# Provision Okta accounts for today's new hires from BambooHR

> Every weekday at 7am we find everyone starting today in BambooHR, create their Okta account, add them to the right department group, and recap it in Slack.

- Workflow type: code
- Services: Okta, BambooHR, Slack
- Categories: HR & People, Operations
- Published: 2026-08-09

## What it does

- Checks your HR records every weekday morning and picks out the people whose first day is today.
- Creates each new hire an account in your company sign-in system using their work email, name, and department, left inactive so nothing reaches them before you are ready.
- Adds them to the access group that matches their department, so they inherit the right apps automatically instead of someone granting access app by app.
- Posts one message to your IT channel listing every account created, and calls out anyone whose department has no matching group so a person can assign their access by hand.

## What you'll need

- A BambooHR account with permission to read employee records, including start dates
- An Okta organization where you can create users and manage group membership
- A Slack workspace and the channel where IT should get the daily recap
- A list of which Okta group each of your departments should map to, and those groups already created in Okta

## Prompt

Every weekday at 7am, provision Okta accounts for the new hires whose first day is today according to BambooHR.

Read the roster from BambooHR with Request Custom Report, asking for first name, last name, work email, department, and hire date, then keep only the employees whose hire date is today in the company timezone. Use Request Custom Report rather than Get Employee Directory here, because the directory returns only BambooHR's default identity and job fields and does not include hire date, so filtering on start date against the directory would silently match nobody. If a matched employee has no work email or no department, do not create their account, and carry them into the Slack recap as needing manual handling.

For each new hire, first check Okta with List Users, searching on the work email as the login, so a rerun or an already-provisioned employee never produces a duplicate account. If no account exists, call Okta Create User with the work email as both the login and the primary email, plus first name, last name, and department taken from the BambooHR record. Leave the account staged by not activating it on creation, so no activation email goes out until IT deliberately activates it on the person's actual start date. If one account fails to create, keep going with the rest of the hires and report the failure rather than aborting the whole run.

Map the BambooHR department to the matching Okta group using a department to group lookup table defined at the top of the workflow. This table is the headline thing a user configures, so keep it in one obvious place and make it easy to add rows to. Resolve each configured group name to its Okta group id with List Groups, then call Okta Assign User to Group, so baseline app access flows from group membership rather than one-off per-app grants. Never fall back to a default group when a department is unmapped.

Finish by posting a single message to the IT channel with the Slack Send a Message action. List every account created with the person's name, work email, department, and the group applied. Then, under a clearly separated heading, explicitly flag any new hire whose department did not match a configured group, along with anyone skipped for a missing work email or an account that already existed, so a human knows exactly who still needs access assigned by hand. If nobody starts today, do not post anything.

## How to customize

- The department to group map is the main thing you set up: list each department in your HR system and the Okta group its new hires should join. Anything left off the list gets flagged in Slack instead of guessed at.
- Whether new accounts stay inactive until IT activates them, or get activated right away so the welcome email goes out on its own.
- The timing and the audience: 7am on weekdays by default, posting to your IT channel, and staying quiet on days when nobody starts.

## Example output

Okta provisioning for Monday, 9 June
3 accounts created

• Priya Raman | priya.raman@acme.com | Engineering -> okta-engineering
• Tom Ellery | tom.ellery@acme.com | Sales -> okta-sales
• Dana Whitfield | dana.whitfield@acme.com | Customer Success -> okta-customer-success

Needs manual access assignment
• Marcus Lee | marcus.lee@acme.com | department "Studio Ops" has no configured group. Account created and left inactive.

## FAQ

### What happens if a new hire's department does not match any group?

Their account still gets created, and they are listed in a separate section of the Slack message as needing access assigned manually. The workflow never guesses at a group, because a wrong guess quietly hands someone access they should not have.

### Will this email the new hire before their first day?

No. Accounts are created inactive by default, so no activation or welcome email goes out until someone on your team activates the account. If you would rather the email go out automatically the moment the account is made, you can switch that on.

### What if it runs twice, or someone already has an account?

Before creating anything the workflow looks for an existing account with that work email and skips anyone who already has one. Running it again on the same day will not create duplicate accounts.

### Do I need to create the Okta groups first?

Yes. The workflow adds people to groups that already exist, matching them by the group name you put in the department map. It will not create new groups on the fly.

### We use a different HR system. Can this still work?

This version reads from BambooHR, but the shape is the same for the other HR platforms we support. The workflow just needs a roster it can read start dates, work emails, and departments from.

Use this prompt in General Input: https://www.generalinput.com/prompts/provision-okta-accounts-for-todays-new-hires-from-bamboohr