Provision Okta accounts for today's new hires from BambooHR

Every weekday at 7am, provision Okta accounts for the new hires whose first day is today according to BambooHR.

Read the roster from BambooHR with Request Custom Report, asking for first name, last name, work email, department, and hire date, then keep only the employees whose hire date is today in the company timezone. Use Request Custom Report rather than Get Employee Directory here, because the directory returns only BambooHR's default identity and job fields and does not include hire date, so filtering on start date against the directory would silently match nobody. If a matched employee has no work email or no department, do not create their account, and carry them into the Slack recap as needing manual handling.

For each new hire, first check Okta with List Users, searching on the work email as the login, so a rerun or an already-provisioned employee never produces a duplicate account. If no account exists, call Okta Create User with the work email as both the login and the primary email, plus first name, last name, and department taken from the BambooHR record. Leave the account staged by not activating it on creation, so no activation email goes out until IT deliberately activates it on the person's actual start date. If one account fails to create, keep going with the rest of the hires and report the failure rather than aborting the whole run.

Map the BambooHR department to the matching Okta group using a department to group lookup table defined at the top of the workflow. This table is the headline thing a user configures, so keep it in one obvious place and make it easy to add rows to. Resolve each configured group name to its Okta group id with List Groups, then call Okta Assign User to Group, so baseline app access flows from group membership rather than one-off per-app grants. Never fall back to a default group when a department is unmapped.

Finish by posting a single message to the IT channel with the Slack Send a Message action. List every account created with the person's name, work email, department, and the group applied. Then, under a clearly separated heading, explicitly flag any new hire whose department did not match a configured group, along with anyone skipped for a missing work email or an account that already existed, so a human knows exactly who still needs access assigned by hand. If nobody starts today, do not post anything.