--- title: "Automated User Provisioning" canonical: https://harmony.io/platform/employee-management/user-provisioning --- # Automated User Provisioning Grant and revoke application access through Okta, Microsoft Entra ID or Google Workspace groups, with approvals, time limits and HR-driven onboarding and offboarding. ## Automated user provisioning from request to revoke Employees ask for access in Slack or Teams. Harmony checks the policy, gets the approval, adds them to the right identity group and takes access away when it should end. ## What is automated user provisioning? User provisioning is giving people the accounts and access their job needs, and deprovisioning is taking it away when they change role or leave. Done by hand, access requests are often the largest single category of IT tickets, and a missed deprovisioning step is a security risk. Harmony provisions through the identity provider you already run. An access request in Slack, Microsoft Teams or the portal is matched to the application, checked against its access policy and sent for approval. Approval tiers can require any one or all approvers and time out, for example after two days. Approved access is applied through Okta, Microsoft Entra ID or Google Workspace, by group or direct assignment. Requests nobody answers in time are never approved automatically: the ticket goes back to the desk. The employee lifecycle drives the rest. A new hire in the HRIS starts onboarding 14 days before the start date by default, with a parent ticket and linked child tickets for each task. On termination, Harmony disables the account and ends active sessions in Okta, Microsoft Entra ID or JumpCloud after manager approval, and offboarding opens the task to return company assets. [Automating app access requests](https://harmony.io/insights/automate-access-requests) goes deeper on the request side. ## Access that follows the job - **Provisioning through your IdP:** Access granted by Okta, Microsoft Entra ID or Google Workspace group, or by direct assignment. - **Approval tiers:** Any one or all approvers per tier, more than one tier where needed, with reminders and a timeout. - **Business justification:** Require a reason for access per identity provider, with each application's own policy able to override it. - **Time-limited access:** Grants for 1 hour or for 30, 60 or 90 days that revoke themselves. - **Auto-approval:** Per application, for the tools everyone should have. - **Manual fallback:** Applications outside the identity provider route to the desk you choose, so nothing waits in limbo. - **Group sync:** Groups from Okta, Google Workspace and Microsoft Entra ID sync every four hours. - **Deprovisioning:** Account disable and session revocation in Okta, Microsoft Entra ID and JumpCloud on termination. ## How automated provisioning works **Trigger:** An employee asks for an app, a new hire appears in the HRIS, or someone leaves. 1. **Request** - The employee asks in Slack, Microsoft Teams or the portal, in their own words. 2. **Check the policy** - Harmony matches the application, reads its access policy and asks for a business justification if one is required. 3. **Approve** - Approvers get the request where they work and approve with one action. Unanswered requests go back to the desk. 4. **Provision** - Access is applied through an Okta, Microsoft Entra ID or Google Workspace group, or routed to a desk for applications outside the identity provider. 5. **Revoke on time** - Time-limited grants expire on their own, and termination disables the account and ends its sessions. **Outcome:** Access that matches the job, granted in minutes and removed when it should be. ## Fireblocks' access agent has run 915 times Application access was 44% of Fireblocks' old Jira Service Management queue. It is now the platform's largest automation: Harmony's access request agent has run 915 times, resolving the application, routing to the right approver and provisioning through Okta groups. > It can't be just an approval - the actions the agent can take are too critical. Harmony put the challenge at a higher level, exactly where we needed it. > > - Meir Grinberg, Global IT Manager, Fireblocks ## Agents for joiners, movers and leavers - [Application Access Request](https://harmony.io/agents/application-access-request) - [Group Membership Management](https://harmony.io/agents/group-membership-management) - [Employee Onboarding](https://harmony.io/agents/new-hire-onboarding) - [Employee Offboarding](https://harmony.io/agents/employee-offboarding) - [Employee Account Termination](https://harmony.io/agents/employee-account-termination) ## Provisioning through your identity and HR systems - **Identity: **[Okta](https://harmony.io/integrations/okta), [Microsoft Entra ID](https://harmony.io/integrations/microsoft-entra-id), [Google Workspace](https://harmony.io/integrations/google-workspace), [JumpCloud](https://harmony.io/integrations/jumpcloud-idp) - **HRIS: **[HiBob](https://harmony.io/integrations/hibob), [Workday](https://harmony.io/integrations/workday), [BambooHR](https://harmony.io/integrations/bamboo-hr), [SAP SuccessFactors](https://harmony.io/integrations/sap-successfactors), [Rippling](https://harmony.io/integrations/rippling), [UKG Pro](https://harmony.io/integrations/ukg-pro) - **Developer access: **[GitHub](https://harmony.io/integrations/github) ## FAQ ### What is automated user provisioning? Granting the accounts and access an employee needs without a technician doing it by hand, and removing them when the employee changes role or leaves. Harmony does it through your identity provider, with approvals and time limits. ### Which identity providers does Harmony provision through? Access requests are provisioned through Okta, Microsoft Entra ID or Google Workspace, by group or direct assignment. On termination, Harmony disables accounts and ends sessions in Okta, Microsoft Entra ID and JumpCloud. ### What happens if an approver doesn't respond? The request is never approved automatically. After the timeout, such as two days, the ticket goes back to the desk. ### Can access be temporary? Yes. Access can be granted for 1 hour or for 30, 60 or 90 days, and Harmony revokes it when the period ends. ### Does Harmony handle deprovisioning when someone leaves? Yes. The HRIS termination starts offboarding, which opens the tasks to terminate accounts and return company assets. Account termination disables the account and revokes sessions after manager approval. See the [employee offboarding checklist](https://harmony.io/insights/employee-offboarding-checklist). ### What about apps that aren't connected to the identity provider? They route to the desk you choose for manual provisioning, with the approved request and the requester's details already on the ticket.