joiner, mover and leaver templates as ordered runs — automatic, conditional, manual and wait steps, previewed end to end before anything changes. Dry-run preview today; live execution coming.
✓
Fast Onboarding
Create a user with the right groups, licenses, manager and department — pulled live from the tenant, no typos.
✓
Clean Offboarding
Sign-in blocked, sessions revoked, mailbox converted, then groups and licenses removed — in a safe order, with live progress.
✓
Signatures & Directory
Server-side company email signatures on every device, and the company directory synced to every phone.
✓
Secretless Authentication
Federated managed identity (no stored password or secret) — nothing to leak, expire or walk out the door. Sensitive actions require step-up MFA, which asks for a second sign-in check first, and every change lands in a hash-chained audit log: a tamper-evident history of every change.
✓
White-Label Ready
The client edition carries your name, logo and colors, with a small "Helix by Evolution IT Services" credit.
Preview complete — every step logged to the audit chain
Everything that ships today
One console for the Microsoft 365 user lifecycle
Every feature below is built and in use now. Runbooks run as a dry-run preview today; live execution is coming. Things we're still building are listed separately, further down, and clearly marked.
Tenants
Connect a client in one step
A Microsoft 365 admin approves Helix once, with admin consent. After that the tenant shows up in the console next to every other one you manage.
✓ Connect a tenant with Microsoft admin consent, no shared admin passwords
✓ One console for all your tenants, with the active client always shown
✓ Every call scoped to the tenant you're working in
Onboarding
New hires set up right the first time
Every picklist is pulled live from the tenant, so there are no typos and no stale lists.
✓ Create users with license, domain, manager, department, groups and SharePoint sites chosen from live lists
✓ Copy group memberships from a model user in the same role
✓ Custom onboarding fields such as employee ID and remote or in-office
✓ Office locations kept per tenant, plus a photo at creation
User management
Day-to-day changes without the admin center
The edits people ask for every week, in one screen.
✓ Edit 15 profile fields: name, job title, department, company, office, phone numbers, address and employee ID
✓ Upload or replace headshot photos
✓ Password resets protected by step-up MFA (a second sign-in check before the reset goes through), with change-at-next-sign-in on by default
Offboarding
Nothing left to memory
Choose the steps, and Helix runs them in a safe order with live progress on screen.
✓ Block sign-in, revoke sessions, reset the password, remove groups and licenses, rename the account
✓ Exchange steps: hide from the address list, set an auto-reply, forward to the manager, give someone access to the mailbox, litigation hold, convert to a shared mailbox
✓ Licenses are held until the mailbox has converted, so no mail is lost
✓ If Exchange automation isn't set up yet, Helix shows the exact PowerShell commands to run by hand
Runbooks
Joiner, mover and leaver as repeatable runs
Dry-run preview today; live execution coming
Templates turn your process into ordered steps you can preview before anything changes.
✓ Joiner, mover and leaver templates
✓ Automatic, conditional, manual and wait steps
✓ Dry-run preview shows every change before it happens
✓ Pick up a paused preview run where it stopped
Company email signatures
One signature, on every email, from every device
Signatures are applied in Exchange on the server, so they appear whether someone sends from Outlook, a phone or the web. If you pay for a separate signature tool today, this replaces it.
✓ Designer with 12 starter templates, a brand kit and live previews
✓ Size meter that keeps you under the Exchange limit
✓ Version history with one-click rollback
✓ Banner campaigns with start and end dates
✓ Test with a pilot group before turning it on for everyone
✓ Replaces people's own Outlook signatures, backed up first so they can be restored
GAL Sync (company directory on every phone)
The company directory on every phone
Helix pushes the company directory into a contacts folder in each mailbox, which phones and Outlook pick up on their own.
✓ Caller ID for coworkers, and a directory that works offline
✓ Preview what will change before a sync runs
✓ Scheduled syncs, limited to the people you choose
✓ A safety breaker stops a sync that would delete too many contacts
✓ Only touches contacts Helix created, never personal contacts
Governance & security
Proof, not memory
Built for the people who have to answer "who changed this, and when?"
✓ Hash-chained audit log: a tamper-evident history of every change, filtered per tenant
✓ Access Check: a permissions preflight before you rely on a tenant
✓ Step-up MFA: asks for a second sign-in check before sensitive actions
✓ Sign-in with Microsoft Entra ID
✓ Secrets kept in Azure Key Vault
✓ Federated managed identity: no stored password or client secret to leak or expire
Two editions, same engine
Run it for many clients, or inside one organization
The same Helix, set up two ways.
For MSPs
MSP Edition
One console across all of your client tenants. Pick the client you're working on and manage it from the same place as every other one.
✓ Every client tenant in one console
✓ Connect a new client with admin consent
✓ Each action scoped to one tenant at a time
✓ Audit view across all clients, or one at a time
Hosted by Evolution in Microsoft Azure. It connects to each client tenant through Microsoft admin consent.
For one organization
Client Edition
Deployed in the customer's own Microsoft 365 tenant, under their sign-in and conditional access policies. Evolution ships updates and support, and never holds the customer's credentials.
✓ Runs inside your own tenant
✓ Secretless: nothing stored for us to hold
✓ Your name, logo and colors, with a small "Helix by Evolution IT Services" credit
✓ Governed by your existing conditional access policies
What's different between editions
Capability
MSP
Client
Multi-tenant console (many clients at once)
✓
—
Single-tenant deploy in customer's own Microsoft 365
—
✓
White-label branding (your name, logo, colors)
✓
✓
Partner Center discovery of client tenants
✓
—
Runs under the tenant's own conditional access policies
✓
✓
Audit log in the tenant's own Microsoft audit (not stored by us)
✓
✓
Secretless: no admin credentials stored by us or the client
✓
✓
Pricing model
Per client tenant
Per seat
Integrations and what Helix works with
Helix lives in the Microsoft identity graph today. Everything below ships now; the vendor connectors in the next card are what we are building.
Live
Microsoft Entra ID
Users, groups, licenses, roles and conditional-access policies. Delegated access, no stored secrets.
Live
Exchange Online
Mailboxes, shared mailboxes, delegation, forwarding, GAL Sync, signatures across devices.
Live
Microsoft 365
Groups, Teams, SharePoint, OneDrive handoff on offboarding, M365-wide reporting.
Live
Microsoft Graph API
Everything Helix does to a tenant is a signed Graph call, so every change is auditable in your tenant's audit log.
Live
Microsoft Partner Center
Discovers and syncs the tenants under your CSP relationship so onboarding a new client is a single click.
Live
Microsoft Teams signing
Approve runbook steps and change requests from a Teams Adaptive Card, no console needed.
Coming soon — not live yet
Most of an offboarding isn't Microsoft
Disabling the account is the easy part. The rest lives in endpoint management, device encryption, application control, remote access and DNS filtering, and for some companies in on-prem Active Directory. This is what we're building next. None of it is switched on today, and we'll say so here when it is.
○ Vendor connectors
ThreatLocker, Action1, DriveStrike, AnyDesk, Cisco Umbrella and FreshService steps inside the same runbook.
○ On-prem Active Directory
An agent for on-prem AD, with hybrid routing that sends each change to the system that owns the account.
○ Live runbook execution
Runbooks run for real from the console. Today they run as a dry-run preview.
○ HR and ticket-driven intake
Start a joiner or leaver from an HR system or a help desk ticket.
○ Verify and reconcile
A scheduler that re-checks finished runs and flags anything that drifted.
○ Attestation reports
Signed proof of completed offboardings, delivered into Hawkpost reports.
In production today
Microsoft 365
Tenants under management via Partner Center
100%
Of our managed-IT client onboardings run through Helix
Zero
Shared admin credentials — delegated access only
Daily
Use inside a white-label client edition tenant
Helix isn't a preview. Evolution IT uses it for our own managed IT clients' onboarding and offboarding, and a white-label client edition is in daily use inside a customer's own Microsoft 365 tenant.
Who it's for: MSPs managing many Microsoft 365 tenants, and in-house IT teams who want onboarding, offboarding, signatures and the company directory handled in one place. If you'd rather have us run it for you, that's part of our Microsoft 365 services.
