Automating employee onboarding: preparing accounts, devices and access

New starters need the right accounts, devices and access from day one. If that is done by hand every time, it is worth looking at the process. I have automated employee onboarding for seven clients, from the entry in the HR system to a device that sets itself up the first time it is switched on. I show which steps can be linked up and which approvals should deliberately stay with a person.

Where the time goes in employee onboarding

Without automation, setting up a new starter is a series of small tasks: create the user account, assign groups and licences, find a free device, set it up, install software, prepare the phone. None of these steps is difficult. Together, though, they took my clients several hours per person, and any single step can be forgotten.

On top of that, the information sits in different places. HR knows the name, department and start date, while IT often hears about it shortly before. If you want to automate employee onboarding, the first step is to reverse the order: the data HR already maintains in its system triggers everything else.

How automated employee onboarding works

At my clients, the process roughly follows this order. The details vary with the environment; the principle stays the same.

1. The start date is fixed. Only once the date is entered and confirmed in the HR system, Personio for example, does the process start.
2. User account. In hybrid environments I first create the user in the on-premises Active Directory, with the details from the HR system. Synchronisation then carries the account over to Microsoft 365. In cloud-only environments, the account goes straight into Microsoft 365.
3. Asset management. As soon as the account exists, the workflow adds the person to the inventory and assigns free hardware.
4. Groups. Security groups, some of them assigned automatically according to agreed roles, determine which licences, software and settings someone receives.
5. Rollout. On first start, the device enrols itself and sets itself up according to these groups: Windows through Autopilot, Apple devices through Apple Business Manager and Intune.

This last step matches what I described for phones that set themselves up. The case study on device management with Intune and Apple Business Manager shows what this looks like for a growing company with many devices out in the field.

What I use to automate onboarding

As far as possible I build with built-in tools, meaning what the environment already has. That keeps the number of systems involved small and makes the solution easy for others to follow.

Monitoring is not an extra. Personio, for instance, expects the receiver of a webhook to respond within three seconds and otherwise retries for up to three days. If something goes wrong in that time, someone arrives on their first day without an account. An alert the day before is far more pleasant.

Where a person still decides

The basic setup can be fully automated: account, mailbox, licences, device, standard software. With permissions, I draw a line. I grant access to drives, SharePoint areas and line-of-business applications through groups that someone assigns to a person deliberately. The assignment itself runs automatically; the decision comes from someone who knows what the person needs. I consider automatically granted access to sensitive data dangerous. Before someone starts work, a member of the IT team therefore checks that they are in the right security groups.

Leaving works in a similar way. Much of it can be triggered automatically, but what happens to a person’s data depends on how they worked, locally or in the cloud. For that reason, offboarding usually remains a partly automated process for me, with a deliberate decision in the middle.

What turned out harder than expected: the interfaces

The process itself is stable. Most of the effort lies in the connections between vendors, because each of them adjusts its side from time to time. One example is the link between Apple and Microsoft 365. Licences for Apple apps reach Intune through a token from Apple Business Manager that needs renewing every year. If that renewal fails and the token expires, the app licences disappear from Intune. Once the token is renewed, I have to reassign the licences and app profiles.

This happens very rarely, but it takes a lot of time when it does. Besides this token, the push certificate for device management and the token for automated device enrolment also expire after a year. My advice: the expiry dates of these certificates belong in the same monitoring as the workflows themselves.

When is it worth automating employee onboarding?

There is no fixed threshold. As a rough guide, the setup usually pays off from around ten employees, and the more often people join and leave, the sooner it does. A company that brings in many new people every year saves the time with every hire. With a very stable team, the effort of building it takes longer to balance out against a small number of uses.

Regardless of size, automation helps wherever mistakes are costly. A missing group membership usually only shows up when someone cannot open something. A defined workflow makes the required steps traceable. Errors and missing details still need to be visible so that someone can deal with them.

Frequently asked questions

Which tools do you need to automate employee onboarding?

Usually fewer than people expect. I mainly use built-in tools: webhooks from the HR system, Power Automate where Microsoft 365 is in use, and scripts on the domain controller. For devices, Intune with Windows Autopilot and Apple Business Manager come into play, and n8n or another monitoring system watches the workflows.

Does this work without an on-premises server?

Yes. In cloud-only environments I create the account directly in Microsoft 365, and the detour through the on-premises Active Directory disappears. The remaining steps stay the same: inventory, groups, licences and automatic device setup.

How much time does automation save?

At my clients, employee onboarding used to take several hours per new starter. Today it takes less than one. That is my experience from these projects; how much you save depends on your current process. What time remains goes mainly into deciding on permissions and handing over the device.

Sources

• Webhooks from Personio, response time and retries: Personio Developer Hub – Webhooks (as of September 2026)
• Synchronising on-premises Active Directory to Microsoft 365: Microsoft Learn – Microsoft Entra Connect Sync: Understand and customize synchronization
• Groups with automatic membership: Microsoft Learn – Manage rules for dynamic membership groups in Microsoft Entra ID
• Automatic setup of Windows devices: Microsoft Learn – Overview of Windows Autopilot
• Annual renewal of the Apple push certificate: Microsoft Learn – Get an Apple MDM push certificate
• Token for automated device enrolment: Microsoft Learn – Set up automated device enrollment token for Apple mobile
• Token for app licences from Apple Business Manager: Microsoft Learn – Manage iOS and macOS apps purchased through Apple Business Manager with Microsoft Intune