Guide
Zero-touch onboarding in Google Workspace & Entra.
A new hire should be added once — and have everything they need waiting on day one. Here’s the pattern I use.
Most onboarding pain isn’t about tools — it’s about sequence. Someone creates the account, someone else grants the Drive access, a third person remembers (or forgets) the Slack invite. Every handoff is a chance for delay, a wrong permission, or a security gap.
The fix is to make onboarding a system, not a checklist. Add a person once, and let identity, mailbox, apps and permissions provision themselves — consistently, every time.
Why manual onboarding breaks
Manual onboarding fails quietly. It works when one person owns it and remembers every step. It breaks the moment they’re on holiday, the team grows, or two people start on the same day.
- Access granted “temporarily” that never gets removed
- New hires idle on day one waiting for accounts
- Inconsistent group membership and permissions
- No audit trail of who was given what, and when
The single source of truth
Everything starts with one authoritative record of a person — usually your HR system or a directory in Microsoft Entra. That record drives identity in Google Workspace and every downstream app, so there is exactly one place to add, change or disable someone.
If you can’t point to the one system that decides who exists, you don’t have onboarding — you have a habit.
The provisioning flow
Once identity is anchored, provisioning becomes a flow rather than a scramble:
- A person is created in the source of truth (HR / Entra)
- Identity syncs to Google Workspace via SCIM or the Admin SDK
- Group membership assigns apps, Drives and licences by role
- Slack, Jira and other tools provision from the same groups
- A welcome flow delivers credentials and first-day context
The result: a new hire logs in on day one to a mailbox, the right shared drives, the right Slack channels and the right Jira projects — with no ticket, no waiting, and no over-granting.
Don’t forget offboarding
The same flow runs in reverse. Disable the person in the source of truth and access is revoked everywhere, data is preserved and handed over, and licences are reclaimed — the day they leave, not three months later when someone notices.
What you need to start
You don’t need to boil the ocean. A working zero-touch flow usually needs a clean directory, role-based groups, and one or two automation glue points. I typically get a first version live in days, then expand it as trust grows.