FS-DOC-03Operations
Process Runbook / SOP
User Provisioning & Access Management
[YourCompany.com] · IT Department · Prepared by FullSpec · [Today's Date]
This runbook is the operating guide for the IT Administrator responsible for the User Provisioning and Access Management automation. It covers how the process runs end to end, what the automation handles without any action from your team, where a human decision is required, and how to deal with exceptions when they arise. FullSpec builds, monitors, and maintains the automation layer. Your team's role is limited to the single approval step for elevated permissions and to keeping the access policy rules up to date.
01Process overview
When BambooHR marks an employee record as New Hire, Transfer, or Terminated, the automation fires immediately. The Provisioning Policy Agent reads the employee's role and department, maps them against your access policy, and creates or deactivates accounts across Okta, Google Workspace, Microsoft 365, and Slack in sequence. If the role carries elevated or non-standard permissions, the workflow pauses and sends the IT Administrator a review request before any accounts are created. Once approved, provisioning resumes automatically. On termination, the Offboarding Audit Agent takes over, executes the full deactivation sequence, transfers file and email ownership to the line manager, and writes a timestamped audit record to Jira. No ticket queue, no manual follow-up, and no spreadsheet entry is required for standard events.
Process name
User Provisioning & Access Management
Trigger
BambooHR employee record moves to New Hire, Transfer, or Terminated status
Final output
All accounts provisioned or deactivated, manager notified, and a timestamped audit ticket created in Jira
Agents running
Provisioning Policy Agent; Offboarding Audit Agent
Tools involved
BambooHR, Okta, Google Workspace, Microsoft 365, Slack, Jira
Weekly volume
Approximately 6 to 10 provisioning events per month (hire, transfer, or departure)
Human checkpoint
IT Administrator reviews and approves any provisioning request flagged for elevated or non-standard permissions
Process owner
IT Administrator
Process Runbook / SOPPage 1 of 4
FS-DOC-03Operations
02Step-by-step: what happens and who acts
What you actually need to do: There is one human step in this process. When the Provisioning Policy Agent flags a new hire or transfer record as requiring elevated or non-standard permissions, you will receive a Slack notification with a summary of the requested access. You review the request and either approve or reject it directly from the notification. If you approve, provisioning continues automatically. If you reject it, the agent holds the request and alerts you to confirm the correct access level before retrying. Every other step in the table below runs without any action from your team.
Step
What happens
Who acts
Type
1
BambooHR detects that an employee record has moved to New Hire, Transfer, or Terminated status and immediately fires the workflow trigger.
Automation
Automated
2
The Provisioning Policy Agent reads the employee's role, department, and location from BambooHR and maps them against the stored access policy to produce a full provisioning or deprovisioning manifest.
Provisioning Policy Agent
Automated
3
The agent checks whether the resolved access profile includes any elevated or non-standard permissions. If it does, the workflow pauses and sends a Slack alert to the IT Administrator with the access details for review.
Provisioning Policy Agent
Automated
4
The IT Administrator reviews the flagged access request and approves or rejects it via Slack. This is the only step that requires a human decision. All standard-permission events skip this step entirely.
IT Administrator
Human
5
The automation creates or deactivates the user's account in Okta, setting the correct profile attributes, group memberships, and SSO federation settings based on the approved manifest.
Provisioning Policy Agent
Automated
6
A Google Workspace account is created in the correct organisational unit with access to the relevant shared drives and group inboxes, or the account is suspended and ownership of Drive files and the mailbox is transferred to the line manager on offboarding.
Provisioning Policy Agent / Offboarding Audit Agent
Automated
7
The correct Microsoft 365 licence tier is assigned, the user is added to the relevant Teams and SharePoint groups, or access is removed and the mailbox is archived according to your data retention rules on departure.
Provisioning Policy Agent / Offboarding Audit Agent
Automated
8
The user is invited to the Slack workspace and added to all role-mapped channels automatically, or deactivated and removed from all channels if the trigger was a termination.
Provisioning Policy Agent / Offboarding Audit Agent
Automated
9
A Slack and email notification is sent to the hiring or departing employee's line manager confirming every action taken. A timestamped Jira ticket is created as the permanent audit record for compliance purposes.
Offboarding Audit Agent / Automation
Automated
Process Runbook / SOPPage 2 of 4
FS-DOC-03Operations
03Handling exceptions
Situation
What the system does
What you do
Employee record is missing required fields (role, department, or start date blank in BambooHR)
The Provisioning Policy Agent cannot resolve an access profile without a complete record. It pauses the workflow and sends a Slack alert to the IT Administrator and HR Manager listing the missing fields.
Ask the HR Manager to complete the BambooHR record. Once the fields are filled, the trigger will re-fire automatically and provisioning will proceed without any manual restart.
A duplicate employee record is detected (same name and email already active in Okta)
The agent detects a conflict during the Okta account creation step and halts provisioning for that record. It raises a Jira alert flagging the duplicate and does not create a second account.
Review the existing Okta account to confirm whether it is a genuine duplicate or a rehire. If it is a rehire, reactivate the existing account manually and close the Jira alert. If it is a data error, correct the BambooHR record and allow the workflow to retry.
A required system or group is not found (for example a Slack channel or SharePoint site in the access policy no longer exists)
The agent logs the missing item in the Jira audit ticket and marks that specific action as incomplete, but continues provisioning all other systems. A Slack alert is sent to the IT Administrator noting which item could not be assigned.
Create the missing channel or site, then manually add the user to it. Update the access policy rules to reflect the correct channel or site name so future provisioning succeeds automatically.
IT Administrator does not act on an elevated-permissions review request within four hours
The workflow sends a follow-up Slack reminder after two hours of no response. If there is still no action after four hours, the agent escalates to the Operations Lead via Slack and holds the provisioning request open.
Approve or reject the request as soon as possible. If you need to delegate the review temporarily, notify the Operations Lead so they can act on the escalation. The workflow resumes the moment a decision is recorded.
A deactivation step does not confirm success within two minutes during offboarding (for example Okta or Microsoft 365 returns an error)
The Offboarding Audit Agent raises an immediate Slack alert to the IT Administrator, marks the failed step as unconfirmed in the Jira audit ticket, and continues attempting the remaining deactivation steps across other systems.
Manually deactivate the account in the affected system as quickly as possible to close the security exposure. Confirm completion in the Jira ticket. Contact FullSpec support at support@gofullspec.com if the failure repeats.
A connected tool is unavailable (for example Google Workspace or Okta API returns a service outage or timeout)
The automation retries the failed action three times with a 90-second interval between each attempt. If all three retries fail, the workflow pauses, logs the outage in Jira, and sends a Slack alert to the IT Administrator with the affected step clearly identified.
Check the relevant tool's status page to confirm the outage. If the service recovers quickly, the automation will retry automatically when connectivity is restored. If the outage is extended, complete the affected step manually and note it in the Jira audit ticket. Notify FullSpec support at support@gofullspec.com if the workflow does not recover within one hour of service restoration.
04Who to contact and when
Fill in once your team is confirmed. The rows marked with brackets are placeholders for your own team contacts. The FullSpec rows are fixed and do not need to be updated.
Role
Name
How to reach them
IT Administrator (process owner)
[Your name]
[Your email or Slack handle]
HR Manager (BambooHR record updates)
[HR Manager name]
[HR Manager email or Slack handle]
Operations Lead (escalation for delayed approvals)
[Operations Lead name]
[Operations Lead email or Slack handle]
Legal or Compliance contact (data retention queries)
[Legal contact name]
[Legal contact email]
FullSpec builder (workflow changes, agent updates, technical issues)
FullSpec
support@gofullspec.com
FullSpec support (errors, outages, unexpected behaviour)
FullSpec Support
support@gofullspec.com
Process Runbook / SOPPage 3 of 4
FS-DOC-03Operations
05Ongoing maintenance
Whenever a role is created, changed, or removed
Update the role-to-access mapping rules that the Provisioning Policy Agent uses to build its manifest. If the access policy is not kept current, new hires in that role will receive incorrect or incomplete provisioning. Contact FullSpec at support@gofullspec.com if rule changes require a change to the agent logic rather than just a policy document update.
IT Administrator
Whenever a Slack channel, SharePoint site, or shared Drive is renamed or archived
Update the access policy document to reflect the new channel or site name or mark the item as retired. Outdated references will cause the provisioning step to fail silently for that item and generate an alert.
IT Administrator
Monthly spot-check (first Monday of each month)
Review the Jira audit log for the previous month. Confirm that every provisioning and deprovisioning event has a complete and timestamped record. Check for any tickets marked as incomplete or unconfirmed and resolve outstanding items.
IT Administrator
Monthly error-log review (first Monday of each month)
Check the automation platform's error log for any failed retries, skipped steps, or repeated alerts during the previous month. If the same error appears more than twice, raise it with FullSpec support so the root cause can be addressed before it affects a live event.
IT Administrator, FullSpec
Whenever a team member with a contact role in this runbook changes
Update the contact table in Section 04 of this document and confirm the new contact details with FullSpec so escalation routing in the automation is updated to match.
IT Administrator
Quarterly volume review (every three months)
Compare actual monthly provisioning event volumes against the baseline of 6 to 10 events per month. If volume has grown significantly, confirm that the current automation tier and tooling plan still cover your needs. Share updated figures with FullSpec if a capacity or plan review is needed.
IT Administrator, Operations Lead
The most common maintenance issue for this process is an outdated access policy. When a team restructure, a new SaaS tool, or a role rename is not reflected in the mapping rules, the Provisioning Policy Agent produces an incomplete or incorrect manifest, which triggers an exception alert and requires manual correction. Set a reminder to review the access policy document whenever your organisation adds a new tool, restructures a department, or creates a new role type, not only during the scheduled quarterly review.
Process Runbook / SOPPage 4 of 4