Onboard your first hire

Before you start

• A persona for the new person’s role. The persona decides what they get. See Create a persona.
• An onboarding pipeline that is published. Every instance comes with one called “Master Onboarding” (HR Trigger, IT Setup, Manager Approval).
• People in an “HR” (or “Human Resources”) group and an “IT” group to work their steps. Administrators can work any step.
• Optional: email set up, so IT and the hire’s manager are notified. IT alerts go to “IT recipients” under Security & ComplianceSecurity SettingsEmail / SMTP.

Start the run

1. 1

   Step 1: Open Workflow Tasks

   Go to ExecutionWorkflow Tasks and click “Start a run”. A window with the same name opens.

   If the button is greyed out, your role cannot start runs. Hover it to read why; you can still work the runs assigned to you.

2. 2

   Step 2: Pick the onboarding pipeline

   Under “JOINER”, click your onboarding pipeline. The one marked “DEFAULT” is the one to use unless you built your own.

   The window shows every step in order, how many wait on a person and how many run on their own, and which team gets it first.

3. 3

   Step 3: Enter the person

   Type their “Full name”. Add their “Work email” if you have it; if the pipeline starts with an HR step, HR can fill it in there.

   Add a “Start date (optional)” if you know it. Everything IT has to do by hand is dated to this day.

4. 4

   Step 4: Check the persona

   If the pipeline has no IT step, pick a “Persona” here and read the list of what they get: a lightning icon means it will be set up automatically, a person icon means it lands on IT as a task.

   If the pipeline has an IT step (the default does), you will not pick it here. HR proposes the persona at the first step and IT confirms it at theirs.

5. 5

   Step 5: Start it

   Click “Start run”. If you set a start date, you can tick “Hold until …” so nobody sees the run until then. Leave it off if IT should prepare in advance.

Work the steps

1. 6

   Step 6: HR confirms the details

   The run appears in “Workflow Tasks” under “Waiting on you” for the HR team. Click it, then “Open & complete step”. Use “Assign to me” so the team knows who has it.

   HR checks the name, “Reports To (Manager)”, “Employee Start Date” and “Personal Email”, proposes the persona, and clicks “Complete step”.

2. 7

   Step 7: IT confirms the persona

   The “IT Setup” step moves to the IT queue. IT confirms the persona and clicks “Complete step”. This locks in what the person will get.

3. 8

   Step 8: The manager approves

   “Manager Approval” goes to the person’s own manager, not to a pool. They confirm the approval and click “Approve & continue”.

4. 9

   Step 9: Automatic steps run

   After approval, the run adds one step per connected system in the persona (for example Okta or Google). Whether these run on their own depends on the pipeline’s automation setting:

   • “Accounts automatic” (the default for onboarding): accounts are created on their own; approvals still wait.
   • “Runs manually”: every step waits. Automatic steps show “WAITING TO RUN” until an administrator opens them and clicks “Run this step now”.
   • “Fully automatic”: every step marked automatic runs unattended.

   Change it in ExecutionWorkflow BuilderManage under “AUTOMATION”.

   What HR needs to know: if your company creates accounts in its own directory, the new hire gets a temporary password. It is emailed to the “Personal Email” you entered, if you entered one and email is set up. If not, IT is shown it once and passes it on.

For IT: passwords, dated tasks and hardware

1. 10

   Step 10: Pass on a directory account’s temporary password

   A new account in Microsoft Entra ID, Active Directory or OpenLDAP comes with a temporary password, which the person must change the first time they sign in.

   When it is not emailed to the hire’s personal address, the step shows a “Reveal password” button to the team that holds the run. Click it, pass the password to the new hire, and note that it is shown only once: after that it is deleted.

2. 11

   Step 11: IT works the dated tasks

   Anything without a connector (an app you have not connected, a licence, a laptop) becomes an IT task due on the start date. IT does the work, ticks each item, and clicks “Complete step”. The step cannot be completed until every item is ticked.

3. 12

   Step 12: Link the new hire’s computer

   When the hardware list includes a laptop or desktop, Zonitix reserves a place for it under DevicesInventory (filter the list by “Reserved for new hires”).

   • If IT records the serial number on the hardware step, the computer is linked to the new hire by itself when it enrolls. A Linux computer reports a machine ID in place of the maker’s serial number, so it is linked the second way.
   • If not, Inventory asks whether the newly enrolled computer is theirs, with “Yes, link it” and “Not a new hire’s”.

   See the Enroll a device guide.

Other ways onboarding starts

1. 13

   Step 13: Someone already in Users (a rehire or pre-boarding)

   In AdministrationUsers, people whose status is Pre-boarding, Offboarded or Inactive have an “Onboard (provision from a persona)” icon on their row (“Rehire and onboard” for a former employee).

   Pick a “Persona” and optional “Start date”, check the automatic and IT task counts, and click “Start onboarding” (or “Rehire and onboard”). The run then appears in Workflow Tasks as above.

2. 14

   Step 14: Your identity provider (Okta or Entra)

   If you use SCIM, turn on “Start onboarding for new people” in Security & ComplianceSecurity SettingsProvisioning (SCIM). Each person your identity provider creates then gets an onboarding run. Leave it off for the first sync of existing staff.

3. 15

   Step 15: A signed offer (Team plan and up)

   With HR & Talent, set the “User Persona” on the job posting. When the candidate signs their offer in Zonitix Sign, or you use “Mark as signed manually”, a pre-boarding account and an onboarding run are created for you. The run says “Auto-created from a signed offer”.

What you should see

If something goes wrong

"No published onboarding pipeline" or "NO onboarding run was created — there is no active onboarding workflow"

Open Workflow Builder, go to the Onboarding tab, and send your pipeline for approval with Submit for approval. If it was retired, use Manage, then Reinstate pipeline. Nothing is provisioned until one is approved and live.

The Onboard icon is missing on a person in Users

It only shows for people who are Pre-boarding, Offboarded or Inactive. For someone whose account is already Active, start the run from Workflow Tasks with Start a run instead.

"… already has an onboarding run in progress."

Zonitix will not create a second run for the same person. Find the existing one in Workflow Tasks with the search box.

"You cannot onboard a user into a role that grants access you don’t hold"

The persona gives access you do not have yourself. Ask an administrator who holds that access to start the onboarding.

Reveal password says "This one-time password has already been revealed, or was delivered by email — nothing to show."

The temporary password can be shown only once, and it is not shown at all if it was emailed to the new hire. If nobody has it, reset the password in the directory itself (for example in the Microsoft Entra admin center).

The HR step is waiting but nobody on the HR team can see it

The HR queue belongs to a group named HR or Human Resources. Add the right people to that group in Groups, or have an administrator complete the step.

Still stuck? See When something goes wrong, or Contact Zonitix support.

Where next

• Create a persona
• Connect Okta, Entra or Google
• Enroll a device
• Offboard someone