A laptop that is not ready teaches a new person something on day one that no onboarding document will undo. Here is how to trigger the whole first week from a single fact.
The first week sets what a new person believes about how the company works. A laptop that is not ready and accounts that do not exist teach them something on day one that no onboarding document will undo.
This is also the automation with the tightest link to the security article in this series, because provisioning and deprovisioning are the same map read in opposite directions.
How to build it
1. Define access profiles by role, not by person
The instinct is to copy whoever does a similar job. That person accumulated access over years, most of which they no longer need, and copying it propagates the problem to everybody hired afterwards. Write down what each role genuinely requires.
2. Trigger from the start date, working backwards
The trigger is a start date being set with a role attached. Every task gets a due date derived from it: accounts three days before, equipment a week before, meetings booked two weeks before.
3. Automate creation where identity allows it
Your identity provider or Workspace admin can create the core account and group memberships directly. Third-party tools outside single sign-on usually need a task assigned to whoever administers them rather than a full automation.
4. Generate the human parts too
Six introduction meetings booked before they arrive, the first task chosen in advance, and a named first-week owner who is not necessarily their manager. These matter more than the accounts and they are just as automatable.
5. Escalate incomplete tasks before the start date, not after
A provisioning task still open at forty-eight hours out should escalate by name. Discovering on the first morning that an account was never created is entirely preventable and entirely common.
6. Write the reverse at the same time
Every provisioning profile is also a deprovisioning checklist. Building one without the other is how orphaned accounts accumulate, and the second one costs almost nothing once you have the first.
Tools and what they cost
| Option | What it costs | Honest trade-off |
|---|---|---|
| Google Workspace or Microsoft 365 admin plus a script | Included in your existing subscription. | Covers core identity, email, groups and drive access at no extra cost. Third-party tools outside SSO still need individual handling. |
| Identity provider with SSO (Okta, JumpCloud, Entra) | Per user monthly, low single to low double digit dollars. | Provisioning and deprovisioning in one place across every connected app. Genuine setup effort, and worth it above roughly twenty people. |
| HR platforms with onboarding workflows (BambooHR, Rippling) | Per employee per month. | Triggers from the employment record itself, which is the cleanest source of truth. Another system, and often more than a small team needs. |
| A checklist template with assigned tasks | Free. | Better than most businesses manage, and it depends on someone remembering to start it. |
What it is actually worth
Three things, and only one of them is time.
Time to productive. Measure the gap between start date and the day the new person completed something real. In most small businesses it is longer than anyone believes, and access delays are a large part of it.
Reduced access sprawl. Role profiles instead of copied access means people have what they need and not what somebody else accumulated. This is the security dividend and it compounds.
The signal it sends. Hardest to measure and probably the most valuable. A first day that was clearly prepared for tells a new person that this business is organised, and that belief affects how they behave for months.
Your own number: for the last three hires, count the days from start date to full access. That is your baseline and it is usually embarrassing enough to justify the build on its own.
How it breaks
Access profiles go stale. New tools appear and are never added, so provisioning silently under-delivers. Review profiles when you add any tool that more than three people use.
Over-provisioning by default. It is tempting to grant broad access so nobody is blocked. That is exactly how a small business ends up with everyone able to see everything, including payroll.
Tasks generate but nobody completes them. A generated checklist that sits unactioned is worse than a manual one, because everybody assumes it was handled. Escalate before the start date, not after.
The start date moves. Offers get delayed. Make sure the dates recalculate rather than leaving a trail of tasks aimed at a date nobody is arriving on.
How to tell whether it worked
Days from start date to full access, target zero. Provisioning tasks incomplete on the first morning, also zero. And the number of distinct access profiles, which should be small and stable rather than growing with headcount.