Automated user provisioning from request to revoke
OVERVIEW
What is automated user provisioning?
User provisioning is giving people the accounts and access their job needs, and deprovisioning is taking it away when they change role or leave. Done by hand, access requests are often the largest single category of IT tickets, and a missed deprovisioning step is a security risk.
Harmony provisions through the identity provider you already run. An access request in Slack, Microsoft Teams or the portal is matched to the application, checked against its access policy and sent for approval. Approval tiers can require any one or all approvers and time out, for example after two days. Approved access is applied through Okta, Microsoft Entra ID or Google Workspace, by group or direct assignment. Requests nobody answers in time are never approved automatically: the ticket goes back to the desk.
The employee lifecycle drives the rest. A new hire in the HRIS starts onboarding 14 days before the start date by default, with a parent ticket and linked child tickets for each task. On termination, Harmony disables the account and ends active sessions in Okta, Microsoft Entra ID or JumpCloud after manager approval, and offboarding opens the task to return company assets. Automating app access requests goes deeper on the request side.
CAPABILITIES
Access that follows the job
Provisioning through your IdP
Access granted by Okta, Microsoft Entra ID or Google Workspace group, or by direct assignment.
Approval tiers
Any one or all approvers per tier, more than one tier where needed, with reminders and a timeout.
Business justification
Require a reason for access per identity provider, with each application's own policy able to override it.
Time-limited access
Grants for 1 hour or for 30, 60 or 90 days that revoke themselves.
Auto-approval
Per application, for the tools everyone should have.
Manual fallback
Applications outside the identity provider route to the desk you choose, so nothing waits in limbo.
Group sync
Groups from Okta, Google Workspace and Microsoft Entra ID sync every four hours.
Deprovisioning
Account disable and session revocation in Okta, Microsoft Entra ID and JumpCloud on termination.
HOW IT WORKS
How automated provisioning works
An employee asks for an app, a new hire appears in the HRIS, or someone leaves.
- 1
Request
The employee asks in Slack, Microsoft Teams or the portal, in their own words.
- 2
Check the policy
Harmony matches the application, reads its access policy and asks for a business justification if one is required.
- 3
Approve
Approvers get the request where they work and approve with one action. Unanswered requests go back to the desk.
- 4
Provision
Access is applied through an Okta, Microsoft Entra ID or Google Workspace group, or routed to a desk for applications outside the identity provider.
- 5
Revoke on time
Time-limited grants expire on their own, and termination disables the account and ends its sessions.
Access that matches the job, granted in minutes and removed when it should be.
Fireblocks' access agent has run 915 times
Application access was 44% of Fireblocks' old Jira Service Management queue. It is now the platform's largest automation: Harmony's access request agent has run 915 times, resolving the application, routing to the right approver and provisioning through Okta groups.
“It can't be just an approval - the actions the agent can take are too critical. Harmony put the challenge at a higher level, exactly where we needed it.”
RELATED INTEGRATIONS
Provisioning through your identity and HR systems
Identity
Developer access
FAQ
Granting the accounts and access an employee needs without a technician doing it by hand, and removing them when the employee changes role or leaves. Harmony does it through your identity provider, with approvals and time limits.
Ready to build your agentic service desk?
See agents resolving your own tickets in a 30-minute session. No slides.