It was built as a standalone sample-data project to demonstrate how an onboarding process could move from manual emailed documents into a structured review workflow with invites, submissions, document requirements, review steps, missing-information follow-up, SharePoint-backed uploads, reporting, and activity history.
This proof is not connected to OSHE systems and is not production-ready. It is intended as a safe visual and technical proof-of-concept.
OnboardingFlow demonstrates a complete onboarding review loop:
- An admin creates an onboarding template.
- An admin creates an invite for an applicant.
- The applicant opens a public onboarding link.
- The applicant submits details and uploads required documents.
- Uploaded documents are stored through SharePoint.
- A reviewer checks the submission, checklist, and document requirements.
- If information is missing, the reviewer can request updates.
- The applicant can reopen the same link and resubmit.
- The reviewer continues review and can approve the onboarding.
- Activity history and reports show the workflow trail.
The purpose of the proof is to make the workflow easier to review visually before any real pilot or production work is considered.
A full walkthrough video is available here:
OnboardingFlow Proof-of-Concept Walkthrough
The walkthrough demonstrates the full sample workflow, including invite tracking, public submission, SharePoint document uploads, reviewer checks, missing-information follow-up, applicant resubmission, activity history, and reporting.
Screenshots are stored in:
docs/screenshots/
- Template-based onboarding invites
- Public applicant onboarding form
- Submission tracking
- Required document tracking
- SharePoint-backed document uploads
- Reviewer checklist
- Missing-information detection
- Missing-information follow-up messages
- Applicant resubmission workflow
- Admin / Reviewer / Read-only roles
- Activity history / audit trail
- Reports page
- CSV export
- Microsoft Graph invite email sending
- Microsoft Graph needs-info follow-up email sending
- Microsoft 365 integration path
- Laravel
- PHP
- MySQL
- Blade
- Tailwind CSS
- Microsoft Graph
- Outlook email sending
- SharePoint document storage
- Laragon for fast local PHP/MySQL proof-of-concept development
- Composer
- npm / Vite
- Cursor for AI-assisted code editing and project iteration
- ChatGPT for planning, debugging support, documentation drafting, QA planning, demo review, and packaging
- Git / GitHub for version control and project presentation
This proof-of-concept was built locally using Laragon to move quickly on a Windows development machine.
Laragon was used for the proof because the priority was to rapidly validate the onboarding workflow, database structure, Microsoft Graph email flow, SharePoint document uploads, reviewer process, QA checklist, screenshots, and demo packaging.
This does not mean Laragon would be the preferred environment for a real pilot or production project.
For a production-aligned setup, the environment should be reviewed against the organisation's existing stack, development standards, deployment process, hosting approach, and security requirements. Based on the stack previously described for the live environment, that may include Laravel/PHP, MySQL, Composer, npm, Git, React/JavaScript, Tailwind CSS, Lando, Docker, Linux hosting, and the organisation's existing hosting/security requirements.
The proof should therefore be read as a workflow and technical direction prototype, not as a production deployment model.
- Log in as admin.
- Open the dashboard.
- Open the invite list.
- Open an onboarding invite.
- Open the public applicant form.
- Submit applicant details and upload required documents.
- Confirm uploaded files appear in SharePoint.
- Review uploaded documents from the admin/reviewer screen.
- Mark the invite as Needs Info.
- Preview or send the needs-info follow-up email.
- Open the same public link in resubmission mode.
- Resubmit missing information and documents.
- Log in as reviewer.
- Complete document review and checklist items.
- View the activity log and reports.
After seeding:
admin@example.com / password
reviewer@example.com / password
readonly@example.com / password
Admin users can:
- Create templates
- Create invites
- Send invite emails
- Review submissions
- Update document status
- Add notes
- Send needs-info emails
- Export CSV
- View reports and activity history
Reviewer users can:
- Review submissions
- Update checklists
- Mark documents provided/reviewed/missing/not required
- Add missing-information follow-ups
- Send needs-info emails
- Add notes
- Export CSV
- View reports and activity history
Reviewer users cannot:
- Create invites
- Create templates
- Send original invite emails
Read-only users can:
- View dashboards
- View invites
- View templates
- View reports
- View activity history
Read-only users cannot:
- Create records
- Send emails
- Update review fields
- Upload or review documents
- Add notes
- Export CSV
Copy .env.example to .env and configure the local database and Microsoft 365 values as required.
Real secrets, tenant IDs, client secrets, and production configuration values should never be committed to source control.
Example placeholders:
ONBOARDING_EMAIL_PROVIDER=microsoft_graph
ONBOARDING_DOCUMENT_STORAGE_PROVIDER=sharepoint
MICROSOFT_TENANT_ID=
MICROSOFT_CLIENT_ID=
MICROSOFT_CLIENT_SECRET=
MICROSOFT_MAIL_FROM=
MICROSOFT_SHAREPOINT_SITE_ID=
MICROSOFT_SHAREPOINT_DRIVE_ID=
MICROSOFT_SHAREPOINT_FOLDER=OnboardingFlowInstall dependencies:
composer install
npm ciCreate app key:
php artisan key:generateRun migrations and seed demo users:
php artisan migrate
php artisan db:seed --class=DemoUserSeederRun the app:
php artisan serve
npm run devOpen:
http://127.0.0.1:8000/login
OnboardingFlow uses Microsoft Graph as one possible integration path for email sending and SharePoint document storage.
This proof-of-concept uses sample data and is not connected to OSHE systems.
The app registration requires Microsoft Graph application permissions for the proof:
Mail.SendSites.ReadWrite.AllFiles.ReadWrite.All
Admin consent must be granted in Microsoft Entra.
Graph Explorer permissions are only useful for testing Graph requests and finding IDs manually.
The Laravel app uses the app registration credentials from .env, so the app registration itself must have the required Microsoft Graph application permissions and admin consent.
Invite emails and needs-info follow-up emails are sent through Microsoft Graph using the configured Microsoft 365 mailbox.
The proof successfully tested internal tenant delivery.
External delivery from a new or development Microsoft 365 tenant may be blocked by Microsoft outbound protection, including NDR code:
550 5.7.708 Access denied, traffic not accepted from this IP
This is a Microsoft 365 tenant/mail reputation limitation, not an application workflow failure.
For a real pilot, external sending should use the organisation's production tenant/domain, proper SPF/DKIM/DMARC configuration, and Microsoft support clearance if required.
Required document uploads are stored in SharePoint through Microsoft Graph.
Each document requirement stores SharePoint metadata, including:
- Drive ID
- Item ID
- Web URL
- Original filename
- MIME type
- File size
- Upload timestamp
OnboardingFlow is currently a proof-of-concept using sample data.
It demonstrates a possible workflow direction for tracked onboarding invites, applicant submissions, document requirements, reviewer actions, missing-information follow-up, reporting, and audit history.
| Area | Proof Status |
|---|---|
| Invites | Template-based invites are working |
| Applicant form | Public onboarding form is working |
| Documents | Required document tracking is working |
| SharePoint uploads | Files upload to SharePoint through Microsoft Graph |
| Review checklist | Reviewer checklist is working |
| Missing info | Missing-information follow-up and resubmission flow is working |
| Roles | Admin, Reviewer, and Read-only roles are working |
| Microsoft Graph invite and needs-info emails are working internally | |
| Reports | Reports page and CSV export are working |
| Activity log | Workflow actions are logged with actor attribution |
| Area | Proof Status | Production Requirement |
|---|---|---|
| Microsoft Graph works internally | Production tenant/domain deliverability review | |
| Documents | SharePoint upload works | Retention, permissions, malware scanning, file policy |
| Auth | Local demo users | Organisation login / SSO / access policy |
| Data | Sample data | Approved real data model |
| Deployment | Local Laravel app | Hosted environment, backups, monitoring |
| Secrets | Local .env |
Secure secrets management |
| Audit | Activity log proof | Formal audit retention policy |
| Privacy | Sample data only | Privacy review and data handling policy |
Before a real pilot or production deployment, the following would need review:
- Security review
- Privacy review
- Real organisation data requirements
- User acceptance testing
- Error handling and monitoring
- Backup and recovery process
- Data retention policy
- Access control review
- Microsoft 365 tenant/domain configuration
- Deployment process
- Logging and audit retention
- Email deliverability review
- File upload restrictions and malware scanning
- Secrets management
This proof is intentionally limited.
Known limitations include:
- It uses sample data only.
- It is not connected to OSHE systems.
- It is not production-hardened.
- Local demo users are used instead of organisation SSO.
- Microsoft 365 external delivery may be blocked from a new/development tenant.
- File upload security requires production review.
- SharePoint permissions and retention rules require production planning.
- Error handling and monitoring are proof-level only.
- No formal privacy review has been completed.
- No malware scanning workflow has been added.
- No production backup/restore plan has been implemented.
- The current workflow is based on assumed onboarding requirements and would need stakeholder validation.
A possible pilot path would be:
- Review the workflow with stakeholders.
- Confirm the real onboarding fields.
- Confirm the required document types.
- Confirm whether Microsoft 365 is the preferred integration path.
- Confirm email and SharePoint ownership.
- Replace sample data with approved test data.
- Review access roles and approval rules.
- Review privacy and retention requirements.
- Harden authentication and file handling.
- Deploy to a controlled pilot environment.
- Run user acceptance testing.
- Gather feedback.
- Decide whether to continue, revise, or retire the proof.
The following manual QA checks were performed against the proof-of-concept demo workflow.
- Can log in as admin
- Can view dashboard
- Can create onboarding template
- Can create onboarding invite
- Can preview invite email
- Can send invite email through Microsoft Graph
- Can view invite details
- Can update invite status
- Can add internal notes
- Can update review checklist
- Can update document requirement status
- Can view reports
- Can export CSV
- Can open public onboarding link
- Can view invite details
- Can submit onboarding form
- Can upload required documents
- Uploaded documents appear in SharePoint
- Can reopen same link when invite is marked Needs Info
- Can update missing information
- Can upload missing documents
- Resubmission returns invite to In Review
- Can log in as reviewer
- Can view dashboard
- Can view invites
- Can update review checklist
- Can mark documents Provided / Reviewed / Missing / Not Required
- Can add missing-information follow-up
- Can send needs-info email
- Can add internal notes
- Can export CSV
- Cannot create invite
- Cannot create template
- Cannot send original invite email
- Can log in as read-only
- Can view dashboard
- Can view invite details
- Can view templates
- Can view reports
- Can view activity log
- Cannot create invite
- Cannot create template
- Cannot send emails
- Cannot update review checklist
- Cannot update document status
- Cannot add notes
- Cannot export CSV
- Invite email sends internally through Microsoft Graph
- Needs-info email sends internally through Microsoft Graph
- Uploaded files appear in SharePoint
- SharePoint file links open from admin invite detail
- External personal Outlook delivery limitation documented
- Invite creation is logged
- Applicant form opened is logged
- Applicant submission is logged
- Document upload is logged
- Reviewer actions show reviewer name
- Needs-info email send is logged
- Applicant resubmission is logged
Recommended length: 5 to 13 minutes depending on whether it is a quick overview or full walkthrough.
- Screen recording only
- Minimal speaking
- Clean intro voiceover
- Text/caption cards during the workflow
- Clean closing voiceover
- No code explanation required
- No secrets or private tabs visible
- Dashboard
- Invite list
- Invite detail
- Public onboarding form
- Document upload
- SharePoint uploaded file
- Reviewer checklist and document review
- Needs-info follow-up email preview
- Public resubmission mode
- Activity log
- Reports
- Roles and access
The docs folder also contains standalone versions of the project notes:
docs/project-summary.mddocs/demo-script.mddocs/demo-video-plan.mddocs/manual-qa-checklist.mddocs/microsoft-365-setup.mddocs/production-readiness.mddocs/known-limitations.mddocs/pilot-next-steps.mddocs/screenshots/
This proof-of-concept was built with AI-assisted development support using Cursor and ChatGPT.
Cursor was used as the AI-assisted code editing environment to apply, review, and iterate on changes inside the Laravel project. ChatGPT was used to help plan the workflow, generate and refine code, debug issues, draft documentation, prepare QA checklists, review demo flow, and package the project for presentation.
The workflow direction, business logic, testing, integration decisions, review, and final implementation choices were manually guided and validated.
Because the real application environment would involve production users, security, hosting, deployment processes, and existing development standards, this project should be reviewed as a proof-of-concept only, not as production-ready software.
This project uses sample data and is separate from any real organisation systems.
It should be treated as a visual and technical proof-of-concept, not a production system.
OnboardingFlow is closed at v1.0.0 as a synthetic Laravel workflow proof.
The final release includes meaningful automated workflow and access tests, PHP 8.3-8.5 CI, security and production boundaries, and the approved eleven-image evidence set:
docs/screenshot-groups/screenshot-group-01-onboarding-workflow-closure
Created and developed by Codie Shannon.