To automate onboarding and offboarding access, make the HR record the one place where a start, a team move or a leaving date is entered, and let your identity system, the central list of who can sign in, change accounts from it. This guide builds that in seven steps, from the HR trigger to user provisioning (creating and updating accounts and access for each person), then to exceptions, testing and a failure watch. It is for an IT manager, HR head or business owner at a mid-size firm in India or the GCC who already has an HR list, a sign-in system and a written leaver rule. It names no product and promises no time saving.
Last reviewed 2026-11-01 by Manish Sharma.
In short, the seven steps run in this order:
Choose it and its trigger fields.
Write standard access for each role.
Link the HR record to the identity system.
Keep start, move and leave separate.
Give each one an owner.
Run one real joiner and one real leaver.
Catch failures and keep a record.
The order is Signisys’ suggestion, not a standard.
How to Automate Onboarding and Offboarding, Step 1: Pick the HR Record That Starts Every Change
One system has to be the source. Signisys’ suggestion is the HR record, because it already holds who works for the firm and from which date. Your identity system then follows the HR record and nobody edits it by hand. Before you automate anything, the HR record has to be accurate enough to trust for onboarding new joiners and for offboarding leavers.
The trigger fields are the HR fields that start a change. These are Signisys’ suggestions: employment status, start date, leaving date, job role, team and line manager. A new record with a start date starts a joiner. A changed role, team or manager starts a move, and a leaving date or a status change starts a leaver. An empty role field leaves the rule nothing to choose access from, so check that every field has a value before you connect anything. User provisioning reads these fields, and it can only act on what they hold.
Someone also has to own the dates. Name the HR owner who enters and corrects them, because a wrong or late date carries through to the accounts. That is Signisys’ reasoning. The written leaver rule, who tells IT and the deadline the firm sets are in the written leaver rule in the implementation guide. This guide starts where that rule stops and sets no deadline.
Decision: which HR fields start each event, and who enters and corrects them.
Done when: every active person in the HR record has a role, a team, a manager and a start date, and one named person owns changes to them.
Step 2: Define Standard Access by Role
A role bundle is the set of accounts, groups and permissions that goes with one job. Signisys’ reasoning is that the automation can grant only what someone has written down, so the bundles come first. The idea builds on role-based access control, which ties access to the job rather than to the person. The automation applies a bundle when a person starts and removes it when the person leaves. Bundles also decide what you automate for onboarding and offboarding.
The head of each team approves what their roles need, and IT builds the bundle. That split is a suggestion. Start with the largest roles and add the rest later, which keeps the first version small enough to check.
Every person on the HR list also receives a baseline bundle, for example email and the main sign-in. When no bundle fits a case, the automation gives the baseline only. Extra access is then requested through an approver the firm names, with a reason on record. The approval workflow itself is outside this guide.
Decision: who approves each role’s bundle.
Done when: the three largest roles each have a written bundle that its team head has approved.
How to Automate Onboarding and Offboarding, Step 3: Connect HR to User Provisioning
User provisioning means creating accounts and access for a person, changing them as the job changes and removing them when the person leaves. Connecting the HR record to your identity system lets a change in HR start that work. CISA and NSA, in Identity and Access Management: Recommended Best Practices for Administrators, write that an identity governance system can use HR and personnel data to “automatically create accounts in directories and applications”. The guide is US guidance for administrators, gives no date and is advisory. It describes what such a system can do, not what every firm must do.
To automate onboarding and offboarding, the HR record can reach the identity system through a built-in connection, a scheduled file or a small script. Check your HR system’s and identity system’s documentation for which it offers. A tool choice is outside this guide.
The identity system then reaches each application in one of two ways. The application accepts a feed, meaning a regular automatic transfer of changes, through a standard such as SCIM (System for Cross-domain Identity Management), or it sits behind single sign-on, so that signing in to it follows the work account (an account held inside the application may remain; its documentation says). Ask each application’s documentation or supplier which it supports. Applications that support neither stay on a manual list (Step 5).
Decision: which applications to connect first.
Done when: a test record in HR creates the main account and the baseline bundle without anyone typing the person’s name into a second system.
Key Takeaway The HR record is the source, and a role bundle is what the automation grants.
How to Automate Onboarding and Offboarding, Step 4: Write Separate Rules for Start, Move and Leave
CISA and NSA describe Join, Move and Leave as the most critical identity lifecycle events. Each of the three changes different accounts. A firm that wants to automate onboarding and offboarding needs three rules, not one. Separate rules can keep a mistake in one from changing the others. That is Signisys’ reasoning.
The Start Rule: Create the Account and Apply the Role Bundle
On the start date, or a set time before it that the firm decides, user provisioning creates the account and applies the baseline and role bundle. Also send a notice to IT and the line manager so they can prepare equipment. Ask your identity system’s documentation whether it can hold an account disabled until the start date.
The Move Rule: Add the New Access and Remove the Old
A change of role, team or manager adds the new bundle and removes the old one. The removal is what keeps the old access from staying behind. Whether to add first or remove first is the firm’s decision. A short overlap lets a person keep working, and the firm sets how long. User provisioning for a mover is an add and a remove, not a new account.
The Leave Rule: Switch Off Sign-In First
CISA and NSA write that when users separate, “their accounts and privileges must be promptly terminated”. They add that an identity governance system can automate disablement and removal in response to separation actions in HR systems. “Promptly” has no number, and neither does this guide. Signisys’ suggested order is to switch off sign-in, then end sessions and remove group memberships, then remove application accounts and licences. A mailbox or data the firm needs to keep goes to a named person before removal, not deleted by the rule. The HR trigger can start device recovery, but a person does it. The article on where a leaver’s access can survive a closed account covers what a kept device or mailbox can leave open.
Decision: the order of changes for a leaver and what the firm keeps.
Done when: each of the three rules fits on one page and none edits what another rule owns.
Key Takeaway Start, move and leave each get their own rule, and sign-in goes off first for a leaver.
Step 5: Handle Exceptions by Hand, With an Owner
The automation covers the ordinary case, and it reaches only the systems you connect to it. Accounts a person made on outside services are not in this chain. A short written list says who handles each of the others, whether the person is in onboarding or in offboarding. Some cases do not fit the rule, and Signisys’ suggestion is to list them, each with a named owner and a place to record what the owner did. A case without an owner has nobody to act on it. A manual list is the fallback when user provisioning does not reach an application.
Contractors, agency staff and other outside parties are not on the HR list, so this guide leaves them out. A separate guide to managing outside access covers them.
Decision: who owns each exception.
Done when: each exception on the list has one named owner and a place to record what they did.
How to Automate Onboarding and Offboarding, Step 6: Test With One Real Joiner and One Real Leaver
Before you automate onboarding and offboarding for the whole firm, run each rule on one real case with a person watching: one joiner, one leaver and, if one arises, one mover. That is Signisys’ suggestion. If your identity system has a report-only or preview mode, use it first, and check its documentation.
This is an illustration, not a client: a procurement officer joins and another leaves.
A test shows whether user provisioning did what the role bundle says. Test accounts from user provisioning need clearing afterwards. The NCSC’s 10 Steps guidance on identity and access management (UK, 11 May 2021, written for cyber security professionals) says temporary accounts, perhaps created to test processes, should be removed or suspended once no longer needed. The page does not mention automation tests, so applying that line here is Signisys’ reasoning.
For a manual list to compare against, the scored checklist for leavers, movers and joiners covers the items to check at each event.
Decision: who runs the test and signs it off.
Done when: one real joiner and one real leaver have run through the rules, and a person has compared the result with the role bundle and the leave order.
How to Automate Onboarding and Offboarding, Step 7: Watch for Failures and Keep a Record
A rule that fails silently looks the same as one that worked until a person is missing access, or a leaver still has it. Signisys’ suggestion is that each failed or skipped change raises a message to a named person, and that the automation logs every run with the person, the change and the date. The firm decides where to keep the log. User provisioning errors, such as a change an application rejects, belong in the same log.
The failure watch sends a message to a named owner when a rule fails, when an HR field is missing, or when a connected application rejects a change, for onboarding as for offboarding. That owner reads the log at an interval the firm sets. In addition, the log answers the question “what did the automation do for this person?” without a search across several systems. That is Signisys’ reasoning, and the article makes no claim that a log satisfies an auditor or a standard.
When a role bundle or rule changes, write down the owner and the date. A scored test of the leaver rule sits in the identity and access management checklist, and a review method is in the implementation guide linked in Step 1.
Decision: who receives the failure message and who reads the log.
Done when: a deliberate failure in a test, for example a missing role field, reaches the named person.
Where This Guide Stops and What to Read Next
This guide covers how to automate onboarding and offboarding access, not the whole subject. It is a build order, not a tool choice. Its sources are UK guidance from the NCSC and US guidance from CISA and NSA. No Indian or GCC rules entered this research, and it says nothing about them. It gives no time saving and no statistic. It leaves out contractors and outside parties, the ways a leaver’s access can survive, and the list of items to check at each event. Separate articles will cover those, and a comparison of tools is in the guide to choosing tools for joiner, mover and leaver changes.
The joiner and leaver use case describes the wider picture, and the glossary entry on identity and access management defines the field.
If the HR record is incomplete, several applications do not accept a feed, or you do not know what a rule changed, ask an identity specialist to review the design before you switch it on.
Signisys offers identity and access management services, and this is a Signisys offer, not neutral advice.
Signisys provides identity and access management, helping organisations control who can access what, with single sign-on, strong authentication, privileged access and automated provisioning. Signisys agrees the exact scope for each engagement. Our Solution: Identity and Access Management (IAM). Our Service: Cybersecurity Services.
How to Automate Onboarding and Offboarding FAQ
How can I automate employee onboarding and offboarding?
What is automated onboarding?
What is user provisioning?
Do I need to connect every application at once?
What happens if HR corrects a leaving date after the rule has run?
Security Insights, Delivered.
Practical, vendor-neutral analysis of threats, tools, and architecture decisions.