Set up Workday new hires in Okta before their first day

Every weekday at 7am, find the people joining the company in the next few days and get their accounts and applications ready before their first morning. This workflow only ever grants access. It must never deactivate a user, unassign an application, or remove access of any kind, even if a record looks wrong or out of date. If something seems off, provision what is safe and flag the rest for a human.

Start in Workday. Use Staffing – List Workers to retrieve workers whose hire date is today or falls within the next three business days, and page through the collection until you have everyone in that window. For each person, capture their full name, preferred name, work email, hire date, job profile, department, supervisory organization and work location. Use Staffing – Get Worker when you need more detail on an individual than the list returns.

Identify each new hire's manager. Take the supervisory organization from the worker record and resolve who leads it with Common – Get Supervisory Organization, and confirm the reporting relationship using Common – List Workers Supervisory Organizations Managed, which returns the supervisory organizations a given worker manages. Capture the manager's name and work email. If you cannot confidently determine the manager, continue provisioning and note the gap in the summary rather than stopping.

Then check Okta. Look each new hire up by their work email with Retrieve User, and fall back to List Users with a search on the email or profile attributes if the direct lookup does not find them. If the person already exists, keep their account as it is and do not modify their profile. If they do not exist, create the account with Create User using their name, their work email as both login and username, and their job title and department from Workday, then run Activate User so they can set a password ahead of their start date.

Now decide which applications each person should receive. Use List Applications to see what app integrations exist in the org, then map the person's job profile, department and work location onto the right bundle. Apply judgement rather than an exact string match. A sales job profile should get the sales tooling bundle such as the CRM, dialer and sales engagement apps. An engineering job profile should get the engineering bundle such as source control, CI and error tracking. Everyone should get the baseline apps that all employees receive, such as email, chat and the HR portal. Take work location into account where an app is region specific. If a job profile does not map cleanly to any bundle, grant only the baseline apps and flag the person for a human decision.

Before assigning anything, check what the person already has, using List Application Users on the target app or List User App Links on the user. Only call Assign User to Application for apps they are not already assigned to. If a new hire already has an active account and every application in their bundle, treat them as fully provisioned, skip them, and do not post about them again. This is what makes repeated runs safe, so never assume a fresh start.

Finish with two Slack messages sent as the bot. First, post a welcome message in the team channel using Send a Message, introducing the person by name along with their role, department, team and start date, written warmly in a couple of sentences so the team knows who is arriving and what they will be working on. Second, send the hiring manager a direct message: find them with Look Up User by Email using their work email, get the DM channel with Open a Conversation, then use Send a Message to deliver a short summary listing exactly which applications were newly provisioned, which were already in place, and anything still needing a human, such as hardware, a licence that has to be purchased, or an app the workflow could not match confidently.

If there are no new hires in the window, or everyone found is already fully provisioned, post nothing at all.