Employee onboarding
An end-to-end joiner project: from HR hire event to day-one access.
This project automates onboarding: when HR marks someone hired, SailPoint creates their identity, assigns birthright roles, and provisions day-one access automatically.
- Trigger from an HR hire event
- Create the identity cube
- Assign birthright roles
- Provision day-one accounts
Employee onboarding (the joiner process) is usually the first automation a SailPoint programme delivers, because its value is immediate and visible: a new hire is productive on day one with zero manual access tickets. This project connects the HR event to automatic identity creation and birthright provisioning.
The goal
When HR marks someone as hired, SailPoint should create their identity, assign the baseline access their role, department and location require, and provision the underlying accounts, all before the person walks in the door.
How to build it
- Configure the HR system as the authoritative source and map the worker attributes that drive access.
- Detect the hire via a lifecycle event (or lifecycle state) triggered by the new worker appearing.
- Define birthright access as roles with membership criteria (e.g. all full-time Finance staff in the EU).
- Provision the day-one accounts (AD, email, core apps) through connectors.
- Notify the manager and new hire, and log the whole process for audit.
Design considerations
The central design decision is what counts as birthright. Too little and new hires raise tickets on day one, undermining the whole point; too much and you institutionalise over-privilege. Model birthright tightly around genuine day-one needs, and route anything beyond it through the request catalogue. Also handle pre-hire timing, some organisations provision a few days ahead of the start date.
Common pitfalls
- Over-broad birthright granting more than day-one needs.
- Dirty HR attributes causing wrong-department provisioning.
- No handling of pre-start or future-dated hires.