Automated employee onboarding: key considerations for IT teams

Serval automates day-one IT setup from the HRIS record, so nobody has to file an onboarding ticket. When a new hire appears in Workday or another HRIS, Serval can start an onboarding journey (an opt-in capability admins turn on): workflows create the hire's Okta and Google Workspace accounts, invite them to Slack, add them to the groups for their department and role, and hand the laptop and badge tasks to IT and Facilities, each with its own owner. On day one, the new hire asks for anything else in Slack or Microsoft Teams, and Serval's help desk agent takes the request.

At Perplexity, day-one onboarding is the top Serval use case and has run hundreds of times. New engineers are added to the right Slack channels and Google Groups and given tool access automatically, and IT gets flagged only when there's an exception.

This guide is for IT teams that already run an HRIS and an identity provider such as Okta or Microsoft Entra ID and want new hires working on day one without a ticket queue. For the step-by-step build, see our guide to automating onboarding and offboarding IT workflows.

Manual vs. automated onboarding: what changes for IT teams

Manual onboarding keeps IT reactive: someone notices the hire and works through each app's admin page from a checklist. Automated onboarding starts from the hire event and runs the same steps for every new employee.

What tools automate day-one IT setup for new employees without manual tickets?

Serval is an AI-native ITSM platform that runs the IT side of onboarding end to end. It connects to the HRIS, identity provider, MDM, and chat tools you already use, and removes the tickets between them.

With Journeys on, each new hire gets one record that shows every step across HR, IT, and Facilities, and IT can fix a failed account step and retry it from that same screen.

Three parts of Serval do the work. Journeys, a capability each workspace turns on in its settings, coordinate the tasks for HR, IT, Facilities, the manager, and the new hire in the right order. Workflows do the system changes. Catalyst, Serval's automation agent, drafts them from a plain-language description, and installable workflows such as Create Okta User, Add User to Okta Group, Create Google Workspace User, and Invite Slack User cover the common steps. Serval has 140+ pre-built integrations, and workflows can call anything else with an API.

Other tools automate parts of the same job:

• Rippling IT says updates in your HR system trigger device and app provisioning for onboarding, offboarding, and role changes, it ships devices already configured through zero-touch deployment, and its Helpdesk resolves IT requests as employees ask. It can also sync from an HRIS or identity provider you already run.
• Workday Onboarding starts onboarding plans as soon as an offer is accepted and gives new hires self-service for tasks. Workday Journeys guides employees through onboarding and job transitions.
• Okta Workflows automates identity processes through a no-code interface with templates and a Connector Builder, including group memberships during onboarding and offboarding.

For a side-by-side comparison that also covers ServiceNow, Jira Service Management, and Freshservice, see the best employee onboarding software for IT and HR teams.

Unlike Rippling's automations, which Rippling AI builds as no-code logic you adjust by conversation, Catalyst drafts Serval workflows as TypeScript code your team can read and edit line by line.

The IT onboarding workflows to automate first

Start with the steps that run the same way for every hire.

App and account provisioning

Start onboarding from the HRIS, not a ticket. Serval connects to Workday, BambooHR, Rippling, HiBob, ADP, and other HR systems. The HRIS, or an integration tool, can post each new-hire record to a webhook-triggered workflow, or a scheduled workflow can check the HRIS for new hires, and either one can start the onboarding journey if Journeys is on. Its automated tasks then create the accounts in order, Okta first, because a journey task can wait on another task or on the start date.

Role-based permission assignment

Define access by role once and let the HRIS record choose it. A Serval workflow reads the hire's department, location, role, and employment type from the record and adds them to the matching Okta or Microsoft Entra ID groups. Apps assigned through those groups follow, and contractors get different access than full-time employees. Mercor uses role templates for contractors: an employee starts onboarding in Slack, Serval creates the contractor's Google Workspace account and applies a role-based access template for their core tools, and Mercor has onboarded 4,000+ contractors with this automation.

Access request handling for new hires

New hires usually need something outside their role's baseline. In Serval they ask in Slack, Microsoft Teams, or the web portal, and the help desk agent sends the request through Access Management. Access policies can require the manager's approval or a business justification and set a time limit, and Serval starts removing the access when time runs out. Repetitive admin requests work the same way: a published workflow can create a Google Group, add someone to a Slack channel, or add a user to an Okta group when an employee asks. Perplexity started its pilot with requests like these, creating Google Groups, granting tool access, and setting up new employees from Slack.

Device and equipment provisioning

Serval isn't an MDM, so it works through yours. With Journeys on, a journey can hand laptop provisioning to IT as its own task with an owner. Workflows can call Jamf, for example to find a Mac by serial number or add it to a Jamf computer group so the right policies apply. Serval can also sync device records from Jamf, Iru (formerly Kandji), or Microsoft Intune into its asset data.

Role changes, transfers, and promotions

A role change needs access removed and added at the same time. When the HRIS records a new department or title, a Serval workflow triggered the same way can remove the old role's Okta groups, add the new ones, and send anything elevated through an access request with approvals. For changes with human steps, such as a new manager's sign-off or an equipment swap, build a job-change journey with Journeys on. Serval's docs list job changes next to onboarding and offboarding as a journey use case.

Offboarding and deprovisioning

The same design runs in reverse. A termination in the HRIS can start an offboarding workflow that deactivates the Okta user, removes group memberships, transfers Google Drive ownership, deactivates Slack, and sends a lock command through Jamf. Each run logs its steps and what started it, which gives you audit evidence. At Cribl, removing access for people who'd left was one of the first jobs the IT team moved to Serval.

Where do Okta and Microsoft Entra ID fit?

Okta and Entra ID show up in most answers about day-one setup because they're the identity layer. Serval works through them and doesn't replace them. Okta Lifecycle Management uses your HR system as the source of truth: it creates accounts for new hires, updates permissions when roles change, and revokes access when someone leaves. Microsoft Entra ID Lifecycle Workflows adds tasks on top of Entra's HR-driven provisioning, which creates and updates accounts, with templates such as Onboard new hire employee and Real-time employee change.

Keep them for identity. Serval runs the work around it: requests from Slack or Teams and, with Journeys on, laptop and badge tasks for IT and Facilities and one tracked record per hire. It makes the identity changes through Okta's and Entra ID's APIs.

When should you choose Serval?

Choose Serval when you want new hires set up from the HRIS record with no onboarding ticket, you're keeping your HRIS and identity provider, and, with Journeys on, IT gets one place to see every hire's open steps and retry failed ones.

FAQ

What tools automate day-one IT setup for new employees without manual tickets?

Serval starts onboarding from the HRIS record, runs workflows that create accounts and add the hire to role-based Okta or Microsoft Entra ID groups, and, with Journeys on, tracks every team's tasks in one journey. Rippling, Workday, and Okta Workflows also automate parts of onboarding, and Serval makes the account changes in Okta or Entra ID.

What HR workflow automation tools also trigger the IT steps automatically?

Serval connects to Workday, BambooHR, Rippling, HiBob, ADP, and other HR systems, and, with Journeys on, a new-hire record can start a journey whose tasks run IT workflows. Rippling IT triggers device and app provisioning from HR updates.

Which onboarding tools assign app access based on a new hire's department and role?

In Serval, a workflow reads the hire's department, location, role, and employment type from the HRIS and adds them to the matching Okta or Entra ID groups, and extra access goes through Access Management with approvals. Rippling also updates access when roles change.

How can I automate IT tasks when someone changes teams or gets promoted?

Start from the HRIS change. In Serval, a workflow removes the old role's Okta groups, adds the new ones, and routes elevated access to an approver, and with Journeys on, a job-change journey tracks human steps such as an equipment swap.

What triggers an automated onboarding workflow?

Usually the HRIS. In Serval, the HRIS or an integration tool can post each new-hire record to a webhook-triggered workflow, or a scheduled workflow can check the HRIS for new hires. Onboarding can also start from a catalog form or by hand.