Employee onboarding
Quick answer
This project automates onboarding: when HR marks someone hired, SailPoint creates their identity, assigns birthright roles, and provisions day-one access automatically.
Key takeaways
- Trigger from an HR hire event
- Create the identity cube
- Assign birthright roles
- Provision day-one accounts
Employee onboarding (the joiner process) is usually the first automation a SailPoint programme delivers, because its value is immediate and visible: a new hire is productive on day one with zero manual access tickets. This project connects the HR event to automatic identity creation and birthright provisioning.
The goal
When HR marks someone as hired, SailPoint should create their identity, assign the baseline access their role, department and location require, and provision the underlying accounts, all before the person walks in the door.
How to build it
- Configure the HR system as the authoritative source and map the worker attributes that drive access.
- Detect the hire via a lifecycle event (or lifecycle state) triggered by the new worker appearing.
- Define birthright access as roles with membership criteria (e.g. all full-time Finance staff in the EU).
- Provision the day-one accounts (AD, email, core apps) through connectors.
- Notify the manager and new hire, and log the whole process for audit.
Design considerations
The central design decision is what counts as birthright. Too little and new hires raise tickets on day one, undermining the whole point; too much and you institutionalise over-privilege. Model birthright tightly around genuine day-one needs, and route anything beyond it through the request catalogue. Also handle pre-hire timing, some organisations provision a few days ahead of the start date.
Common pitfalls
- Over-broad birthright granting more than day-one needs.
- Dirty HR attributes causing wrong-department provisioning.
- No handling of pre-start or future-dated hires.
Want to learn this properly?
Our live, instructor-led SailPoint Training covers this hands-on, with real projects and a certification path.
Check your understanding
What triggers onboarding?
- A. Baseline access every new hire gets automatically based on attributes.
- B. Day-one access with no manual tickets.
- C. A hire event from the HR authoritative source.
Show answer
C. A hire event from the HR authoritative source.
A hire event from the HR authoritative source.
What is birthright access?
- A. Baseline access every new hire gets automatically based on attributes.
- B. A hire event from the HR authoritative source.
- C. Day-one access with no manual tickets.
Show answer
A. Baseline access every new hire gets automatically based on attributes.
Baseline access every new hire gets automatically based on attributes.
What is the goal?
- A. Baseline access every new hire gets automatically based on attributes.
- B. A hire event from the HR authoritative source.
- C. Day-one access with no manual tickets.
Show answer
C. Day-one access with no manual tickets.
Day-one access with no manual tickets.