Stepwork logoStepwork logo
ProcedureDeterministic AgentsMarketplace

By department

  • ITAccounts, access, helpdesk requests
  • Security & ComplianceAccess reviews, evidence, audits
  • Finance & AccountingInvoices, billing, month-end close
  • Sales & RevOpsCRM to ERP, orders, quotes
  • OperationsOrders, deliveries, dispatch
  • HR & PeopleOnboarding and offboarding
See every use case

By industry

  • HealthcareReferrals, eligibility checks, EHR entry
  • 3PL and warehousingPDF orders, WMS entry, client billing
  • Freight and truckingRate confirmations, carrier checks, TMS
  • Fuel and convenience storesStore staff, POS IDs, back office
  • ConstructionJob setup, subcontractor insurance
  • Manufacturing and distributionPO entry, supplier dates, legacy ERPs
  • Accounting firmsMonth-end across every client file
  • Field services and tradesService calls to jobs to invoices
  • MSPsNew users and license true-ups
See every industry
Security
Log inBook a Demo
ProcedureDeterministic AgentsMarketplace

By department

  • ITAccounts, access, helpdesk requests
  • Security & ComplianceAccess reviews, evidence, audits
  • Finance & AccountingInvoices, billing, month-end close
  • Sales & RevOpsCRM to ERP, orders, quotes
  • OperationsOrders, deliveries, dispatch
  • HR & PeopleOnboarding and offboarding
See every use case

By industry

  • HealthcareReferrals, eligibility checks, EHR entry
  • 3PL and warehousingPDF orders, WMS entry, client billing
  • Freight and truckingRate confirmations, carrier checks, TMS
  • Fuel and convenience storesStore staff, POS IDs, back office
  • ConstructionJob setup, subcontractor insurance
  • Manufacturing and distributionPO entry, supplier dates, legacy ERPs
  • Accounting firmsMonth-end across every client file
  • Field services and tradesService calls to jobs to invoices
  • MSPsNew users and license true-ups
See every industry
Security
Log inBook a Demo
  1. Home
  2. Use cases
  3. Employee onboarding automation

Automate new hire onboarding across every app, including ones without SCIM

Stepwork reads new hires from your HR system, creates their accounts, sets up every app in their bundle, including ones without SCIM, and tells the manager what's ready.

Book a DemoSee the procedures
  • New hire in HR
  • Offer accepted
  • Manager request
Use case
New hire onboarding across HR, IT, and every appPeople
Best for
People Ops Manager, IT Manager, IT Administrator
Applications used
  • Workday
  • Microsoft Entra ID
  • Okta
  • Internal tool
  • Jamf
  • Microsoft Teams
Business outcome
Accounts, apps, and a laptop ready before day one

The problem

Every new hire starts the same checklist from scratch

  • Watch the HR system for new hires starting soon
  • Create the account and add the groups for their department
  • Sign in to each app without SCIM and add the user by hand
  • Open the laptop ticket and chase it before the start date
  • Confirm the background check cleared before day one
  • Tell the manager what's ready, then find out what was missed

Triage

However a new hire shows up, it lands in the right procedure

New hires arrive as an HR record, an accepted offer, a status change, or a manager's message. Stepwork reads each one where it lands and hands it to the procedure that deals with it.

How it arrives
  • WorkdayNew hire recordPriya Nair · Account Executive Department: Sales · Start: Nov 16 Manager: D. OkaforDGoes to Day-one provisioning
  • Microsoft TeamsTeams messageHi IT, Jordan starts on my team on the 16th and works from home. Can we get a laptop out this week?PGoes to Pre-start ticket and laptop
  • GreenhouseOffer acceptedMarcus Bell · Support Engineer Offer accepted · Start: Nov 30 Recruiter: L. ChenGGoes to Offer-to-start gate
  • CheckrReport updateCandidate: Marcus Bell Status: Consider · 1 item to review Expected: Nov 12GGoes to Offer-to-start gate
  • OutlookEmailPriya's offer included 4,000 options. Can someone confirm the grant is in Carta before her first payroll?EGoes to Payroll and equity setup
Where it goes
  • DDay-one provisioningFromRuns inWorkdayMicrosoft Entra IDExcelInternal toolMicrosoft Teams
  • PPre-start ticket and laptopFromRuns inWorkdayFreshserviceMicrosoft IntuneMicrosoft Teams
  • GOffer-to-start gateFromRuns inGreenhouseCheckrWorkdayMicrosoft Teams
  • EPayroll and equity setupFromRuns inWorkdayADP Workforce NowCartaMicrosoft Teams

Systems

Every app a new hire needs on day one

Your HR system says who is starting and when. Your identity provider covers the apps it can provision. Stepwork does the rest through each app's own admin screens, including desktop and on-prem apps with no SCIM, connector, or API, with a login your team grants.

  • HR, recruiting, and background checks: Workday, BambooHR, Rippling, Greenhouse, Lever, Checkr
  • Identity and devices: Microsoft Entra ID, Active Directory, Okta, JumpCloud, Microsoft Intune, Jamf
  • SaaS admin consoles: Microsoft 365, Google Workspace, Salesforce, GitHub, AWS, 1Password
  • Apps without SCIM: Internal tool, On-prem app, Vendor portal
  • Payroll and equity: ADP Workforce Now, Paychex Flex, Gusto, Carta
  • Where requests come in and updates go: Microsoft Teams, Slack, Freshservice, ServiceNow
  • BambooHR
  • Rippling
  • Greenhouse
  • Lever
  • Checkr
  • Microsoft Entra ID
  • Active Directory
  • JumpCloud
  • BambooHR
  • Rippling
  • Greenhouse
  • Lever
  • Checkr
  • Microsoft Entra ID
  • Active Directory
  • JumpCloud
  • BambooHR
  • Rippling
  • Greenhouse
  • Lever
  • Checkr
  • Microsoft Entra ID
  • Active Directory
  • JumpCloud
  • BambooHR
  • Rippling
  • Greenhouse
  • Lever
  • Checkr
  • Microsoft Entra ID
  • Active Directory
  • JumpCloud
  • Microsoft Intune
  • Jamf
  • Internal tool
  • On-prem app
  • Microsoft Intune
  • Jamf
  • Internal tool
  • On-prem app
  • Microsoft Intune
  • Jamf
  • Internal tool
  • On-prem app
  • Microsoft Intune
  • Jamf
  • Internal tool
  • On-prem app
  • Vendor portal
  • ADP Workforce Now
  • Paychex Flex
  • Gusto
  • Carta
  • Microsoft Teams
  • Freshservice
  • Vendor portal
  • ADP Workforce Now
  • Paychex Flex
  • Gusto
  • Carta
  • Microsoft Teams
  • Freshservice
  • Vendor portal
  • ADP Workforce Now
  • Paychex Flex
  • Gusto
  • Carta
  • Microsoft Teams
  • Freshservice
  • Vendor portal
  • ADP Workforce Now
  • Paychex Flex
  • Gusto
  • Carta
  • Microsoft Teams
  • Freshservice

Example procedures

Four onboarding procedures, card by card

One sets up day-one accounts and apps, one opens the ticket and assigns a laptop, one holds a start until the background check clears, and one sets up payroll and equity. Swap in your HR system, identity provider, or chat tool above each one and the steps stay the same.

Day-one accounts in Microsoft Entra ID and every app in the department's bundle

Every weekday morning Stepwork reads who starts next week in Workday, creates each new hire's account and groups in Microsoft Entra ID, and works through their department's app bundle. Apps Microsoft Entra ID can't provision get the account through their own admin screens, and the manager hears what's ready.
  • Workday
  • Microsoft Entra ID
  • Excel
  • Internal tool
  • Microsoft Teams
Swap in your systemsThe steps stay the same. Only the screens change.
HR system
Identity provider
Team chat
Day-one accounts in Microsoft Entra ID and every app in the department's bundle
Extraction
Workday

Read new hires starting next week in Workday

Scheduled · weekdays at 6:00

Extracted variables

  • hire_name
  • department
  • manager_email
  • start_date
Execution
Microsoft Entra ID

Create the account in Microsoft Entra ID with the department's groups

Input variables

  • hire_name
  • department

Output

  • work_email
Extraction
Excel

Read the department's app bundle

Input variables

  • department

Extracted variables

  • app_name
  • app_role
Rule logic

Does Microsoft Entra ID already provision this app?

Input variables

  • app_name

Paths

  1. If the app isn't provisioned from groups in Microsoft Entra IDThen: Add the new hire in the app's admin console
  2. OtherwiseGroups in Microsoft Entra ID already cover it
Execution
If it has no SCIM

Add the new hire in the app's admin console

Input variables

  • work_email
  • app_name
  • app_role

Output

  • app_account
Summary
If it has no SCIM

Sum up what's ready for day one

Input variables

  • app_account

Output

  • ready_summary
Execution
If it has no SCIM
Microsoft Teams

Tell the manager it's ready in Microsoft Teams

Input variables

  • manager_email
  • start_date
  • ready_summary

Drag to explore · pinch to zoom

Step by step

  1. 1
    The new hires come in
    Stepwork reads everyone starting next week in Workday, with their department, manager, and start date. Each new hire runs through the same cards.
  2. 2
    The account gets created
    The recorded flow creates the account in Microsoft Entra ID and adds the groups for the new hire's department, so the apps those groups provision come with it.
  3. 3
    The bundle comes in
    Stepwork reads the department's app bundle from the list your IT team keeps in Excel: each app, and the role the new hire gets in it. Each row is one pass through the loop.
  4. 4
    The rule skips what's covered
    Inside the solid frame, apps Microsoft Entra ID already provisions through SCIM need nothing more, so nothing else runs for them. Apps without SCIM go on to their own admin screens.
    • If it has no SCIMAdd the new hire in the app's admin console
    • OtherwiseGroups in Microsoft Entra ID already cover it
    Repeats: For each app in the bundle · 9 apps
  5. 5
    Each app gets the account
    The recorded flow signs in to the app's admin console and adds the new hire with the role from the bundle. It runs the same way in an internal tool, a desktop app, or a vendor portal.
    Only on this path: If it has no SCIMRepeats: For each app in the bundle · 9 apps
  6. 6
    The day-one list comes together
    After the last app, the Summary card lists every account that's ready and anything that needs a person, app by app.
    Only on this path: If it has no SCIM
  7. 7
    The manager hears it's ready
    The manager gets the list in Microsoft Teams with the start date, so they know what works before the new hire's first morning.
    Only on this path: If it has no SCIM

Field map

FromTo
WorkdayNew hire: name, departmentMicrosoft Entra IDNew user: name, department groups
ExcelApp bundle: app and roleInternal toolAdd user: roleOnly apps without SCIM
Microsoft Entra IDNew account: work emailInternal toolAdd user: email

Onboarding ticket in Freshservice and a laptop in Microsoft Intune two weeks out

Two weeks before each start date, Stepwork opens the onboarding ticket in Freshservice and assigns a spare laptop in Microsoft Intune. A rule adds a shipping task for remote hires or a desk setup task for the office, and IT and the manager hear it's in hand.
  • Workday
  • Freshservice
  • Microsoft Intune
  • Microsoft Teams
Swap in your systemsThe steps stay the same. Only the screens change.
HR system
Helpdesk
Device management
Team chat

Step by step

  1. 1
    The start dates come in
    Stepwork reads everyone starting in two weeks in Workday, with their start date, where they'll work, and a shipping address for remote hires.
  2. 2
    The ticket gets opened
    The recorded flow opens the onboarding ticket in Freshservice with the new hire's name and start date, so IT works from the same ticket for every hire.
  3. 3
    A laptop gets assigned
    Stepwork picks a spare laptop in Microsoft Intune and assigns it to the new hire, so the device record names them before it leaves IT.
  4. 4
    The rule checks where they work
    Remote hires take the top path. Everyone else sets up in the office.
    • If remoteAdd a shipping task with the home address
    • If in the officeAdd a desk setup task for the office
  5. 5
    Remote hires get it shipped
    Only on the top path: Stepwork adds a shipping task to the ticket with the laptop's serial number and the home address from Workday.
    Only on this path: If remote
  6. 6
    Office hires get a desk
    On the office path, Stepwork adds a desk setup task to the ticket with the laptop's serial number.
    Only on this path: If in the office
  7. 7
    IT and the manager hear it's in hand
    Both paths end here. Stepwork posts the ticket and its task in Microsoft Teams, and the run record keeps which laptop went to whom.

Field map

FromTo
WorkdayNew hire: name, start dateFreshserviceOnboarding ticket: subject, due date
Microsoft IntuneDevice: serial numberFreshserviceTicket: assigned asset
WorkdayHome addressFreshserviceShipping task: addressRemote hires only

Hold each start in Greenhouse until Checkr clears it

Every weekday morning Stepwork reads the candidates marked hired in Greenhouse and checks each background check in Checkr. Cleared candidates get their employee record in Workday, which starts their onboarding. Anyone else is held, and the recruiter hears why.
  • Greenhouse
  • Checkr
  • Workday
  • Microsoft Teams
Swap in your systemsThe steps stay the same. Only the screens change.
Applicant tracking
Background checks
HR system
Team chat

Step by step

  1. 1
    The hires come in
    Stepwork reads each candidate marked hired in Greenhouse who doesn't have an employee record yet, with their start date and recruiter.
  2. 2
    Each check gets read
    Inside the dashed frame, Stepwork looks the candidate up in Checkr and reads where their check stands.
    Repeats: For each hired candidate · 4 candidates
  3. 3
    The rule checks for a clear result
    A check that is still running, or came back for review, takes the top path. A clear check goes on to Workday.
    • If not clear yetHold the start and tell the recruiter in Microsoft Teams
    • If clearCreate the employee record in Workday
    Repeats: For each hired candidate · 4 candidates
  4. 4
    The recruiter hears first
    Only when the check isn't clear: no record is created, and the recruiter gets the check's status in Microsoft Teams so a person decides what happens next. The next run checks again.
    Only on this path: If not clear yetRepeats: For each hired candidate · 4 candidates
  5. 5
    The employee record gets created
    The recorded flow creates the employee in Workday with the start date from the offer. From there, the pre-start and day-one procedures pick them up.
    Only on this path: If clearRepeats: For each hired candidate · 4 candidates
  6. 6
    People Ops gets the picture
    Both paths end here. After the last candidate, the Summary card lists who cleared and who is on hold, with each check's status.

Field map

FromTo
GreenhouseHired candidate: name, start dateWorkdayNew employee: name, hire dateOnly once the check clears
CheckrCheck: statusMicrosoft TeamsHold message to the recruiterWhen it isn't clear

New hires into ADP Workforce Now, with a Carta check for each option grant

Every Monday Stepwork reads the week's new hires and their offer terms from Workday, adds each one to ADP Workforce Now, and checks Carta for the option grant their offer promised. A missing grant goes to People Ops instead of waiting for the new hire to ask.
  • Workday
  • ADP Workforce Now
  • Carta
  • Microsoft Teams
Swap in your systemsThe steps stay the same. Only the screens change.
HR system
Payroll
Team chat

Step by step

  1. 1
    The new hires come in
    Stepwork reads everyone starting this week in Workday, with their pay rate, start date, and any equity in their offer. Each new hire is one pass through the loop.
  2. 2
    Payroll gets set up
    Inside the dashed frame, the recorded flow adds the new hire to ADP Workforce Now with the pay rate and start date from Workday, in the same fields every time.
    Repeats: For each new hire · 5 hires
  3. 3
    Stepwork checks Carta
    It looks the new hire up in Carta and reads whether an option grant has been drafted for them.
    Repeats: For each new hire · 5 hires
  4. 4
    The rule finds missing grants
    If the offer includes equity and Carta has no grant for it, the run goes on to flag it. If there's no equity, or the grant is drafted, nothing else runs for that hire.
    • If the grant is missingFlag the missing grant to People Ops in Microsoft Teams
    • OtherwiseNo equity, or the grant is drafted
    Repeats: For each new hire · 5 hires
  5. 5
    People Ops hears about it
    Only when a grant is missing: People Ops gets the new hire's name and the shares from the offer in Microsoft Teams, so the grant gets drafted.
    Only on this path: If the grant is missingRepeats: For each new hire · 5 hires
  6. 6
    The week gets summed up
    After the last hire, the Summary card lists who was added to payroll and which grants still need drafting.
    Only on this path: If the grant is missing

Field map

FromTo
WorkdayOffer: pay rate, start dateADP Workforce NowNew employee: pay rate, hire date
WorkdayOffer: equity sharesCartaOption grants: stakeholder lookupRead only, nothing changes in Carta
CartaGrant statusMicrosoft TeamsMissing grant messageOnly when the offer includes equity

Flows

The onboarding flows these procedures are built from

Each flow is one recorded job in one app. Procedures run them in order for each new hire, and any of them can also run on its own from a request.

  • Microsoft Entra ID
    Microsoft Entra ID

    Create user with group memberships

    Creates a new Entra user and adds them to the security groups that grant team apps and shared resources.
    Execution · Slack request
  • Okta
    Okta

    Create user and assign groups

    Creates a new Okta user with name, email, and title, then assigns the group memberships that grant their app entitlements.
    Execution · Slack request
  • JumpCloud
    JumpCloud

    Create user with groups

    Creates a new JumpCloud user and adds them to the groups binding their apps and devices.
    Execution · Slack request
  • Google Workspace
    Google Workspace

    Create user in org unit

    Creates a Google Workspace user with the correct organizational unit and initial password policy applied.
    Execution · Slack request
  • Microsoft 365
    Microsoft 365

    Assign license to user

    Opens the Microsoft 365 admin center, locates the user, and assigns the specified license SKU.
    Execution · Slack request
  • Slack
    Slack

    Invite member with default channels

    Invites a new member to the workspace with the standard default channel set for their team.
    Execution · Slack request
  • GitHub
    GitHub

    Invite member with team assignment

    Invites a new member to the GitHub org and adds them to the teams that grant their repo access.
    Execution · Slack request
  • Salesforce
    Salesforce

    Create user with profile and role

    Creates a Salesforce user with the correct profile, role, and license type for their job.
    Execution · Slack request
  • AWS
    AWS

    Create IAM user with group membership

    Creates an IAM user in the AWS console and adds them to the groups granting their policy set.
    Execution · Slack request
  • 1Password
    1Password

    Invite user with team vault access

    Invites a new member and grants access to the standard vaults for their team.
    Execution · Slack request
  • Notion
    Notion

    Invite member to teamspaces

    Invites a new member and adds them to the standard teamspaces for their department.
    Execution · Slack request
  • Asana
    Asana

    Invite member to teams

    Invites a new member and adds them to their department's Asana teams.
    Execution · Slack request
  • Dropbox
    Dropbox

    Invite member with team folders

    Invites a new member and grants access to their team's shared folders.
    Execution · Slack request
  • Zendesk
    Zendesk

    Add new agent with role and groups

    Creates the agent in Zendesk with the correct role, group memberships, and default views for their team.
    Execution · Slack request
  • Jamf
    Jamf

    Reassign device to new user

    Updates a device's assigned user and moves it to the correct smart-group scope for its new owner.
    Execution · Slack request
  • Freshservice
    Freshservice

    Create onboarding ticket set for new hire

    Creates the standard set of onboarding tickets (accounts, hardware, access) for a new hire from a template.
    Execution · Slack request
  • Internal tool
    Internal tool

    Add a user in an app without SCIM

    Signs in to the app's admin page, adds the new hire with the role their bundle names, and saves the user list afterwards as a timestamped screenshot.
    Recorded on your screens
See every employee onboarding flow in the Marketplace

More procedures

More onboarding procedures

Ready-made procedures in the Marketplace for new hires, contractors, and internal moves.

  • BambooHROktaGoogle Workspace3 more
    BambooHR · Okta · Google Workspace + 3 more

    New-hire day-one provisioning

    Runs nightly against upcoming start dates in BambooHR, then creates the Okta user with role-based groups, the Google Workspace account in the right org unit with team groups, sends the Slack invite with default channels, provisions Zoom, and invites to the team 1Password vaults, posting a ready-for-day-one summary to IT.
  • DeelOktaSlack
    Deel · Okta · Slack

    Contractor onboarding with contract issuance

    From an approved contractor request, issues the Deel contract, then once countersigned creates a time-boxed Okta account and Slack guest access scoped to the engagement channels.
  • Google WorkspaceOkta
    Google Workspace · Okta

    Internal transfer access migration

    For an approved internal transfer, moves the user to the new Google Workspace org unit, swaps old-team groups for new-team groups in both Google Workspace and Okta, and confirms the resulting access set to the new manager.
  • NotionAsanaAirtable1 more
    Notion · Asana · Airtable + 1 more

    Team workspace provisioning from roster

    For a new or restructured team, invites members to the right Notion teamspaces, Asana teams, and Airtable workspaces, and adds everyone to the team channel set, confirming full coverage against the roster.

Why Stepwork

The same bundle for every hire, with a record of each one

Stepwork is a deterministic agent platform: it runs the steps you recorded in each app, in the same order, for every new hire. Two people in the same role get the same bundle, whether an app provisions through SCIM or only through its admin screen. Every run records which accounts were created, in which apps, who triggered it, and when. Credentials stay in your vault until a run needs them.

Deterministic agentsProceduresCredentials
Book a Demo

Related use cases

More use cases

  • Employee offboarding automationStepwork starts offboarding when HR records a termination, closes every app including ones without SCIM, hands files to the manager, and records when access ended.Learn more
  • IT helpdesk automationStepwork runs the requests your helpdesk repeats, from password and MFA resets to licenses and mailbox access, from a Teams message or a ticket, the same way every time.Learn more
  • User access review automationStepwork pulls accounts from every app, including ones without SCIM, matches them to HR, carries out reviewer decisions, and files the evidence in Vanta.Learn more
See every use case

FAQ

Common questions

  • Most cover a cleared background check, the HR record, an account with the right groups, each app in the role's bundle, a laptop, payroll, and a note to the manager when it's all ready. The procedures on this page run each of those steps the same way for every hire.
  • Yes. Stepwork signs in to each app's admin screens the way an admin does and adds the new hire with the role their bundle names. It doesn't need SCIM, an API, or a connector, so internal tools, desktop and on-prem apps, and vendor portals are ready on day one too.
  • No. Your HR system stays the record of who is starting, and Okta or Entra ID still provisions the apps it already covers. Stepwork reads from them, creates the account, and handles the apps and steps they don't reach.
  • The bundle is a list your team already keeps, like a spreadsheet of apps and roles for each department, or groups in your identity provider. Change the list and the next run uses it. Nothing in the procedure has to be rebuilt.
  • No employee record is created, so nothing gets provisioned. The recruiter gets the check's status in Teams or Slack and decides what happens next, and the next run checks again.
  • Every run records which accounts were created, in which apps, which laptop was assigned, who triggered it, and when. When a manager or an auditor asks what someone got on day one, the answer is in the run record.

The math

What manual onboarding costs IT and People Ops

Example volumes for a company of about 500 people hiring five people a week, with about ten apps in each department's bundle. Swap in yours.

Illustrative estimate, not a quote. These are example volumes and typical hand times, not a customer's results. Your numbers will differ, and we can work them out with you.
The manual taskTimes a weekMinutes eachHours a week
Create the account and add the department's groups5151.3
Add a new hire to an app without SCIM2562.5
Open the onboarding ticket and assign a laptop5201.7
Check a background check and update the recruiter850.7
Set up payroll and confirm the option grant5201.7
Hours a week
7.8
Hours a year
388
Of one full-time person
19%
Example volumes, not a customer's numbers. Minutes are the typical time to do each task by hand. Hours a year assume 50 working weeks.

See it run on a process you already repeat

Bring one. We will show you what it looks like as a flow and what each run records.

Book a Demo
Stepwork

Deterministic agents for work that must run the same way every time.

ProcedureContainersDeterministic AgentsMarketplaceUse CasesIndustriesSecurityClaude Co-Work AlternativeStepwork MCPAngelList Case StudyFAQ
Terms and ConditionsPrivacy PolicyData Processing AgreementSubprocessors

2261 Market Street #4481, San Francisco, CA 94114, USA

Loot Discount inc dba Stepwork

© 2026 Stepwork. All rights reserved.