New-hire onboarding fails in the gap between systems, not inside any one of them. HR enters a hire in the HRIS, and from that single event a laptop needs imaging, a directory account needs provisioning, a dozen SaaS licences need assigning, a badge needs printing, and payroll needs the person on the next run — each owned by a different team, each with its own system of record. Automating onboarding means wiring those systems to a shared trigger and shared identity, not adding another checklist app on top.
The hire event as the trigger
Every reliable onboarding pipeline starts from one authoritative event: a new hire record created or a status change to "active" in the HRIS (Workday, BambooHR, SAP SuccessFactors). That event needs a stable identifier — employee ID, not name — and enough attributes (start date, department, manager, employment type, location) to drive every downstream decision. If IT provisioning is triggered by a spreadsheet or a Slack message instead of the HRIS event, you get race conditions: accounts created before the offer is signed, or contractors granted the same access as full-time employees because nobody encoded the distinction.
The HRIS should own "who is this person and when do they start." Everything else — identity, access, equipment, training — subscribes to that record rather than maintaining a parallel copy of it.
Identity provisioning and the identity provider
The identity provider (Okta, Entra ID, Google Workspace) is the fan-out point. A SCIM integration between the HRIS and the IdP is the least fragile way to keep this in sync: the HRIS pushes a user object, the IdP creates the account, and group membership derives from attributes like department and job code rather than being set by hand. Manual account creation is where onboarding automation quietly dies — someone is on PTO, the ticket sits for two days, and the new hire's first day is spent unable to log in.
Map department and role to IdP groups once, and every new hire in that department inherits the right SaaS licences and channel access automatically. The alternative — an IT admin eyeballing "what did the last person in this role get" — drifts within a quarter and becomes an audit finding.
Least privilege and ITSM approval
Not every access request should auto-approve. Baseline access — email, chat, core productivity apps — can provision automatically off the HRIS event. Anything touching finance, source code, or customer data should route through an ITSM workflow (ServiceNow, Jira Service Management) with a named approver, even if that approval happens within minutes. The automation's job is to generate the right request with the right approver pre-filled, not to skip the approval step entirely.
Teams build elaborate onboarding automation and then delete offboarding accounts by hand, months late. Wire the same HRIS event — termination or status change — to revoke IdP sessions and remove group membership immediately. An orphaned account with standing access is the most common finding in a SOC 2 access review.
Equipment and physical provisioning
Laptop imaging and shipping is the one leg of onboarding that has real lead time — MDM enrollment profiles (Jamf, Intune) need to be assigned before the device leaves the warehouse, and shipping to a remote hire takes days, not minutes. This is why the trigger has to fire on hire-record creation, not on start date: a five-business-day lead time means IT needs the signal a week before day one, and the automation should compute that lead time from the start date rather than have someone eyeball a calendar.
{
"event": "worker.hire.created",
"employeeId": "E10432",
"startDate": "2026-08-03",
"department": "Engineering",
"manager": "E08221",
"employmentType": "full_time",
"location": "Nairobi-Remote",
"provisioning": {
"idp_groups": ["eng-all", "github-org", "vpn-standard"],
"itsm_requests": ["prod-db-readonly"],
"equipment": {"profile": "engineer-laptop-14", "ship_by": "2026-07-27"}
}
}Training and compliance tracking
Mandatory training (security awareness, code of conduct, region-specific compliance) is easy to automate the assignment of and easy to forget the enforcement of. The LMS should receive the same hire event and auto-enrol the new employee in the right curriculum based on role and jurisdiction, but the useful automation is the escalation: if a course isn't completed by day 14, notify the manager, not just the employee. Completion status feeding back into the HRIS closes the loop so compliance reporting doesn't require someone manually cross-referencing spreadsheets before an audit.
| System | Owns | Triggered by |
|---|---|---|
| HRIS | Employee record, start date, org data | Offer acceptance |
| Identity provider | Accounts, group membership, SSO | HRIS event via SCIM |
| ITSM | Non-standard access approvals | Provisioning request |
| MDM | Device enrollment and imaging | Lead-time offset from start date |
| Payroll | Compensation, tax setup | HRIS event, separate SLA |
None of this requires a unified onboarding platform to replace the HRIS, IdP, or ITSM — it requires picking one system as the source of truth for the hire event and making every other system a subscriber to it. Get that wiring right and the checklist app on top becomes optional; get it wrong and no amount of workflow tooling fixes accounts that were never in sync to begin with.
Independent software engineer in Nairobi specialising in Acumatica customisations, Laravel backends, and tax fiscalisation integrations across East and Southern Africa.