This is the work that quietly consumes a service desk, and it is usually solved with custom scripts that only their author understands.
The shape that scales
A client is a configuration. The lifecycle is one shared process.
Shared everywhere: the request form, who approves, the order of the steps, the verification that runs afterwards, and the audit record.
Per client, by configuration: groups, licences, naming conventions, the approver, the systems in scope, and any genuine exceptions.
The test is the same as any multi unit rollout. Write down what changes between client one and client two. If it is all values, you can standardise. If it includes logic, fix that first.
Build offboarding first
Most teams build onboarding first because it is the one people complain about. That is the wrong order.
Onboarding fails loudly. Someone cannot log in and you hear within minutes.
Offboarding fails silently. An account stays live, a licence keeps billing, access to a shared drive is never revoked. Nobody reports it. It sits open until an audit or an incident finds it.
Build the one that fails silently first, and put the noisy one second.
Verify the end state, not the run
The automation reporting success means it executed. It does not mean the state is correct.
After each run, verify: does this account exist, in these groups, with these licences, and are these accesses removed. Check the state rather than the log, because a green execution with a wrong outcome is the failure mode that survives longest.
One form, conditional fields
The recurring debate is one form for all clients or one per client. One form, with fields that change based on the client configuration.
Separate forms multiply maintenance and drift, and the differences between clients are almost always values rather than different logic.
Handle exceptions without breaking the model
There will be a client who genuinely needs something different. Make it a configuration value with a name, not a branch in the code.
The moment an exception requires different logic, you have found either something that belongs in the shared process because others will need it, or something that should not exist.
What this leaves you
A process that survives the person who built it, an audit trail per client, and a verification report you can show at renewal.
That last one is worth more commercially than the hours saved, because it is evidence of a control the client cannot easily check themselves.