Skip to main content

​
Introduction

You can start employee onboarding in three ways: via Slack, via the web interface, or automatically via an HRIS integration:
To onboard an employee via Slack:
  1. Go to the AccessOwl home tab and click “Onboard New User”, or use the /onboard command. This opens the web onboarding flow in your browser.
  2. Enter the user’s name, email, manager, and the provisioning start date.
  3. Choose the applications and permissions the user needs. You can also select one or more access templates.
The manager is notified of this selection and can request additional applications and permissions.
AccessOwl ensures that a Google Workspace or Microsoft 365 email exists for the new hire before provisioning begins. If no email is found and neither service is part of the onboarding template, provisioning is paused. You can manually create the email, sync AccessOwl, and resume the onboarding process without delays.
If an application has mandatory resources configured, you must include them in the onboarding selection. If mandatory resources are missing, you’ll see a validation error listing the required permissions. Where a mandatory resource is configured with Any child resource required, including any one of its child resources is enough.

​
Onboarding Contractors and External Users

If you need to onboard a contractor, consultant, or any user who is not in your HRIS and does not share your organization’s email domain, you can create them as an external user in AccessOwl. Requesting access for an external user in Slack
1

Open Access Request in Slack

Go to the AccessOwl home tab in Slack and click Request/Change Access
2

Type the full email address

In the Access for field, type the full email address of the contractor, including their external domain. You will see a “Create [email you typed]” option appear. Select it to create the external user in AccessOwl only. The user will not be added to any of your directory workspaces
3

Select applications

Select one or more applications that you need for this user. You can also add them to applications that are not automated by AccessOwl, so you have a complete overview of their access
4

Submit the request

Click Next. The request will be processed like a regular access request
Having all contractor access tracked in AccessOwl gives you a centralized report view of who has access to what, which is useful for security reviews and compliance

​
Access Templates

Access Templates define which applications and permissions a new hire receives based on their job role. Combined with an HRIS integration, they enable zero-touch onboarding-new employees automatically receive the right access without manual intervention. Key features:
  • Application bundles: Define which applications and permissions each role requires.
  • Auto-assignment rules: Automatically apply templates based on HRIS attributes (department, team, job title).
  • Conflict resolution: Configure attribute priority to handle overlapping permissions.
  • Simulator: Test which templates apply before actual onboarding.
See the Access Templates guide for setup instructions.

​
Best Practices for Using HRIS Integrations

AccessOwl’s integration with HRIS systems like BambooHR, HiBob, or Personio makes onboarding easier by automating account creation for new hires. Follow these steps to maximize efficiency:
  1. Add User to HRIS
    HR typically adds the new employee to the HRIS system before their first day to set up contracts, payroll, and other necessary details.
    You don’t need to include the HRIS itself in any AccessOwl templates.
  2. Receive Slack Notification
    Once the user is added to the HRIS, AccessOwl automatically sends a Slack notification to the designated channel.
    No manual action is required to initiate onboarding.
  3. Select Access Templates HR or IT can respond to the Slack notification by selecting the appropriate access templates and onboarding date. Alternatively, if you’ve configured auto-assignment rules, matching templates are applied automatically (zero-touch). This ensures the new hire receives the correct tools and permissions.
  4. Automated Provisioning
    AccessOwl automatically provisions integrated apps like Google Workspace and Slack.
    For apps without integration, respective admins are notified via Slack for manual setup.
  5. Onboarding Date
    Provisioning begins on the scheduled onboarding date, ensuring everything is ready for the new hire’s first day.

​
FAQ

By default, HR or Org Admins select applications for new users. If you’d prefer managers to handle this task, you can adjust that in settings.For HRIS onboardings, templates can be auto-selected based on employee attributes if you configure auto-assignment rules.
No. Apps selected in an onboarding, by hand or through an Access Template, are approved as part of the onboarding and skip the app’s approval policy.To keep the policy for an app, leave it out of the onboarding and have the manager request it for the new hire afterwards. That request goes through the normal approval flow.
Yes, AccessOwl can restrict permissions so that only HR can manage onboarding and offboarding processes. By default, both HR and Org Admins can perform these tasks.
When the new hire’s temporary login credentials are sent to their personal email address, some mail providers move the email to the spam or junk folder. Because the message carries login credentials, spam filters can score it higher than regular mail, and each provider (Gmail, Outlook, iCloud) filters differently.AccessOwl follows email deliverability best practices, but the final inbox placement is decided by the recipient’s mail provider. The practical step is to tell new hires to check their spam or junk folder on day one, for example as part of your onboarding notices.To skip email altogether, choose Application admins under Send the credentials of the new account to when you onboard them. The credentials then go to the Application Admins of Google Workspace or Microsoft 365 as a Slack message, and they hand them over.
During onboarding, you can set a specific provisioning date for granting access. Approvals are processed immediately, but accounts and permissions will only be activated on the date you select. This ensures everything is ready for the new hire’s first day.When a scheduled onboarding applies access templates, the new user’s manager receives a Slack message listing the applications being requested. To add applications, the manager submits an access request for the new user.
Provisioning runs at the exact date and time AccessOwl has for the onboarding.
  • When you schedule an onboarding manually in Slack or the web interface, you choose both the date and the time, and provisioning starts at that time.
  • For HRIS onboardings, the time comes from your HRIS. Some providers send a specific start time, which AccessOwl uses as-is. Others send only a date with no time, in which case provisioning defaults to midnight UTC (00:00 UTC) on the start date.
If you need provisioning to run at a specific local time, set the time explicitly when scheduling, or check whether your HRIS includes a start time in what it sends to AccessOwl.
Open the user’s profile in the admin interface. Once the user’s status is Offboarded, a Reactivate button appears in the top-right corner.
1

Complete the offboarding if it is still in progress

If the user is still in Offboarding status (offboarding steps remaining), click Skip Remaining on their profile. The status moves to Offboarded and the Reactivate button appears in the top-right corner.
2

Reactivate the user

Click Reactivate. This is access-neutral: it sets the user back to active without restoring any of their previous access or stopping existing revocations. The warning saying so is expected.
3

Assign the access they need

Add the applications and permissions they need (Google Workspace, Slack, and so on), the same way you would for any user.
To provision that access on a future date instead, after reactivating use the three-dot menu in the top right to schedule the onboarding, where you can set a provisioning date and select an access template.
Reschedule Onboarding, in the middle of the user’s profile, changes when a scheduled onboarding runs. To change its templates or applications, cancel it and trigger it again.
  1. Open the user’s profile in the admin interface and click Cancel remaining, then confirm. This cancels the requests that haven’t been provisioned yet and marks the user as Active.
  2. Click the three dots in the top right of the profile and select Trigger Onboarding.
  3. Set the provisioning date and select the templates and applications.
Templates are matched when the onboarding is created. If you change an auto-assignment rule afterwards, onboardings that are already scheduled keep their original templates, so use the steps above to apply the new ones.
This happens when no applications were selected when the onboarding started, so the flow never completed. Open the user’s profile and click Cancel on the onboarding banner. The user switches to Active and keeps all their current access; cancelling only closes out the unfinished onboarding flow.
This can happen when a start date changes in your HRIS and the new date doesn’t sync through to an onboarding that was already scheduled, so the profile keeps showing the original (sometimes already past) date.You can fix it without waiting for a sync. Open the user’s profile in the admin interface, click the three dots in the top right, and select Retrigger onboarding. You can then choose the provisioning date you want and select the applications to assign.
Last modified on October 26, 2026