---
title: "Automatic Employee Onboarding: Day One Ready | JustAutomate"
description: "Accounts, access and documents start on the day the contract is signed, and the workflow watches every pre-start obligation. Live in 2 to 6 weeks."
url: "https://justautomate.ai/en/automations/automatic-employee-onboarding/"
lang: en
---

Team and customer service

# Automatic employee onboarding day one ready before day one

A signature in the HR system starts the whole sequence: an account in Google Workspace or Microsoft 365, access by role, documents out for e-signature, the medical referral, a slot for the safety induction, the payroll and insurance registrations, a schedule for the first week. The workflow knows the employment type, so it never chases an obligation that does not apply.

 Book a free consultation [See how the workshop works](https://justautomate.ai/en/services/process-workshop/)

- 5 peoplehow many have to land in the same week: the recruiter, HR, IT, the line manager and whoever orders the hardware. One of them away is enough to stop the chain
- 2 to 6 weeksfrom the workshop to a working workflow, depending on how many systems are in play and how many separate onboarding paths you run
- 5 to 10 secondshow long the AI agent takes to answer which new joiner is still waiting for access, straight out of the HR system and the calendar

The problem

## Why does a new hire spend day one with no access to anything?

The Google Workspace account sits inactive, because IT learned the start date from an email sent the day before. CRM access waits on a manual click from somebody who is on holiday. The laptop lies unopened, because nobody ordered the licence and nobody enrolled the device in MDM. The new person sits with a coffee and waits, and the manager improvises between their own meetings.

The second layer is worse, because it has dates on it. The employment law of the country you hire in decides what has to close before somebody may start work: the contract in place, a written statement of the terms, a medical clearance where the role requires one, a safety induction, registration with the social insurance and payroll authorities, enrolment into the pension scheme. The list differs by country and by employment type, and every deadline is counted from the start date, not from the day HR found out.

The third layer is the data of the person you just hired. From the moment you collect it you owe them an information notice under Art. 13 of [GDPR 2016/679](https://eur-lex.europa.eu/eli/reg/2016/679/oj), and Art. 5(1)(e) says the record may not be kept beyond the purpose it was collected for. Those are steps with dates, same as the rest, and today all of them are watched by somebody's memory and a spreadsheet that exists in three versions.

The stakes rise with the responsibility of the role. A sales rep with no CRM burns selling time, a developer with no repository and no VPN cannot write a line of code, and a production worker with no station induction may not go near a machine or a forklift at all. In regulated sectors clearance depends on one more document: AML training in a financial institution, a practising licence in a healthcare setting, a valid driver card in transport.

- The new hire spends day one waiting for access to the system they were hired to work in
- A medical clearance, a safety induction or a registration closes after the date local law sets for it
- HR firefights, because they heard about the start date a day earlier
- Accounts and access stay alive for months after somebody has left

Why now

## What changed, so this takes weeks rather than a quarter?

An employment contract can be signed electronically and personnel records can be kept in electronic form in most of the markets our clients hire in. The whole path from offer to signature closes without a single printed page, and the signed document lands straight in the right section of the personnel file rather than in a shared folder waiting to be sorted before an audit.

The second change is on the access side. Google Workspace, Microsoft 365 with groups in Entra ID and a good part of the team tooling now accept automatic provisioning over SCIM, and a laptop can be enrolled in Intune or Jamf before it physically reaches the employee. A joining layer built in Make or [n8n](https://docs.n8n.io/) keeps the entire account lifecycle, meaning start, change of department and departure, tied to one source of truth in the HR system.

The third change is the AI agent. A workflow will create the account and raise the reminder, but it will not answer a manager asking which of the new joiners is still waiting for access. BOND, our company AI agent, answers that in a plain sentence in 5 to 10 seconds, with nobody logging into the HR system and nobody building a report.

What changes

## What do HR, IT and the line manager get?

- ### Day one ready before day one
The account, the licences, the groups and the access to the CRM and the project tools are built from the role and the department recorded in the HR system. The hardware is enrolled in MDM before anyone unboxes it.
Provisioning over SCIM wherever the system supports it, instead of clicking through five admin consoles
- ### The dates are watched by the workflow, not by memory
The medical clearance, the safety induction, the insurance and payroll registrations and the pension enrolment window are all counted from the start date, not from the moment somebody thought of them. The alert arrives before the date and it goes to a named person.
Deadlines counted from the HR system, with a separate alert while there is still time to act
- ### Documents from template to the right section of the file
The contract, the written statement of terms, the personal data form, the pension declaration and the Art. 13 information notice are assembled from templates and driven out to e-signature. For remote roles the policy and the home workstation risk assessment join the same path.
The signed file lands in the personnel record under your own retention structure, not in a shared folder
- ### A separate path for every employment type
A permanent hire runs the full set of clearances and registrations. Contractors and B2B partners skip the steps that legally do not apply to them, and an agency temp follows a shorter path that matches the rules for temporary work in your country.
Three to four paths instead of one checklist stretched over everybody
- ### Access dies on the last day
The same mechanism run backwards withdraws permissions, disables the account, unenrols the device from MDM and archives the data under your retention policy and GDPR. Nobody has to remember to raise a separate ticket with IT.
A closed loop: start, change of department, departure, all off one source of data
- ### Onboarding status in a plain sentence
Who is still waiting for access, whose medical clearance runs out this month, who is coming up on their pension enrolment window, how many people start next month. The AI agent answers from the HR system and the calendar.
An answer in 5 to 10 seconds, with no clicking through five systems

And in your company

## What if every department onboards its own way?

Four sentences we hear most often, and what we answer to each of them.

If you are looking at the neighbouring pieces, there are separate pages for [client onboarding](https://justautomate.ai/en/automations/automatic-client-onboarding/), for the [shared onboarding mechanism](https://justautomate.ai/en/services/onboarding-automation/) behind both cases, and for the wider [HR automation](https://justautomate.ai/en/services/hr-automation/) around leave, balances and expiry dates.

- We hire three people a year. That is not scale.
Then automation solves a problem you do not have yet, and we say so on the consultation. One written checklist and a set of document templates make more sense. We come back to it when several people start each month, or when a season brings a wave of hires at once.
- We are not giving a robot the right to create accounts in our domain.
The workflow runs on a service account scoped to one organisational unit and to named groups, not on an admin account. The scope is written down in the workshop and you can narrow it to preparing the account only, which IT then approves with one click. n8n can run on your own infrastructure, so HR data never leaves your systems.
- We run BambooHR, not Personio, and nobody has ever integrated it.
The workflow reads from whatever you have: Personio, BambooHR, HiBob, Workday, Sage HR or the HR spreadsheet that quietly acts as the system of record. Where a system has no API we take a scheduled export, and the trigger becomes an approval in a form rather than an event in HR. Slower by a few hours, not by days.
- Our personnel files are on paper and they are staying on paper.
Then we do not pretend they are electronic. The workflow watches the dates, assembles the documents from templates and drives them to signature, and you print them into the binder exactly as you do today. Moving to electronic records is a separate decision and onboarding does not require it.

HR and payroll

Personio, BambooHR, HiBob, Workday, Sage HR, an HR spreadsheet

Accounts and access

Google Workspace, Microsoft 365 with groups in Entra ID, HubSpot, Pipedrive, provisioning over SCIM

Team work

Slack, Microsoft Teams, Notion, Asana, ClickUp, Jira

Documents and e-signature

DocuSign, Adobe Acrobat Sign, qualified electronic signature, Google Drive, SharePoint

Hardware and calendar

Intune, Jamf, Google Calendar, Outlook

Automation layer

n8n, Make, custom integrations over the API

## Onboarding steps and what the workflow does at each one

The steps that most often go into the first version of the path. The order matters legally: without the clearance and the induction there is no permission to start work, so both have to close before the start date. The exact deadlines come from the employment law of the country you hire in, and the workflow holds whichever ones apply to you.

| Step                                                | When it has to close                                                       | What the workflow does                                                                    |
| --------------------------------------------------- | -------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------- |
| Contract and written statement of terms             | before the person is allowed to start, per local employment law            | assembles the documents from a template and drives them out to e-signature                |
| Medical clearance, where the role requires one      | before the start date                                                      | issues the referral and checks whether a valid clearance from a previous job still counts |
| General and station safety induction                | before the person goes near the workplace                                  | books the slot in the calendar and holds the training record on the file                  |
| Social insurance and payroll registration           | the deadline set by the country of employment, counted from the start date | reminds HR with the start date and the employment type attached                           |
| Accounts, licences and access                       | the day before the start date                                              | creates the account and assigns groups and licences by role and department                |
| Pension scheme enrolment                            | the enrolment window and the recurring re-enrolment set by local law       | watches both dates and gives notice ahead of each one                                     |
| Remote work: policy and workstation risk assessment | before the first day worked outside the office                             | adds the documents to the path and will not close the step without a signature            |

The rows are a starting point. In regulated roles we add the clearances specific to the job: AML training, a practising licence, a driver card with its medical and psychological checks, a criminal record certificate. We close the leaver path separately, because that is the same mechanism run backwards.

How we do it

## Five steps from a checklist in somebody's head to onboarding in production

Each step ends with something you can judge before you decide on the next one.

1. ### Workshop
We sit down with HR, IT and the person who actually brings new people in, and take the current path apart: from the accepted offer to the end of probation. The material is your last few real hires. The output is a matrix of roles, systems and documents, together with the list of statutory dates that have to fit inside the path.
2. ### Path design
We set separate paths for employment types, departments, locations and work modes, but only where the checklists genuinely differ. We pick the tool: n8n, Make or a direct API integration with the HR system, the identity directory and MDM. We write down the permission scope of the service account and exactly which personal data the workflow gets to see.
3. ### Build and test on profiles
We test the workflow on sample profiles: a permanent hire in production, a contractor in the office, a remote role, an agency temp. Separately we test the case where the HR system returns incomplete data, because in practice that is what breaks these workflows more often than anything else.
4. ### Go live on the next hire
The path runs in production alongside the existing checklist, so nothing disappears if something misfires. As standard we set up error monitoring and alerts on exceptions, including any statutory date with only a few days left on it.
5. ### Training and measurement at 30 and 90 days
HR and IT learn to handle the exceptions: an unusual employment type, a department change during probation, incomplete data from the system. Then we measure the time from signature to a ready workstation, the number of dates that closed late and the steps that went back for a manual fix. We tune the path to what actually arrives.

Before and after

## How the week before a new start changes

### Before

- HR learns the start date the day before, from the recruiter's email
- IT creates the accounts by hand, across several consoles, on the first day of work
- The clearance, induction and registration dates live in a spreadsheet and in somebody's head
- The manager puts the first week together at the last minute, between meetings

### After

- A signature in the HR system starts the sequence the same day
- The account, the licences and the access exist before the new person walks in
- Every deadline announces itself ahead of the date, with an alert to a named person
- The first week sits in the calendar alongside the meetings

You see the first complete path on the next hire after go live. The time from signature to a ready workstation and the number of late dates are measured at 30 and 90 days.

For the person signing this off

## What the HR director or the owner gets out of it

The questions "does the new starter have access yet" and "who was meant to order the laptop" stop landing on your desk, because every step in the path has an owner. The state of each onboarding is a number in a system rather than an impression from a corridor conversation.

The second thing weighs more when somebody comes to check. The date of every step, together with who closed it, sits in the path log, so you are not reconstructing it out of email and memory during a labour inspection, a social insurance audit or a client security questionnaire. That is an argument you do not have today, and it costs the most at exactly the moment you need it.

- Every step logged with a date and an author, ready to show at an audit
- Onboarding does not stall when HR or the IT admin is on holiday
- The workflow runs in parallel with the current checklist, so nothing disappears
- You change a document template or an access list yourself, with no ticket to us

What it costs

## The workshop has a published price, the rollout is quoted after it

The process workshop costs **EUR 3,500 net per week**. Onboarding usually takes one or two weeks, because the process crosses three teams at once, HR, IT and the line manager, and it carries dates that local law will not move for you. We quote the rollout after the workshop, once it is clear how many systems are involved and how many separate paths have to exist.

You pay the cost of running the workflow directly to the tool vendor, meaning n8n or Make, or you pay nothing at all when it runs on your own infrastructure. Your account, e-signature and MDM licences stay exactly where they are. Where the AI agent is in scope, model queries cost the vendor EUR 0.005 to 0.07 each. No commission from us on any of it.

- ### Process workshop
EUR 3,500 net
per week, on onboarding usually one or two
A self-contained piece of work. It ends with a matrix of roles, systems and documents and a list of dates you can act on without us.

  - Map of the current path, from the offer to the end of probation
  - Matrix of roles, systems and documents, ready to use as configuration input
  - List of statutory dates and the places where they close late today
  - Tool recommendation plus the metrics to measure after 30 days
 Start with the workshop
- Most popular
### Workshop and onboarding rollout
Quoted after the workshop
scope follows from the number of systems and the number of paths
The option most companies choose. Working onboarding within 2 to 6 weeks of the workshop, tested on your own role profiles.

  - Everything in the workshop
  - A workflow in n8n, Make or over the API, wired into HR, accounts and MDM
  - Documents from template to e-signature and into the right part of the file
  - Alerts on statutory dates and on steps that have stalled
  - The leaver path: access withdrawn, account disabled, data archived
  - Training for HR and IT on handling exceptions
 Talk about a rollout
- ### Onboarding and an AI agent for HR
Quoted after the workshop
for companies hiring several people a month
Everything in the rollout plus BOND, which answers questions about onboarding status in a plain sentence.

  - Everything in the onboarding rollout
  - An AI agent wired into the HR system, the calendar and the task tool
  - Status questions: who is waiting for access, whose clearance runs out this month
  - Access for HR, IT and line managers, with no login to the HR system
 Ask about the agent

If the workshop shows that at your hiring rate one written checklist and a set of templates is enough, we say so plainly. The workshop ends with a document that stands without us: you roll it out yourself or with your own IT, and we do not sell you a rollout you do not need.

## Frequently asked questions

What is automatic employee onboarding?

It is a sequenced workflow that starts the moment an offer is accepted or a contract is signed, and then runs on its own through the whole induction period. It creates the account and the access by role, assembles documents from templates and drives them to e-signature, books the medical clearance and the safety induction, watches the insurance, payroll and pension deadlines, and lays out the schedule for the first week. A person steps in where a decision is needed, not where memory is needed.

How long does automatic employee onboarding take to implement?

One or two weeks of workshop and 2 to 6 weeks of build. The upper end applies when the HR system, the identity directory, MDM and e-signature all have to be wired together and several separate paths have to run at once. Your next real hire already goes through the new path, in parallel with the existing checklist, so nothing is lost if a step misfires.

Which deadlines does the workflow watch?

Whichever ones the employment law of your country attaches to a new hire. In practice that means the contract and the written statement of terms, the medical clearance and the safety induction before the person is allowed to start, the registrations with the social insurance and payroll authorities, and the pension enrolment window with its recurring re-enrolment. For remote roles the policy and the home workstation risk assessment join the list. We write down the exact deadlines during the workshop and the workflow counts each one from the start date.

Does the workflow create accounts and grant permissions by itself?

Yes, on a service account with a permission scope written down in the workshop, not on an admin account. Where the system supports it we use provisioning over SCIM, and the groups in Entra ID or Google Workspace follow from the role and the department. You can narrow the workflow to preparing the account only, which IT then approves with a single click.

What about contractors, B2B partners and agency temps?

Each form of engagement gets its own path. A permanent hire runs the full set of clearances and registrations, contractors and B2B partners skip the steps that legally do not apply to them, and a temp placed through an agency follows the shorter path that matches the rules for temporary work in your country. Nobody gets a reminder about an obligation they do not have to meet.

Does this work when our personnel files are kept on paper?

It does, and in that case we do not pretend the records are electronic. The workflow watches the dates, assembles the documents from templates and drives them to signature, and you print them into the binder exactly as you do today. When you later decide to move to electronic records, we add the file structure without rebuilding the whole path.

Do we need an in-house IT team to run this?

No. We need somebody with the authority to decide about permissions in your domain, even if that is an external administrator. We do the configuration and the integrations, and after go live you change a document template or the access list for a new role yourself, with no ticket to us. We do not leave you with a black box.

What happens to access when an employee leaves?

The same mechanism runs backwards on the last day of the engagement: it withdraws permissions, disables the account, unenrols the hardware from MDM and archives the data under your retention policy and GDPR. Access stops living a life of its own for months after somebody has gone, and IT does not need a separate ticket from HR to make it happen.

## Let us find where your onboarding jams today

The free consultation takes 30 minutes. You tell us how many people start in a month, which systems you grant access in and where things usually slip: on the documents, on the access or on the clearance and registration dates. We show a demo of the AI agent on sample data and say what can be wired up straight away and what needs your HR data tidied first. You do not have to give access to any system.

We run at most two rollouts at a time, so that someone is actually sitting on each of them.

[Book a free consultation](https://justautomate.ai/en/contact/)

**PS.** If a new hire spent day one waiting for access this year, or a clearance closed after the date, that is exactly this problem. A path that lives in the memory of five people breaks the moment three hires land in the same week. After the change the workflow watches the dates and a person takes care of welcoming the new employee. You write directly to Paweł and you get an answer within one working day.

## Related

- [Automatic client onboarding](https://justautomate.ai/en/automations/automatic-client-onboarding/)
- [Automatic contract generation](https://justautomate.ai/en/automations/automatic-contract-generation/)
- [Automatic document archiving](https://justautomate.ai/en/automations/automatic-document-archiving/)
- [n8n automation](https://justautomate.ai/en/services/n8n-automation/)
- [BOND, business AI agent](https://justautomate.ai/en/services/bond-business-ai-agent/)
- [Process workshop](https://justautomate.ai/en/services/process-workshop/)

---

**JustAutomate** · contact: contact@justautomate.ai · form: https://justautomate.ai/en/contact/