Seamless employee on-and off-boarding

By Nick Church
August 23, 2018
On and Offboarding

Editor’s Note: When talking to Nick Church, IT Specialist at BetterCloud, we were amazed at how much of this process is communication and coordination first. Give it a read and learn how to create the structure for a nice & smooth on-boarding process that lets you sleep at night! :) Thanks for contributing to our IT Manager Checklist too!

Employee on-boarding starts with communication

At Bettercloud, we have a Slack channel specifically dedicated to recruiters. This channel keeps us updated on any open roles they have and are looking to fill soon. It also helps to keep IT managers updated when recruiters send offers so nobody runs into any surprises. In addition to the channel, we also have a weekly meeting where we update everyone on upcoming hires.

With regards to planning for each role, we have a spreadsheet with upcoming hires and computers they need with a corresponding due date. This allows for easy accountability and efficiency when things are missing or are not checked off. For example, if we have any discrepancy in the sheet, I’ll @here our channel to see what is going on. Organisation is really crucial especially when IT, HR, Office Manager and Recruiter are in that process and pipeline.

In a nutshell, I see IT as interpersonal job where you always need to communicate with each other and to help make things go smoothly.

Preparing for on-boarding

Our gold standard in employee on-boarding is that people start on Friday. Earlier that week on Tuesday, their google accounts get provisioned and access to most programs gets turned on -- including access to the building. Especially on Tuesdays, which is the IT deadline day for new employee on-boarding, I check my calendar for the week and the next week if we have anything coming up. If there is something odd, that gives us sufficient buffer time on Wednesday and Thursday to figure it out. So by Friday AM, there is definitely a computer on the new hire’s desk that is ready to go.

IT then creates their Google Account and HR adds them to the payroll. An interesting point to note is that all email addresses follow a standard format so in the case of an emergency, HR would know what the email address will be. We have about 200 programs in total that people can have access to. Many of them are limited to 1 or 2 people, while others are used by everyone like Google SSO.

2 Factor Authentication (2FA) is activated by default on each Google Account, and we have a rather special way of handling it. We put the new employee in an exception OU group which is meant for people who do not have 2FA enforced. This way, it is locked down and prevents them from using certain services or even adding their email account to their mobile. On Friday AM where we would have the on-boarding, we will check if they have turned on 2FA. Only after this will we continue with on-boarding, where they will be introduced to the knowledge base, and a couple of workflows will be automatically fired -- some of which adds them to their respective Slack channels.

onboarding workflow
Employees are automatically added to Slack channels

Onboarding the new employee

On Friday when new employees are starting - our HR and hiring manager have an all-day event at the starting day where they onboard them with a session on how to use all the programs.

Firstly we make sure the computer is set up, and that they have changed their password. Then we show them how to book a room for video conferencing (we use chromebox for meetings). We also make sure that their lastpass account is set up. Following which, we review company security policies with them, run through our knowledge base (we use confluence which works well because a lot of people are familiar with it), and run through our MDM policy. They don’t need to bring their own devices -- but if they do, we use Google Device Management to govern usage. Otherwise, JAMF is used to govern the usage of company laptops.

JAMF is used to govern usage of company laptops

Where Bettercloud steps in

Each role has their own sets of pre-configurations and workflows set up that runs on-boarding according to their OU (Organizational Unit). It saves emails and other manual operations by automatically adding people to groups and channels. For organisation, we do have OU, Parent OU and sub OU that could be overlayed.

The Role of Physical Access Control for IT

Learn about future-proof access control with Kisi

The Role of Physical Access Control for IT


We have an exit notification group in Slack where one has to be added in by an admin. If there is an exit, HR sends a notification to that Google Group with regards to when the accounts need to be turned off and what should happen to the data. 99 out of 100 times, the manager of the exiting employee gets the transferred data. Depending on whether calendar meetings will be kept, etc., we transfer the desired events and data, reset passwords and re-route emails to their manager. For software that is not included in SSO, we have a separate checklist where we will run through manually. When it’s time to initiate, HR sends us a message and everyone works together to get this done -- looping all relevant parties in for everyone to be on the same page.

All in all, I think we’ve figured out a good way to integrate the HR and IT on-boarding process. I hope this sharing of my experience helps to make yours better too! For more information on IT onboarding and offboarding you can check out our IT Expert checklist. It's crucial to establish a firm knowledge base; while this process looks different for every company there's a lot to be learned from the effective strategies of other companies and experts.

Nick Church
Nick Church

IT Specialist at BetterCloud