# Set up Workday new hires in Okta before their first day

> Every weekday at 7am we spot who is starting soon, create their accounts, grant the right apps, and tell their manager what is ready.

- Workflow type: agent
- Services: Workday, Okta, Slack Bot
- Categories: HR & People, Operations
- Published: 2026-08-10

## What it does

- Checks Workday every weekday morning for anyone whose start date is today or falls within the next three working days
- Creates and activates their Okta account if they do not have one yet, and leaves any existing account exactly as it is
- Grants the set of apps that matches their role, department and location, skipping anything they already have
- Posts a welcome note in your team channel and sends the hiring manager a direct message listing what is ready and what still needs a person

## What you'll need

- A Workday connection that can read worker and organization records
- An Okta account with admin rights to create people and give them apps
- A Slack workspace with our bot added, and the channel where welcome posts should appear
- A rough idea of which apps each kind of role should get, for example what a new salesperson needs versus a new engineer

## Prompt

Every weekday at 7am, find the people joining the company in the next few days and get their accounts and applications ready before their first morning. This workflow only ever grants access. It must never deactivate a user, unassign an application, or remove access of any kind, even if a record looks wrong or out of date. If something seems off, provision what is safe and flag the rest for a human.

Start in Workday. Use Staffing – List Workers to retrieve workers whose hire date is today or falls within the next three business days, and page through the collection until you have everyone in that window. For each person, capture their full name, preferred name, work email, hire date, job profile, department, supervisory organization and work location. Use Staffing – Get Worker when you need more detail on an individual than the list returns.

Identify each new hire's manager. Take the supervisory organization from the worker record and resolve who leads it with Common – Get Supervisory Organization, and confirm the reporting relationship using Common – List Workers Supervisory Organizations Managed, which returns the supervisory organizations a given worker manages. Capture the manager's name and work email. If you cannot confidently determine the manager, continue provisioning and note the gap in the summary rather than stopping.

Then check Okta. Look each new hire up by their work email with Retrieve User, and fall back to List Users with a search on the email or profile attributes if the direct lookup does not find them. If the person already exists, keep their account as it is and do not modify their profile. If they do not exist, create the account with Create User using their name, their work email as both login and username, and their job title and department from Workday, then run Activate User so they can set a password ahead of their start date.

Now decide which applications each person should receive. Use List Applications to see what app integrations exist in the org, then map the person's job profile, department and work location onto the right bundle. Apply judgement rather than an exact string match. A sales job profile should get the sales tooling bundle such as the CRM, dialer and sales engagement apps. An engineering job profile should get the engineering bundle such as source control, CI and error tracking. Everyone should get the baseline apps that all employees receive, such as email, chat and the HR portal. Take work location into account where an app is region specific. If a job profile does not map cleanly to any bundle, grant only the baseline apps and flag the person for a human decision.

Before assigning anything, check what the person already has, using List Application Users on the target app or List User App Links on the user. Only call Assign User to Application for apps they are not already assigned to. If a new hire already has an active account and every application in their bundle, treat them as fully provisioned, skip them, and do not post about them again. This is what makes repeated runs safe, so never assume a fresh start.

Finish with two Slack messages sent as the bot. First, post a welcome message in the team channel using Send a Message, introducing the person by name along with their role, department, team and start date, written warmly in a couple of sentences so the team knows who is arriving and what they will be working on. Second, send the hiring manager a direct message: find them with Look Up User by Email using their work email, get the DM channel with Open a Conversation, then use Send a Message to deliver a short summary listing exactly which applications were newly provisioned, which were already in place, and anything still needing a human, such as hardware, a licence that has to be purchased, or an app the workflow could not match confidently.

If there are no new hires in the window, or everyone found is already fully provisioned, post nothing at all.

## How to customize

- Change how far ahead it looks. Three working days gives IT a buffer, but you can narrow it to people starting today or widen it to a full week
- Describe your own app bundles in plain language, so a new recruiter, designer or field technician gets the right set instead of a generic one
- Pick which channel gets the welcome post, and decide whether managers get a direct message or whether it all goes to one IT channel

## FAQ

### What happens if someone already has an account?

They are left alone. The workflow keeps the existing account and only adds apps they are missing. If they already have everything on their list, they are skipped entirely and no messages are sent about them. That means you can safely run it again, or run it twice in one day, without creating duplicates or spamming your team.

### Can this also remove access when someone leaves?

No, and that is deliberate. This workflow only ever grants access. It will never switch off an account or take an app away, so a bad reading of your data can never lock someone out of their job. Shutting off access when people leave is a separate workflow with its own safeguards.

### How does it know a salesperson needs different apps than an engineer?

It reads the job profile, department and work location that already exist on the Workday record, then matches that to the app bundles you describe. Because it uses judgement rather than a rigid list, it can handle titles you never explicitly planned for, and it tells the manager when it was not confident about a match.

### Do we need a developer to set this up?

No. You need someone who can connect Workday, Okta and Slack, which usually means an IT or people ops admin with the right permissions. Once connected, everything else is described in plain language that you can edit yourself.

### What if nobody is starting that week?

Nothing happens. If there are no upcoming hires in the window, the workflow stays quiet rather than posting an empty update, so your channel only lights up when there is genuinely someone to welcome.

Use this prompt in General Input: https://www.generalinput.com/prompts/set-up-workday-new-hires-in-okta-before-their-first-day