Onboarding automation: HR as the source of truth for accounts and access

Reference article · 5 min read

A new employee's information usually exists in the HR system days or weeks before that person needs a login. The distance between those two facts is where most onboarding pain lives. A name gets rekeyed into a ticket, the ticket waits in a queue, and a supervisor answers the access question with "same as the last person in that job." On the other end, separations are communicated by email, by hallway conversation, or not at all, and accounts stay live long after the badge is turned in.

Treating the HR system as the authoritative source for workforce identity closes both gaps with the same plumbing. The HR record becomes the trigger, the position determines baseline access, and downstream systems subscribe to changes instead of waiting to be told by hand. That pattern is usually called joiner-mover-leaver, and most agencies can build a useful version of it with the HR platform and directory they already own.

Decide what HR owns and what it does not

• HR owns identity facts. Legal name, preferred name, employee number, hire and separation dates, job code, department, work location, supervisor, and worker type: regular employee, sworn, temporary, seasonal, intern, elected official.
• IT owns the translation. Username format, mailbox and license assignment, directory group membership, device standards, and the rules that turn a job code into entitlements.
• Application owners keep their approvals. HR data decides who is considered for access to a records or permit system, not who is granted it.

Decide early where contractors, volunteers, reserve officers, and board members will live. They are often absent from payroll, and without a sponsored identity process they become accounts nobody reviews.

Build the position-to-access map before you buy a tool

The hard part of provisioning is not the connector. It is agreeing on what a job should be able to reach, a data exercise for department leadership.

• Map the common cases first. Most of the workforce falls into a modest number of repeatable roles: field crew, front counter, dispatcher, accountant, caseworker, patrol officer.
• Treat anything outside the baseline as a request with an owner, an approval, and an expiration date.
• Avoid roles that are really one person's accumulated history. If a role cannot be described in a sentence a supervisor understands, it is not a role yet.

The joiner sequence

Once the map exists, provisioning can run on effective dates rather than on emails.

1. The HR record reaches a committed state with a start date.
2. An identity is created in the directory ahead of day one, pre-staged and inactive until that date.
3. Email, phone extension, baseline groups, file share access, and a device order follow from the role bundle.
4. A badge request goes to physical security from the same record, so badge, account, and payroll point at one person.
5. Required training is enrolled in the learning system, with due dates tied to the start date.
6. Multifactor enrollment happens through a proofing step in which someone verifies the new hire, not by emailed link alone.

Pre-staging matters: it gives the supervisor time to review what was provisioned before the employee arrives.

Movers and leavers

Movers are where access quietly accumulates. A transfer should remove the previous role's access, not add the new role on top of it. Where overlap is needed during a handoff, time-box it.

Leavers deserve the most attention: the risk is immediate and the automation is simplest.

• Use the separation date from HR, and keep a documented manual path for same-day emergency terminations.
• Revoke active sessions and tokens, not just the password. Disabling an account while a session stays alive is a common gap.
• Disable rather than delete, and hold the account for a defined retention period so records requests and investigations remain answerable.
• Notify owners of systems with locally managed accounts, and track badge, device, keys, and purchasing cards on the same checklist so return is visible.

Where a human stays in the loop

Automation should move work, not judgment. Keep an explicit approval gate, with the decision recorded, in these cases.

• Sworn and public safety roles. Access to criminal justice information carries screening, training, and authentication requirements under the FBI CJIS Security Policy, administered through your state's CJIS Systems Agency. Specifics change between policy revisions and states add their own conditions, so confirm requirements with your CJIS Systems Officer and agency counsel.
• Privileged and administrative accounts. These should never be granted by job code alone.
• Protected data. Health information, student records, tax data, and court records carry their own eligibility and training conditions.
• Exceptions to the role map. Grant them with a named approver and an expiration.

Automation still helps: it assembles the request, routes it, and provisions once the approval is recorded.

What to automate first, and what to ask

Start with leavers: smallest scope, clearest risk reduction, and proof that the HR feed works. Then automate directory account creation and baseline groups for joiners. Add role bundles, training, and badge requests once the map has survived a few months of real hires.

When evaluating a product or an integrator, ask:

• How are HR changes consumed, and does the integration honor future-dated records and retroactive corrections?
• How are rehires and name changes handled without creating duplicate identities?
• Can approval gates be set per role, and is each approval kept as an auditable record?
• What audit logs are produced, and can the agency export them independently?

In the contract, require the attribute mapping and connector configuration as agency-owned deliverables, a test environment with non-production HR data, runbooks for break-glass provisioning, and exportable logs. Those terms let your staff run the process after the implementation team leaves.

HQT builds and integrates identity, directory, and workflow automation systems for state and local government agencies.

Frequently asked questions