AscendCore
Back to Runbook Library
Provisioning Live in production

New Hire Provisioning

Automate new-employee account creation across Okta, Microsoft 365, and Jira with single-approval workflow. License assignment, group membership, and welcome kit delivery.

Integrates with

M365OktaJira

The problem

New-hire provisioning is one of the highest-stakes IT workflows: every new employee needs an Okta or Entra account, an email license, group memberships, project access, and welcome materials — all by their start date. When this is manual, IT is racing against day-one expectations across three to five disparate systems, and forgotten steps surface as ticket backlog in week two.

What AscendCore does

An HR or IT lead initiates new-hire provisioning from Microsoft Teams, Slack, or a webhook from a system of record (Workday, BambooHR). AscendCore proposes the full provisioning flow — account creation, license assignment, group memberships — gated behind a single approval card. On approval, AscendCore executes each step with verification and rollback discipline, and surfaces a summary back to the requester.

Workflow

  1. Trigger — chat command (/new-hire <First> <Last> <email>), HR system webhook, or admin-portal form
  2. Validate — verify the email isn't already provisioned; check license-pool availability
  3. Propose — single approval card listing every step (account, license, groups, welcome kit)
  4. Approve — one-click approval routes to hr-ops + it-admins (configurable)
  5. Execute — Okta user creation, M365 license assignment, group memberships
  6. Notify — manager + new hire DM'd with credentials and onboarding link
  7. Audit — every step logged, including step-level success/failure and retry status

Integrations

  • Okta — User creation API, group assignment, activation email
  • Microsoft 365 (Entra ID + M365 admin) — License pool checking, license assignment, distribution-list membership
  • Jira / Atlassian — Project access provisioning (optional, role-aware)
  • Slack + Microsoft Teams — Notification delivery to new hire and manager

Status

Live in production for the core flow (Okta create + M365 license assign). Group membership integration is on the May–Aug 2026 roadmap (see 90_day_roadmap.md).

Runbook source preview

Versioned, deterministic, auditable

Every runbook is defined as a versioned YAML manifest with explicit triggers, steps, and approval policies. The runbook itself is the audit-ready record of what AscendCore can and will do — chat is just the interface that triggers it.

name: new-hire-provisioning
trigger:
  source: workday
  event: hire.confirmed
steps:
  - create_okta_user
  - assign_license_bundle
  - add_to_groups: [${user.dept}-all, all-staff]
  - send_welcome_kit
approval:
  required: true
  approvers: [hr-ops, it-admins]
Ready to deploy

Run new hire provisioning from Teams or Slack today

AscendCore deploys in 48 hours for Slack + Okta or Teams + Entra stacks. See the first automated resolution the same day.

See plans & pricingBrowse all runbooks

More provisioning runbooks

Live

Employee Offboarding

Automate end-to-end employee offboarding across Okta, Microsoft 365, Jira, and Intune. Suspend accounts, revoke OAuth tokens, transfer files, revoke licenses, archive mailbox.

Read more
Live

M365 License Assignment

Automate Microsoft 365 license assignment from Slack and Teams. Pool-availability check, approval-gated assignment, optional Intune or Jamf endpoint policy push.

Read more
Live

Software Decommission

Reclaim a specific M365 license seat from a user with full audit trail — distinct from full offboarding. Snapshots the seat pool before/after, optionally surfaces the user's Intune-enrolled devices that have the matching app for follow-up cleanup visibility.

Read more
AscendCore

AscendCore Team

Online · Ask us anything

AscendCore

Hi! Welcome to AscendCore. Ask us anything about how we automate your IT help desk — or just say hi.