Our New Starters Inherited Everything Their Predecessors Had Collected

Description and use

Automated onboarding copied all predecessor groups, causing unauthorized access. Switching to role-based access assigns department roles, separate approvals for extra rights, and automatic removal of temporary permissions.

Problem

Automated onboarding copied all predecessor access, leading to unauthorized permissions for new starters.

Outcome

The new onboarding process eliminates unauthorized access, reduces manual effort, and introduces regular role reviews.

Workflow

• 1. Identify new starter’s job role.
• 2. Assign role definition owned by the relevant department.
• 3. Grant group memberships listed in the role.
• 4. Request and approve any additional access separately.
• 5. Set end dates for temporary permissions.
• 6. Remove old role access 30 days after job change unless overridden.
• 7. Review role definitions quarterly.

Evidence

The automation took a shortcut our service desk had used by hand for years. The hiring manager names the person being replaced, or a colleague in the same job, and the new starter receives the same group memberships.

Source

About a third of the people who had joined through the automation held access that nobody in their current team could explain.

Source

New starters now receive access from a role definition owned by their department, around ninety roles written with the managers, each one a list of groups.

Source