For IT and Microsoft 365 admins
Onboarding built on the Microsoft 365 platform you already run
iomer builds Journey for your organization as a single deployment package and installs it in your own tenant, on SharePoint lists and libraries, Entra ID and Power Automate. There is no new vendor platform, no second sign-in, and no onboarding data leaving Microsoft 365.
Download the IT overview (PDF, no form)
Architecture overview · 2-minute read
How Journey fits into Microsoft 365
| What people see | Where it lives |
|---|---|
| Streams and their audiences | Streams list: title, description, image, audience, owner, permissions matrix and approval levels |
| Task collections | Task templates list: stream, order, type, who does it, a task that must come first, due offset in days, policy to acknowledge, documents to collect, approval route and a link to an existing page |
| Assigned journeys | Journeys list: person, streams, start date, who assigned it, and whether it came from a person, a group or a rule |
| Every task card and matrix dot | Task instances list: status, completion, acknowledgement name, time and version, who recorded it and why, and the approval trail. Secured to the new hire, their manager and stream owners |
| Assignment rules | Rules list: a condition on a group or Entra ID property, mapped to streams and evaluated by Power Automate |
| Policies and their acknowledgements | Policy library: versioned documents, with acknowledgements recorded per version |
| Uploaded forms | Submissions library: a folder per new hire visible only to them, their manager and HR, with each file accepted or returned with a reason |
| Questions, cover, roles and the audit log | Lists for questions and answers, delegated approvals, Journey roles, notifications and every sign-off, decision and change, which can’t be edited |
| Departments, locations, roles, approver lists, theme | Reference lists and a settings list, which drive audiences, rules, report filters and how people are told |
Download the IT overview (PDF)Download the datasheet (PDF, 2 pages)Watch the 40-second tour
How Journey reaches your tenant
One package, built for you and installed by iomer
Journey is a solution accelerator, not a product you download and set up yourself. We build a single deployment package for your organization and run the installation with your Microsoft 365 admin. Nothing is hosted by iomer: once it’s installed, Journey runs entirely in your tenant.
Built for your organization
Your package contains the Journey site, its lists and libraries, and the Power Automate flows, already set up with your streams, tasks, policies, approval routes, rules and theme. Even the flows are built for your site, with its address and time zone filled in.
Installed by iomer
We install it with your admin, including the flows under a service account you own. Your IT team doesn’t assemble components or follow a setup guide.
Changed the same way
When you need something beyond the console settings, we build a new version of your package, test it and install it. Your package runs only in your tenant.
The same in every build
A foundation your team reviews once
- The Journey front end and the list and library design
- Item-level security on tasks and a private folder per new hire
- Approval, rule, reminder and welcome email flows
- Separation of duties, the acknowledgement and approval records, and the audit log
Specific to your build
Your organization’s settings, built in
- Streams, tasks, policies and forms
- Audiences and rules mapped to your Entra ID groups and properties
- Approval routes, approver lists and the permissions matrix
- Theme, site location and how people are told
What differs between organizations is mostly configuration, not new code, so the foundation your security review looks at stays the same from build to build.
Security and data residency
Where your data lives
Journey adds no new place for your data to live. Everything it stores is SharePoint content on a dedicated site in your own tenant.
- Journeys, tasks, acknowledgements, approvals, uploaded documents and the audit log are SharePoint list items and library files, under your security, retention and data residency settings.
- Task records are visible only to the new hire, their manager and the stream owners. Each new hire’s uploads go into a folder only they, their manager and HR can see.
- No separate database, server or vendor cloud. Nothing is hosted by iomer.
- People sign in with their Microsoft 365 accounts. People, managers and groups come from Entra ID through Microsoft Graph.
- Your content is stored by Microsoft 365, which Microsoft independently audits against standards such as ISO/IEC 27001 and SOC 2. Those reports cover Microsoft 365 itself, not iomer, and are in Microsoft’s Service Trust Portal.
Microsoft 365 updates
Built to keep working through Microsoft 365 updates
Journey uses supported Microsoft interfaces and standard SharePoint features, which keeps it clear of the usual causes of breakage after an update.
- SharePoint lists and libraries, with item-level and folder permissions, for every record
- Microsoft Graph, for people, managers and groups
- Power Automate with standard connectors, for approvals, rules, reminders and welcome emails
- The SharePoint site theme, which Journey takes by default
When Microsoft changes something Journey relies on, the change reaches you the same way as any other: a new version of your package, built, tested and installed by iomer.
Licensing prerequisites
Microsoft 365 plans Journey works with
| Microsoft 365 plan | Journey, approvals and reports | Updates by email or Teams | Rules on groups and Entra ID properties | Power BI dashboards (optional) |
|---|---|---|---|---|
| E5 | Included | Included | Included | Included |
| E3 | Included | Included | Included | Needs Power BI Pro to share |
| Business Premium | Included | Included | Included | Needs Power BI Pro to share |
| F3 (frontline) | Included | Included | Included | Needs Power BI Pro to share |
Journey uses SharePoint, Entra ID and Power Automate with standard connectors (SharePoint, Office 365 Outlook, Office 365 Users, Approvals and Microsoft Teams), which these plans include, so a standard deployment needs no premium licences. Everyone taking part needs a Microsoft 365 account. Some HR system connectors are premium; we check yours before we promise an integration. Checked against Microsoft’s documentation in September and October 2026. Microsoft changes plan contents, so check before you buy.
Specifications
What runs where
- Hosting
- All data stays in your Microsoft 365 tenant, on a dedicated SharePoint site. iomer holds none of it.
- Identity
- Entra ID through Microsoft Graph for people, managers and groups. Approver lists as a fallback where the manager field isn’t reliable.
- Automation
- Standard Power Automate connectors for approvals, assignment rules, reminders, escalations and welcome emails.
- Security
- Task records visible to the new hire, their manager and stream owners. A private upload folder per new hire.
- Task types
- Read a page or document, complete an action, attend a meeting or training, upload a form, acknowledge a policy or request an approval.
- Approvals
- Multi-level and sequential, from the Entra ID manager, the stream owner, an approver list or a group. Nobody decides two levels of one item, or their own. Delegation while away.
- Records
- Each task’s completion, who did it and when. Policy acknowledgements by version. An audit log that can’t be edited. Your retention rules apply.
- Notifications
- Always in Journey. Optionally by email or Teams, with welcome emails before the start date, set by one setting.
- Reporting
- Filter by stream, manager, department, location, person and start date. Charts, CSV export and Power BI.
- Branding and accessibility
- Inherits your SharePoint site theme, or a palette or brand colour. Status colours stay fixed. Reviewed against WCAG 2.2 AA.
Before you start
What you need
- Microsoft 365 with SharePoint Online and Power Automate
- An account for everyone taking part, new hires included
- Managers recorded in Entra ID, or approver lists
- A licensed service account with a mailbox to own the flows, and a Power Platform environment it can use
- A Microsoft 365 admin to approve the installation with us
Delivered by iomer
What we do
- Map your streams, approvals, policies and forms with you
- Build your organization’s deployment package
- Install it in your tenant and test it there, flows included
- Pilot it with real new hires
- Launch with administrator, stream owner and manager training
For your IT team
Plain facts to plan around
The details a Microsoft 365 admin asks about in the first meeting. Microsoft features and licensing change often; these were checked in September and October 2026.
The flows
Three optional flows deliver updates by email or Teams and send welcome emails. They run as a licensed service account that is a member of the Journey site, and SharePoint, Outlook and Teams must sit in the same data group in any data loss prevention policy. Add a co-owner so the flows aren’t lost if the account changes.
Timing and limits
On a standard Microsoft 365 licence, the trigger checks for new updates about every five minutes. Each update uses about ten Power Automate actions, well inside Microsoft’s daily limits. Power Automate stores approval records in your default Dataverse environment.
Manager data
Approvals resolve the manager through Microsoft Graph. Where the manager field is empty, Graph returns nothing, so Journey falls back to named approver lists. Fixing the field also helps Teams, people search and Copilot.
Volume and permissions
SharePoint recommends no more than 5,000 uniquely secured items per list. At around 30 tasks per journey, that’s reached at roughly 165 journeys, so every deployment sizes the design to your hiring volume, with column indexing and archiving of completed journeys where needed.
Electronic acknowledgement
Typed-name acknowledgements are generally accepted under Canadian and US electronic signature laws; ask your counsel to confirm.
Privacy
Uploaded documents such as photo ID and tax forms stay in a private folder per new hire, under your retention rules. We can describe the data and its flows for your privacy impact assessment, which Quebec’s Law 25 requires for new systems that handle personal information.
Could IT build this?
Lists and a flow are the easy part
You can. Journey is built from exactly those parts: SharePoint lists, Entra ID and Power Automate. The harder parts are a data model that copes with SharePoint’s limits, item-level security on every task and upload, multi-level approval routing from the org chart, and reporting across streams.
Home-grown builds tend to hit list view thresholds and permission sprawl a year in. That design work is what Journey brings, already built and tested on the same Microsoft 365 you would use.
Bring your IT team to the walkthrough
Watch the 40-second tour, or book a walkthrough and we’ll go through the lists, flows and Entra ID setup behind Journey and answer your security and licensing questions.