Home · Solutions · Other solutions
Solution · Other solutionsOne confirmed hire in the HR system, and every account, role, laptop and badge follows
Day one ready: accounts, access and kit from one HR trigger
The confirmed hire is the only trigger; identity, roles, equipment and paperwork are created, chased and recorded by the process, and every open step is visible to HR, IT and the manager in Teams.
Executive summary
New hires wait days for roles and laptops because onboarding is five processes held together by email.
We design onboarding as one chain with one owner per step and one trigger at the start: the confirmed hire in SAP SuccessFactors, with start date.
Day-one readiness becomes the norm, because every step starts from one trigger and is chased by the process rather than by the manager.
Microsoft Entra ID and Microsoft 365; SAP S/4HANA roles; CRM
Business problem
Onboarding
Onboarding is not one process. It is five departmental processes stitched together by the hiring manager's patience: HR owns the contract, payroll the master data, IT the identity and the device, application owners the roles, facilities the badge and the desk. Each is competent at its own step and blind to the others, and the trigger reaches each in a different form: a contract, a ticket, a spreadsheet row, a forwarded email. So the same hire is keyed four or five times, never quite identically.
The failure is rarely dramatic, which is why it lasts. A person is productive on day four rather than day one. A role is granted "to be safe" and never narrowed. Nobody is measured on the whole chain, so the gaps stay where they are, and peaks before the production season are when the list breaks: hand-offs grow with the starters, the people chasing them do not.
How it works today
The chain below is what we find in most groups of this size, whatever the HR system.
- PersonThe offer is accepted in the HR system and an HR coordinator adds a row to the starters list: start date, department, site, manager
- PersonThe list goes by email to eleven recipients every other Thursday; each filters their own rows and raises tickets for identity, mailbox, laptop and roles
- WaitingApplication owners get separate emails asking for roles and answer when they get to them; the manager is asked which access is really needed
- SystemPayroll re-keys the master data; IT creates the identity and copies group membership from someone in a similar job; the laptop waits in a cupboard until someone confirms the start date
- Risk of errorOn day one the gaps surface, "urgent" tickets are raised and wide roles are granted to unblock the person; access arrives piecemeal over the first week
- Risk of errorNobody records when the employee was fully ready, so nobody can say whether onboarding takes two days or nine
Why the current process costs more than it appears
The bill that never reaches the budget.
- IT time spent creating accounts is the visible cost, and the smaller one. A new hire waiting for access is paid but not productive, and the manager spends the same days compensating.
- Duplicate entry produces master-data mismatches that surface months later, in payroll, in reporting and in the leaver process.
- Access granted wide to unblock a first week becomes a standing risk. A quarterly review rarely questions a role that looks reasonable on its own, and nobody remembers it was a shortcut.
- Without a readiness timestamp the company cannot say whether onboarding takes two days or nine, so "productive on day one" cannot be managed, only hoped for; and when the one coordinator who understands the list is on leave, the follow-ups quietly stop.
Cost of inaction
The list keeps working, since most people eventually get what they need, and that is what makes it easy to leave alone. The cost arrives in small units: an engineer idle on Tuesday, a manager's morning, a role granted wider than the job. If hiring grows by 15%, coordination grows with it and exceptions grow faster, because peaks are where the list breaks.
Two things stay out of the rows on purpose: roles granted too wide have no clean price until an audit finds them, and the manager's compensating time is paid in ten-minute pieces that never reach a timesheet. The written promise of "productive on day one" changes the arithmetic: a nine-day onboarding used to be a nuisance; now it is a broken promise with a name attached.
A plausible organisation with realistic proportions. The figures are there to be recalculated on your data; they are not a client result.
A manufacturing group with 3,800 employees in four European countries; SAP SuccessFactors as the HR system of record, identities in Microsoft Entra ID, roles in SAP S/4HANA, laptops in Microsoft Intune, tickets in Jira Service Management, Microsoft 365 throughout.
About 55 joiners a month, with peaks of up to 90 before the production season; three HR coordinators, two IT engineers and some 40 application owners are involved in each.
The list leaves HR every other Thursday as an Excel attachment to eleven people. Identity, mailbox, laptop and roles are separate tickets and emails; payroll re-keys the master data; the manager chases what is missing after day one.
Around 190 minutes of coordination and provisioning effort per joiner across HR, IT, application owners and the manager, plus about four working hours per joiner spent waiting for access; no record says when a person was ready.
The confirmed hire in SAP SuccessFactors becomes the only trigger. Microsoft Entra ID Governance creates the identity, UiPath Maestro runs the rest as one instance per joiner, robots grant catalogue roles, the manager confirms the profile in Microsoft Teams, and a readiness record carries a timestamp per step.
In the modelled case about 70% of the coordination effort moves to the process, roughly 122 hours a month, and the four hours each joiner spends waiting are paid for work instead. Illustrative figures, not a client result.
Proposed solution
We design onboarding as one chain with one owner per step and one trigger at the start: the confirmed hire in SAP SuccessFactors, with start date, department, site, manager and cost centre. A change to any of those fields re-plans the same chain.
The identity part is native Microsoft configuration. Microsoft Entra ID Governance lifecycle workflows use the joiner template: scheduled from the hire date attribute, they create the identity, assign licences, groups and Teams membership, and issue a Temporary Access Pass for the first sign-in. This needs a Microsoft Entra ID Governance or Microsoft Entra Suite licence for the people in scope, a cost that belongs in the business case.
Everything that does not speak SCIM is orchestrated by UiPath Maestro, one instance per joiner with the start date as its deadline: the manager confirms role profile, cost centre and equipment in a Microsoft Teams task; robots grant SAP S/4HANA roles from a catalogue tied to the job profile and create the CRM user; the device is ordered in Jira Service Management; badge, desk and paperwork follow through a SharePoint checklist. Every human step is a UiPath Action Center task with an owner and a due date, chased by the process before the start date. The readiness record in UiPath Data Fabric holds one timestamp per step and one line per grant. No AI is involved: every decision is a rule or a named person, which is what an audit trail needs.
Microsoft Entra ID Governance lifecycle workflows (joiner template, attribute trigger, Temporary Access Pass, licences, groups and Teams membership); UiPath Action Center actionable notifications in Microsoft Teams; UiPath Orchestrator queues, triggers, credential store and audit; UiPath Maestro instance management; Microsoft Intune enrolment
The Maestro BPMN process, the role catalogue and profile rules as DMN tables, the robots for SAP S/4HANA roles and the CRM user, the manager and owner tasks in Teams, the SharePoint checklist, the readiness record in UiPath Data Fabric, the Power BI report
The confirmed-hire event from SAP SuccessFactors through its OData API into UiPath Integration Service; hire-date attributes into Microsoft Entra ID through your HR-driven provisioning, or written through Microsoft Graph by a robot; device orders through the Jira connector; badge and desk bookings in the facilities system
How the automated process works
- AutomationA confirmed hire in SAP SuccessFactors starts one Maestro instance with the start date as its deadline; a later change to date, department or manager re-plans the same instance
- SystemThe Entra ID Governance joiner workflow runs from the hire date attribute: identity, licences, groups and Teams membership, and a Temporary Access Pass for the first sign-in
- PersonThe manager gets an Action Center task in Teams five working days before the start: confirm role profile, cost centre and equipment; unanswered tasks are reminded and escalated
- SystemRobots grant the profile's SAP S/4HANA roles and create the CRM user, writing each grant to the readiness record with requester, approver and time
- AutomationThe device order goes to Jira Service Management with the delivery address from the HR record; badge and desk are booked; the SharePoint checklist collects the paperwork
- PersonRequests outside the catalogue go to the application owner as a Teams task; hires that fit no template go to HR as a named exception with a due date
- AutomationOn day minus one the readiness record is closed and a summary goes to the manager and HR in Teams; lead times feed Power BI
Human-in-the-loop model
Automation handles
- Detecting the confirmed hire and every later change to start date, department or manager
- Creating identity, licences and groups from profile rules, and granting catalogue roles in SAP S/4HANA and the CRM, with every grant recorded
- Ordering the device, booking badge and desk, and chasing open tasks until day minus one
People decide
- The manager confirms the role profile, the cost centre and any non-standard access
- Application owners approve requests outside the catalogue; security reviews anything privileged
- HR handles contract changes, relocations and hires that fit no template
Before and after
Systems and integrations
The stack is deliberately short: one engine, one execution layer, one place where a person decides.
Inputs
- confirmed hire in SAP SuccessFactors with start date, department, site, manager and cost centre
- the role catalogue
- the equipment standard
- the manager's confirmation
Automation layer
- Microsoft Entra ID Governance lifecycle workflows
- UiPath Maestro
- UiPath Orchestrator
- UiPath Robots
- UiPath Integration Service
- UiPath Data Fabric
Target systems
- Microsoft Entra ID and Microsoft 365
- SAP S/4HANA roles
- CRM
- Jira Service Management
- Microsoft Intune
- SharePoint checklist
- Power BI
Human touchpoints: Action Center tasks in Teams for the manager and the application owners; a Teams channel with the daily readiness summary; HR exception tasks
Technologies used
identity, Temporary Access Pass, licences, groups and Teams membership from the hire date attribute
Aone BPMN instance per joiner with the start date as its deadline; DMN rules of the role catalogue
ASAP S/4HANA role grants and CRM user creation; queues, retries, credential store, audit log
Athe manager's confirmation, owner approvals and exception tasks, completed in Teams
ATeams summaries, the SharePoint checklist, the device ticket in Jira Service Management
Athe readiness record: one entity per joiner, one timestamp per step, one line per grant
Athe hire record that triggers everything; the roles granted through UiPath SAP activities
Areadiness lead time per employee type and country, share ready on day minus one, tickets per hire
AIllustrative economic model
Numbers you can check against your own data.
The 190 minutes per joiner are everybody's touches added up, HR, IT, application owners and the manager, not one person's task. In the modelled case 70% of that effort can move to the process, so the calculator prices 133 automatable minutes per joiner (190 × 0.7) at €41, a blended fully loaded hourly cost for back-office and IT roles in Central Europe. Waiting time is priced in the next section. Nothing here was measured at a client.
Run the numbers on your data
An illustrative estimate from your own inputs. It models released capacity; it is not a promise of savings.
Business benefits
- Day-one readiness becomes the norm, because every step starts from one trigger and is chased by the process rather than by the manager
- Access is narrower: roles come from a catalogue tied to the job profile, not from a copy of a colleague's permissions granted to be safe
- Master data is entered once, in HR, and propagated, which removes the mismatches that later break payroll, reporting and the leaver process
- Managers confirm a profile in Teams and see one status instead of eleven email threads; hiring peaks run through the same chain as a single hire
- The readiness timestamp gives the group a measurable onboarding lead time for the first time
The management view
- Every hire in flight is visible in one place: which steps are done, which wait on whom, which will miss the start date unless someone acts today
- Workload becomes predictable; a peak of 90 starters in September is visible in July, with the device demand it will need
- Every grant carries a requester, an approver and a timestamp, so the onboarding audit turns from a reconstruction into a report, and ownership stays explicit: HR the trigger, IT the identity, each owner their catalogue
Board-level KPIs
Security and governance
Control is not an add-on.
- Robots run as service accounts with the least rights each step needs: a dedicated SAP user limited to catalogue grants, a CRM user that can create users and nothing else; their secrets sit in Azure Key Vault behind the Orchestrator credential store
- No robot grants what no person confirmed: every grant references the manager's confirmation or the owner's approval recorded in Action Center, with name and time
- Segregation of duties is enforced in the catalogue itself; conflicting SAP roles cannot be requested together, and privileged access is excluded from automatic assignment and reviewed by security
- Personal data stays in your Microsoft 365 tenant and in SAP SuccessFactors, orchestration runs in the EU region of UiPath Automation Cloud, documents sit on SharePoint under Microsoft Purview retention labels, and the Orchestrator audit log and the readiness record answer who granted what, when and on whose request
Why now
The commitment to "productive on day one" is now written down, and the September peak is visible in July only if a record exists; in the modelled case each month of delay costs about €5,000 of coordination and a further €7,920 of paid waiting
Lifecycle workflows in Microsoft Entra ID Governance create identity, licences and groups from a hire date attribute, so the identity step is configuration; what is left is orchestration across the applications without SCIM
Hybrid work moved the physical part out of the office: the laptop ships to a home address and the manager may sit in another country, while auditors ask who approved each grant
Relevant executive roles
The first day is the employer brand in practice, and coordinators should manage people rather than distribution lists
Identity and access created by policy from one trigger, with a trail that names the approver of every grant
Fewer urgent starter tickets, narrower roles and a device demand that is known two months ahead
Supervisors and engineers productive on day one, before the seasonal peak rather than after it
Common questions and objections
It sends a message; it does not create the roles, order the laptop or chase the manager. The orchestration turns that message into a tracked chain with an owner and a due date per step.
About a fifth are, in most groups we look at. The catalogue handles the rest, and the exceptions get a named task with a deadline instead of an email thread; the catalogue fit is one of the first numbers discovery produces.
Then a robot performs the identity step through Microsoft Graph. The orchestration, the catalogue and the readiness record do not depend on the licence, which buys native configuration instead of built steps.
When this is not the right solution
- Fewer than roughly ten hires a month; a good checklist and the lifecycle workflows on their own may be enough
- No reliable HR system of record; a start date that lives in emails cannot trigger anything, and fixing that comes first
- Application owners unwilling to define role profiles; without a catalogue only the chasing gets automated, and the wide roles stay
A question for the next management meeting
A new engineer starts next Monday: who in this company can say today, with evidence rather than a phone call, whether she will be able to work by noon?
Implementation approach
A scope without ambiguity, before anything is signed.
We deliver
- Analysis of today's hand-offs per country and employee type, from offer accepted to fully ready
- The role catalogue and profile rules agreed with HR, IT and the application owners, including segregation-of-duties exclusions
- The Entra ID Governance joiner workflow, the Maestro process, the robots for SAP S/4HANA and the CRM, the Jira device order, the SharePoint checklist, the Teams tasks
- The readiness record, the Power BI report and a runbook for HR and IT
- Pilot in one business unit alongside the starters list, then rollout by country and employee type with hypercare
We need from you
- Reliable start dates and a confirmed-hire status in SAP SuccessFactors, with department, site, manager and cost centre
- Application owners who will sign off a role profile per job family, and a process owner each in HR and IT
- Technical accounts for SAP S/4HANA, the CRM, Jira Service Management and the facilities system; your Entra ID Governance licensing position
Stages
Discovery
The chain for two employee types in one country, real lead times, the first role catalogue
Design
Target process, catalogue rules, task owners and due dates, security model
Build
Lifecycle workflow, Maestro instance, robots, Jira and SharePoint integration, Teams tasks
Validation and go-live
Dry runs on last quarter's joiners, then one business unit with the starters list alongside
Scale and run
Further countries, employee types and applications; monthly exception review, catalogue tuning
Enterprise. Effort depends on the number of applications without an API, the job families that need distinct profiles, and how early the HR record is reliable in each country.
Eleven people receive the starters list. None of them owns the first day.
Send us your starter checklist and three months of joiner dates. We map every hand-off between HR, IT, the application owners and the manager, and show which of them a single HR trigger can replace, with a first estimate of the catalogue fit.
Send us three months of joiner datesThe neighbouring process usually has the same problem
New starters wait days for access; leavers keep theirs for weeks. Both are the same missing handover.
View solution IT & servicesProject workspaces provisioned with governance in minutesProject teams and sites built by hand, named differently every time, and never closed.
View solution Other solutionsEvery access and device of a leaver closed on the last dayA disabled account is not the same as closed access. The long tail is where audit findings come from.
View solution Other solutionsApplication access granted by policy in minutes, with proofAccess is granted from interpreted emails, approvals are chased, and the auditor finds the evidence missing.
View solution Case studyAutomated new-hire onboardingNew hires ready to work sooner — less paperwork for HR.
View case study Case studyThe HR agent on TeamsAn employee asks on Teams about leave, a certificate or a benefit.
View case studyIndustries we deliver this in most oftenManufacturing & industryRetail & e‑commercePublic sectorServices & ITShared services