New Hire Onboarding
Employee has SSO, laptop, Slack, calendar access on day 0
The first 24 hours of a new hire's tenure decide the next 24 months. Every missed account, missing device, or day-1 handbook confusion costs momentum you cannot recover. But onboarding is the messiest cross-team workflow in the company — HRIS fires an event, IT provisions accounts, facilities ships a laptop, finance issues a card, the manager schedules 1:1s, security enrols the device in MDM. Anything that runs by ticket or spreadsheet drifts within a quarter.
An hour-by-hour walkthrough.
Step by step.
- 01
Read the HRIS payload
New-hire webhook fires from Workday / BambooHR / HiBob / Rippling / ADP with the requisition data. Harry parses name, email, role, manager, team, location, start date, employment type (FTE / contractor / intern).
HRIS - 02
Resolve manager and team
Look up the manager's identity in the Context Graph, resolve the team's default onboarding template (which SSO groups, which SaaS licences, which device SKU), check for VIP flag which routes through a separate skip-level review path.
Context Graph - 03
Provision identity and SSO groups
Create the Okta / Microsoft Entra ID user, add to SSO groups per the role template, reserve mail alias in Google Workspace or Microsoft 365, assign licences. All writes idempotent — a re-run of the playbook on a race condition doesn't double-provision.
Okta · Google Workspace · Microsoft 365 - 04
Assign device via MDM
Trigger the device order through your procurement API (CDW, Apple Business Manager, Lenovo direct), schedule Jamf / Intune / Kandji auto-enrolment so the laptop is ready to log in the moment it powers on.
Jamf Pro · Intune · Kandji - 05
Send welcome pack + Day-1 tasks
Deliver the handbook, benefits guide, buddy intro, first-week reading, IP-assignment DocuSign envelope. Personalised by role: engineers get repo access + on-call rota, salespeople get territory + comp doc + Gong access.
Slack · Email · DocuSign · LMS - 06
Notify manager and buddy
Manager gets a status card with green/amber/red per provisioning step. Buddy gets a warm intro DM with the first-week meeting scheduled. Both parties know exactly what's ready and what to do next.
Slack
What you connect to make this run.
Workday · BambooHR · HiBob · Rippling · ADP
triggerEnable webhook on the new-hire event (usually named `worker.hire` or similar). Point to the BeforeQuery HRIS webhook URL. On payload we verify the signature and enqueue the playbook.
Okta · Microsoft Entra ID · Google Workspace
writeCreate a service account / app registration with scopes to create users, add to groups, assign licences. Store in Models Studio; every action idempotent by external_id.
Jamf Pro · Intune · Kandji
writeOAuth or API-key credential with scopes to create device records, assign to user, schedule auto-enrolment. MDM does the actual device wipe/setup; we just orchestrate.
Slack
writeInstall the BeforeQuery bot in the workspace. Bot posts DMs to manager + buddy, adds new hire to team + org channels per the role template.
DocuSign
writeOAuth token with envelope-create scope. IP-assignment template pre-configured with signer fields; Harry fills the merge fields and sends.
Context Graph
read+writeEvery provisioning action writes edges (identity → group, identity → device, identity → manager). Downstream playbooks (offboarding, JIT access, VIP fast-track) read those edges.
Before and after, honestly.
Playbooks that pair with this one.
Employee Offboarding
The inverse workflow — clean deprovisioning across the same systems.
New-Hire Handoff
Coordinates the human hand-offs (manager, buddy, IT, facilities) beside this technical provisioning.
30/60/90-Day Check-Ins
The follow-up cadence this playbook schedules.
Onboarding Stall Detection
The watchdog that catches when an onboarding hire's Day-3 or Day-7 tasks slip.
New Hire Provisioning
The IT-owned view of the same underlying provisioning flow.
Answers about this playbook.
What if the HRIS event fires and the manager isn't identified?
The playbook holds. Harry posts to your HR-ops channel with the requisition data and asks who the manager is. Once resolved (by reply or dashboard), the playbook resumes automatically. Never provisions to a hire without a manager on record.
How does it handle contractors vs. full-time employees?
The role template carries the employment type. Contractors get a scoped-access template (fewer licences, contract-end-date on every group grant so offboarding fires automatically). FTEs get the standard package. Interns get a third variant with mentor assignment.
What if the device order can't ship in time?
Harry detects the delivery slip from the procurement API, posts a status update to the manager, and offers a loaner device via the RMA / loaner playbook. New-hire access still works from the loaner; the primary device swaps in on arrival.
Does the manager need to do anything before Day 0?
Two things: confirm the buddy assignment (Harry asks in Slack; a 3-word reply is enough), and confirm the Day-1 meeting on the calendar (Harry schedules it, manager just accepts). Everything else runs on autopilot with status cards.
Can we customise the welcome pack per team?
Yes. The team template holds a Day-1 doc list; engineering gets repo access + on-call, sales gets territory + comp + Gong, etc. Update the template in Playbook Studio; the change applies to the next hire without touching the playbook.
What happens if a new hire is rehired within a year?
Harry checks the Context Graph for a prior identity with the same email. If found, offers a rehire path that preserves badge number, historical audit trail, and equipment history — while re-issuing new credentials and re-consenting to policies. Prevents both duplicate records and stale-account revivals.
See it run on your data.
Free plan, no credit card. Connect the systems this playbook needs and run it against a past event first.