---
# === IDENTITY ===
id: business/erp-integration/employee-onboarding-automation/2026
canonical_question: "How do you automate employee onboarding from HRIS to IT provisioning to ERP access?"
aliases:
  - "How to automate new hire IT provisioning from HR system"
  - "HRIS to Active Directory to ERP onboarding workflow"
  - "SCIM-based employee onboarding across Workday Okta and ERP"
  - "Automated joiner-mover-leaver process for enterprise systems"
entity_type: erp_integration
domain: business > erp-integration > employee onboarding automation
region: global
jurisdiction: global
temporal_scope: 2025-2026

# === SYSTEM PROFILE ===
# Integration playbook — multiple systems involved in the onboarding lifecycle
systems:
  - name: "Workday HCM"
    vendor: "Workday"
    version: "2024R2+"
    edition: "All editions"
    deployment: cloud
    api_surface: "REST (Workday RaaS, SOAP for older integrations)"
  - name: "SAP SuccessFactors Employee Central"
    vendor: "SAP"
    version: "2H 2024+"
    edition: "All editions"
    deployment: cloud
    api_surface: "OData v2/v4, SFAPI"
  - name: "Okta Identity Engine"
    vendor: "Okta"
    version: "OIE 2024+"
    edition: "Workforce Identity Cloud"
    deployment: cloud
    api_surface: "REST, SCIM 2.0"
  - name: "Microsoft Entra ID (Azure AD)"
    vendor: "Microsoft"
    version: "Current"
    edition: "P1/P2"
    deployment: cloud
    api_surface: "Microsoft Graph, SCIM 2.0"
  - name: "ServiceNow ITSM"
    vendor: "ServiceNow"
    version: "Vancouver/Washington DC"
    edition: "ITSM Professional+"
    deployment: cloud
    api_surface: "REST, Table API"

# === VERIFICATION ===
last_verified: 2026-03-03
confidence: 0.85
version: 1.0
first_published: 2026-03-03

# === TEMPORAL VALIDITY ===
temporal_validity:
  status: volatile
  last_breaking_change: "Okta Classic to OIE migration changed lifecycle hooks (2024)"
  next_review: 2026-08-30
  change_sensitivity: high

# === CONSTRAINTS ===
constraints:
  - "SCIM 2.0 does not support custom attributes natively — use enterprise extensions schema (urn:ietf:params:scim:schemas:extension:enterprise:2.0:User)"
  - "Workday pre-hire provisioning requires Workday Integration Security Group configuration — cannot be done via self-service"
  - "Okta SCIM provisioning is push-only by default — HRIS import requires separate HR-as-master configuration"
  - "Microsoft Entra ID inbound provisioning from Workday/SuccessFactors requires P1 license minimum"
  - "ServiceNow Enterprise Onboarding & Transitions (EOT) is a separate SKU from base ITSM"
  - "ERP role assignment cannot be fully automated for SOX-regulated environments — segregation of duties review requires human approval"

# === SKIP CONDITIONS ===
skip_this_unit_if:
  - condition: "Need single-system Workday API reference"
    use_instead: "business/erp-integration/workday-rest-api/2026"
  - condition: "Need Okta SCIM configuration only"
    use_instead: "business/erp-integration/okta-scim-provisioning/2026"
  - condition: "Need SAP SuccessFactors API capabilities"
    use_instead: "business/erp-integration/sap-successfactors-api/2026"

# === AGENT HINTS ===
inputs_needed:
  - key: hris_platform
    question: "Which HRIS is your source of truth?"
    type: choice
    options:
      - "Workday"
      - "SAP SuccessFactors"
      - "BambooHR"
      - "UKG / UltiPro"
      - "Other"
  - key: identity_provider
    question: "Which identity provider do you use?"
    type: choice
    options:
      - "Okta"
      - "Microsoft Entra ID (Azure AD)"
      - "Google Workspace"
      - "Ping Identity"
      - "Other"
  - key: erp_systems
    question: "Which ERP/business systems need access provisioning?"
    type: choice
    options:
      - "SAP S/4HANA"
      - "Oracle ERP Cloud / NetSuite"
      - "Microsoft Dynamics 365"
      - "Salesforce"
      - "Multiple systems"

# === DISTRIBUTION ===
canonical_source: "https://knowledgelib.io/business/erp-integration/employee-onboarding-automation/2026"
suggested_citation: "Source: knowledgelib.io — AI Knowledge Library (verified 2026-03-03)"

# === RELATED UNITS ===
related_kos:
  depends_on: []
  related_to:
    - id: "business/erp-integration/workday-rest-api/2026"
      label: "Workday REST API Capabilities"
    - id: "business/erp-integration/sap-successfactors-api/2026"
      label: "SAP SuccessFactors API Capabilities"
  solves:
    - id: "business/erp-integration/identity-lifecycle-management/2026"
      label: "Identity Lifecycle Management Patterns"
  alternative_to:
    - id: "business/erp-integration/manual-onboarding-checklist/2026"
      label: "Manual Onboarding Checklist (non-automated)"
  often_confused_with:
    - id: "business/erp-integration/user-provisioning-scim/2026"
      label: "SCIM Provisioning (protocol-level, not full onboarding)"

# === SOURCES ===
sources:
  - id: src1
    title: "HR-Driven IT Provisioning"
    author: Okta
    url: https://www.okta.com/solutions/hr-driven-it-provisioning/
    type: official_docs
    published: 2025-01-15
    reliability: authoritative
  - id: src2
    title: "Plan cloud HR application to Microsoft Entra user provisioning"
    author: Microsoft
    url: https://learn.microsoft.com/en-us/entra/identity/app-provisioning/plan-cloud-hr-provision
    type: official_docs
    published: 2025-06-01
    reliability: authoritative
  - id: src3
    title: "SCIM Provisioning: A Complete 2026 Guide"
    author: CloudView Partners
    url: https://cloudviewpartners.com/scim-provisioning/
    type: technical_blog
    published: 2026-01-10
    reliability: high
  - id: src4
    title: "Enterprise Onboarding and Transitions - ServiceNow"
    author: ServiceNow
    url: https://www.servicenow.com/products/enterprise-onboarding-transitions.html
    type: official_docs
    published: 2025-09-01
    reliability: authoritative
  - id: src5
    title: "Microsoft Entra ID and SAP SuccessFactors integration reference"
    author: Microsoft
    url: https://learn.microsoft.com/en-us/entra/identity/app-provisioning/sap-successfactors-integration-reference
    type: official_docs
    published: 2025-03-01
    reliability: authoritative
  - id: src6
    title: "Automated Deprovisioning: A Complete Guide to Securing User Offboarding"
    author: SecurEnds
    url: https://www.securends.com/blog/automated-user-deprovisioning/
    type: technical_blog
    published: 2025-08-01
    reliability: high
  - id: src7
    title: "Workday Provisioning - Okta Identity Engine"
    author: Okta
    url: https://help.okta.com/oie/en-us/content/topics/provisioning/workday/workday-provisioning.htm
    type: official_docs
    published: 2025-06-01
    reliability: authoritative
---

# Employee Onboarding Automation: HRIS to IT Provisioning to ERP Access

## TL;DR

- **Bottom line**: Use your HRIS (Workday, SuccessFactors) as the single source of truth, push hire events via SCIM 2.0 to an identity provider (Okta, Entra ID), which cascades provisioning to AD/directory groups, SaaS apps, ERP roles, and ITSM tickets -- all triggered by the hire record, not manual IT requests.
- **Key limit**: SCIM 2.0 does not natively support custom attributes -- you must use enterprise extension schemas for department, cost center, and role mapping fields.
- **Watch out for**: Pre-start date provisioning timing -- Workday and SuccessFactors expose hire records before the official start date, but downstream systems may reject future-dated users if not configured for pre-hire staging.
- **Best for**: Organizations with 200+ employees onboarding 10+ hires/month who use a cloud HRIS and IdP combination.
- **Authentication**: HRIS-to-IdP uses OAuth 2.0 (Workday) or SAML + OAuth (SuccessFactors); IdP-to-downstream uses SCIM 2.0 bearer tokens or API keys per application.

## System Profile

This is a cross-system integration playbook covering the full employee onboarding lifecycle from hire event in the HRIS through IT provisioning, ERP access assignment, equipment ordering, and ITSM ticket creation. The playbook is HRIS-agnostic at the pattern level but includes specific implementation details for Workday and SAP SuccessFactors as the two dominant enterprise HRIS platforms.

The identity provider (Okta or Microsoft Entra ID) serves as the orchestration hub -- it receives hire events from the HRIS and pushes provisioning actions downstream via SCIM, Microsoft Graph, or application-specific APIs. ServiceNow handles ITSM ticket creation for tasks that require human action (equipment ordering, badge provisioning, workspace assignment).

| System | Role | API Surface | Direction |
|---|---|---|---|
| Workday HCM / SuccessFactors | HRIS -- source of truth for employee master data | REST (RaaS) / OData v2 | Outbound (hire event trigger) |
| Okta / Microsoft Entra ID | Identity Provider -- orchestration hub | SCIM 2.0, REST | Inbound (from HRIS), Outbound (to apps) |
| Active Directory / Entra ID | Directory service -- group/OU assignment | LDAP / Microsoft Graph | Inbound (from IdP) |
| SAP S/4HANA / Dynamics 365 / Salesforce | ERP/CRM -- role and permission assignment | OData / REST / SOAP | Inbound (from IdP or iPaaS) |
| ServiceNow | ITSM -- ticket creation for manual tasks | REST Table API | Inbound (from IdP or iPaaS) |
| Okta Workflows / Workato / MuleSoft | iPaaS -- complex orchestration | REST | Orchestrator |

## API Surfaces & Capabilities

| API Surface | Protocol | Best For | Auth Method | Real-time? | SCIM Support? |
|---|---|---|---|---|---|
| Workday RaaS (Reports as a Service) | HTTPS/JSON or XML | Extracting hire/worker data | OAuth 2.0 (JWT) | Near real-time (polling) | No (use Workday Studio for SCIM) |
| SuccessFactors OData | HTTPS/JSON | Employee Central CRUD | OAuth 2.0 SAML Bearer | Near real-time (polling) | Via Entra ID connector |
| Okta SCIM 2.0 | HTTPS/JSON | User provisioning to downstream apps | Bearer token | Yes | Native |
| Microsoft Graph | HTTPS/JSON | Entra ID user/group management | OAuth 2.0 | Yes | Via provisioning service |
| ServiceNow Table API | HTTPS/JSON | Incident/request/catalog item creation | OAuth 2.0 or Basic | Yes | Limited |

## Rate Limits & Quotas

### Per-Request Limits

| Limit Type | Value | Applies To | Notes |
|---|---|---|---|
| Max SCIM users per page | 100-200 | Okta SCIM push | Configurable, default 100 |
| Max Graph API batch | 20 requests | Microsoft Graph | JSON batch endpoint |
| ServiceNow Table API | 250 records/request | Table API insert | Use batch API for larger payloads |
| Workday RaaS report | 100,000 rows | Report output | Paginate for larger datasets |

[src1, src2]

### Rolling / Daily Limits

| Limit Type | Value | Window | Notes |
|---|---|---|---|
| Okta API rate limit | 600 requests/min | Per-minute | Org-wide; provisioning counts against this |
| Microsoft Graph | 10,000 requests/10min | Per-app | Provisioning service has its own allocation |
| SuccessFactors OData | 200 concurrent / fair use | Per-tenant | No hard daily cap, but throttling applies |
| ServiceNow REST | 10 concurrent | Per-user | Increase via sys_properties |

[src1, src2, src7]

## Authentication

| Flow | Use When | Systems | Token Lifetime | Notes |
|---|---|---|---|---|
| OAuth 2.0 JWT Bearer | Workday-to-Okta server integration | Workday | 60 min | Register ISU in Workday; JWT signed with X.509 cert |
| OAuth 2.0 SAML Bearer | SuccessFactors-to-Entra ID | SuccessFactors | 60 min | Requires SAML assertion from SF |
| SCIM Bearer Token | IdP-to-downstream app provisioning | All SCIM apps | Long-lived | Rotate every 90 days; store in IdP vault |
| OAuth 2.0 Client Credentials | ServiceNow API integration | ServiceNow | 30 min | Register OAuth app in ServiceNow |

[src1, src5, src7]

### Authentication Gotchas

- Workday integration system users (ISUs) require specific security group assignments -- a common deployment blocker. Create the ISU with exact domain security policies for worker data access BEFORE configuring Okta. [src7]
- Microsoft Entra provisioning agent (for on-prem AD writeback) requires .NET runtime on a domain-joined server. This is a separate install from the Entra Connect agent. [src2]
- SCIM bearer tokens issued by some SaaS vendors (e.g., Slack, Zoom) expire silently after 365 days. Set calendar reminders or use IdP-managed token rotation. [src3]

## Constraints
<!-- Agents: read this section before recommending any integration approach from this unit.
     These are hard constraints that must not be violated. -->

- SCIM 2.0 core schema only includes basic user attributes (userName, name, emails, active). Department, cost center, manager, job title, and ERP role mapping require the Enterprise User extension (`urn:ietf:params:scim:schemas:extension:enterprise:2.0:User`) or custom schemas.
- Workday pre-hire provisioning (creating accounts before start date) requires the Pre-Hire Interval field in the Workday-Okta connector. Without it, provisioning only triggers on the actual start date. [src7]
- SOX-regulated ERP access (SAP, Oracle, D365 Finance) cannot be auto-assigned without segregation of duties (SoD) review. The workflow must include a human approval gate for privileged ERP roles, even in a fully automated pipeline.
- Microsoft Entra inbound provisioning from Workday/SuccessFactors requires Entra ID P1 or P2 license. P1 covers basic provisioning; P2 adds access reviews and PIM for just-in-time ERP access. [src2]
- ServiceNow Enterprise Onboarding & Transitions (EOT) is a separately licensed module. Basic ITSM can create tickets via API, but the orchestrated onboarding workflows require EOT. [src4]
- BambooHR and smaller HRIS platforms may not support SCIM natively -- you need an iPaaS (Workato, Celigo) or custom webhook-to-SCIM adapter.

## Integration Pattern Decision Tree

```
START -- Automate employee onboarding from HRIS to ERP
|
+-- Which HRIS is your source of truth?
|   +-- Workday
|   |   +-- IdP is Okta? --> Use native Workday-Okta connector (HR-as-master) [src7]
|   |   +-- IdP is Entra ID? --> Use Entra provisioning service with Workday connector [src2]
|   |   +-- IdP is other? --> Use iPaaS (Workato/MuleSoft) with Workday RaaS
|   +-- SAP SuccessFactors
|   |   +-- IdP is Entra ID? --> Use Entra SF Employee Central connector [src5]
|   |   +-- IdP is Okta? --> Use Okta SFEC provisioning integration
|   |   +-- IdP is other? --> Use iPaaS with SF OData API
|   +-- BambooHR / UKG / Other
|       +-- Check if native IdP connector exists
|       +-- If not --> iPaaS or webhook-to-SCIM adapter
|
+-- What needs provisioning?
|   +-- Identity (AD/directory account) --> SCIM or Graph API from IdP
|   +-- SaaS apps (Slack, Zoom, Google) --> SCIM from IdP (most have SCIM connectors)
|   +-- ERP roles (SAP, Oracle, D365) --> IdP group-to-role mapping + SoD approval gate
|   +-- Equipment (laptop, phone) --> ServiceNow catalog item request via API
|   +-- Physical access (badge, workspace) --> ServiceNow or custom facilities API
|
+-- Pre-start provisioning needed?
    +-- YES --> Configure pre-hire interval (Workday) or future-dated hire (SF)
    +-- NO --> Standard day-of provisioning on start date
```

## Quick Reference

| Step | Source System | Action | Target System | Data Objects | Failure Handling |
|---|---|---|---|---|---|
| 1 | HRIS (Workday/SF) | Hire event created (new worker record) | IdP (Okta/Entra) | Worker profile, department, job code, manager, start date | Retry 3x with exponential backoff; alert HR ops on failure |
| 2 | IdP | Create user identity in directory | Active Directory / Entra ID | sAMAccountName, UPN, email, OU, groups | Retry 3x; fall back to manual account creation ticket |
| 3 | IdP | Assign to AD groups based on department + job role | Active Directory | Group membership | Log and alert; non-blocking for other steps |
| 4 | IdP | SCIM push to SaaS apps | Slack, Zoom, Google Workspace, etc. | User profile, license tier | Per-app retry; deactivate if partial failure |
| 5 | IdP / iPaaS | Assign ERP roles based on job code mapping | SAP / D365 / Salesforce | Security role, permission set, profile | Route to SoD approval queue; do not auto-assign privileged roles |
| 6 | iPaaS / IdP | Create equipment request | ServiceNow | Catalog item (laptop model, peripherals) | Create incident if catalog request fails |
| 7 | iPaaS / IdP | Create badge/workspace request | ServiceNow / Facilities | Location, floor, desk assignment | Non-blocking; create manual ticket fallback |
| 8 | iPaaS / IdP | Send welcome email with credentials + first-day info | Email / Slack | Template with login URLs, IT contact | Retry; queue for manual send |

## Step-by-Step Integration Guide

### 1. Configure HRIS as Source of Truth

Set up the HRIS-to-IdP integration connector. This is the foundational link -- all downstream provisioning depends on it. [src1, src7]

For **Workday + Okta**:
- In Okta Admin > Applications > Add Workday
- Enable "HR as Master" mode (imports users from Workday, not the other way)
- Configure Integration System User (ISU) in Workday with `Get_Workers` API access
- Set Pre-Hire Interval (e.g., 7 days before start date) for early provisioning
- Map Workday worker attributes to Okta profile: `workerID` -> `employeeNumber`, `departmentName` -> `department`, `jobTitle` -> `title`

For **SuccessFactors + Entra ID**:
- In Entra Admin > Enterprise Applications > SuccessFactors to Entra ID user provisioning
- Configure API connection with SuccessFactors OData credentials
- Set scoping filter (e.g., active employees only, specific company codes)
- Map Employee Central fields to Entra attributes

**Verify**: Check that a test hire in the HRIS sandbox appears in the IdP within the configured sync interval (typically 5-40 minutes for initial sync).

### 2. Configure Directory Account Creation

The IdP creates the on-prem AD account (or cloud-only Entra ID account) with proper OU placement and group membership. [src2]

- Define OU mapping rules: `department` + `location` -> target OU (e.g., `OU=Engineering,OU=US,DC=corp,DC=example,DC=com`)
- Configure group assignment rules: `jobCode` -> AD security groups (e.g., job code `ENG-SRE` -> groups `SG-VPN-Access`, `SG-AWS-ReadOnly`, `SG-PagerDuty`)
- Set UPN and email generation rules: `{firstName}.{lastName}@corp.example.com` with collision handling (append number)
- Enable writeback if using Entra hybrid (on-prem AD + cloud sync)

**Verify**: `Get-ADUser -Identity "newuser" -Properties memberOf | Select-Object Name, memberOf` -> user exists with correct groups.

### 3. Configure SCIM Provisioning to SaaS Applications

For each downstream SaaS app (Slack, Zoom, Google Workspace, Jira, etc.), configure SCIM push from the IdP. [src1, src3]

- In the IdP, add each application and enable SCIM provisioning
- Map user attributes: `displayName`, `email`, `department`, `title`
- Configure deactivation behavior: what happens when `active` is set to `false` (suspend vs. delete)
- Set provisioning priority: identity-critical apps first (email, Slack), then productivity (Jira, Confluence), then specialized tools

**Verify**: Create a test user in IdP -> confirm account appears in each downstream app within 5-15 minutes.

### 4. Configure ERP Role Assignment

ERP roles require more complex mapping than SaaS apps because of segregation of duties requirements. [src5]

- Define job-code-to-role mapping table (maintain in IdP or iPaaS):

| Job Code | ERP System | ERP Role | Approval Required | SoD Conflict Check |
|---|---|---|---|---|
| FIN-AP | SAP S/4HANA | SAP_FI_AP_CLERK | Yes (manager + finance controller) | Yes (cannot have AP + AR) |
| SALES-REP | Salesforce | Standard User + Custom Permission Set | Yes (manager) | No |
| ENG-SRE | AWS | ReadOnly + specific IAM policies | Yes (team lead) | No |

- For SAP: Use Business Role assignment via Identity Authentication Service (IAS) or manual assignment via approval workflow
- For Salesforce: Use IdP group-to-profile mapping + permission set assignment via SCIM
- For D365: Use Entra ID group-to-D365 security role mapping

**Verify**: New hire can log into ERP with correct role within 24h of start date (accounting for approval workflow time).

### 5. Configure Equipment and Workspace Requests

Trigger ServiceNow catalog item requests automatically when a hire event is processed. [src4]

```javascript
// ServiceNow REST API — create catalog item request for new hire equipment
// Input:  Employee record from HRIS (name, department, location, start date)
// Output: ServiceNow RITM (request item) number

const createEquipmentRequest = async (employee) => {
  const payload = {
    sysparm_quantity: 1,
    variables: {
      employee_name: employee.displayName,
      employee_email: employee.email,
      department: employee.department,
      location: employee.location,
      start_date: employee.startDate,
      laptop_model: getLaptopModel(employee.jobCode), // e.g., "MacBook Pro 14" for Engineering
      peripherals: getPeripherals(employee.jobCode)   // e.g., monitor, keyboard, mouse
    }
  };

  const response = await fetch(
    `https://${instance}.service-now.com/api/sn_sc/servicecatalog/items/${catalogItemSysId}/order_now`,
    {
      method: 'POST',
      headers: {
        'Authorization': `Bearer ${token}`,
        'Content-Type': 'application/json'
      },
      body: JSON.stringify(payload)
    }
  );
  return response.json(); // { request_number: "RITM0012345" }
};
```

**Verify**: Check ServiceNow for RITM creation -> `GET /api/now/table/sc_req_item?sysparm_query=request.requested_for.email={email}`

### 6. Configure Welcome Email and Day-1 Communications

The final step sends the new hire a welcome email with their credentials, first-day instructions, and links to self-service portals.

- Trigger email from iPaaS or IdP workflow after all provisioning steps complete
- Include: temporary password or SSO enrollment link, VPN setup instructions, Slack channel to join, manager introduction, IT support contact
- Do NOT include credentials in plain text -- use a one-time secure link (Okta activation email or Entra self-service password reset)

**Verify**: Confirm welcome email delivery in email logs; verify all linked URLs resolve.

## Data Mapping

### Field Mapping Reference

| Source Field (HRIS) | Target Field (IdP) | Target Field (AD) | Target Field (ERP) | Transform | Gotcha |
|---|---|---|---|---|---|
| workerID / personIdExternal | employeeNumber | employeeID | Personnel Number | Direct | Workday uses `WID` internally; export uses `Employee_ID` |
| legalName.firstName | firstName | givenName | FIRST_NAME | Direct | SuccessFactors may return preferred name, not legal name |
| legalName.lastName | lastName | sn | LAST_NAME | Direct | Handle apostrophes and hyphens in AD sAMAccountName |
| email (work) | email | mail | EMAIL | Direct or generate | HRIS may not have work email for pre-hires; generate from name |
| supervisorID | managerId | manager (DN) | Manager | Lookup (ID -> DN) | Manager must exist in AD before new hire; order matters |
| departmentName | department | department | Department / Cost Center | Mapping table | HRIS department names rarely match ERP department codes |
| jobTitle | title | title | Job Code / Position | Mapping table | Free-text in HRIS; must map to structured codes in ERP |
| locationCode | office | physicalDeliveryOfficeName | Plant / Company Code | Mapping table | Location codes differ across every system |
| startDate | startDate | accountExpires (inverse) | Valid From | Date format | Workday: ISO 8601; SAP: YYYYMMDD; AD: Windows FILETIME |

### Data Type Gotchas

- Workday exposes dates as ISO 8601 (`2026-03-15`), but the Effective_Date on a hire event may differ from the Hire_Date -- always use Hire_Date for provisioning timing. [src7]
- SuccessFactors Employee Central stores `personIdExternal` as string, but some downstream systems expect numeric employee IDs. Validate format before mapping. [src5]
- Manager references create ordering dependencies -- if a batch of new hires includes someone who is another new hire's manager, the manager must be provisioned first. Most IdP connectors do not handle this automatically. [src2]
- AD sAMAccountName has a 20-character limit and cannot contain special characters. Generate from first initial + last name with collision counter. [src2]

## Error Handling & Failure Points

### Common Error Codes

| Code | Meaning | System | Cause | Resolution |
|---|---|---|---|---|
| 409 Conflict | User already exists | SCIM endpoint | Duplicate provisioning run or rehire | Check for existing deactivated user; reactivate instead of create |
| 400 uniqueness | Username collision | AD / SCIM | Generated username already taken | Implement collision counter: jsmith -> jsmith2 -> jsmith3 |
| 403 Forbidden | Insufficient permissions | Workday API | ISU missing security group assignment | Add ISU to required domain security policies |
| 404 Not Found | Referenced object missing | SCIM / ERP | Manager or department not yet provisioned | Implement dependency ordering; retry with backoff |
| 429 Too Many Requests | Rate limit exceeded | Okta / Entra | Bulk provisioning during peak | Implement rate limiting with exponential backoff |
| SCIM 500 | Internal server error | Downstream app | App-side issue (maintenance, bug) | Retry 3x; route to dead letter queue for manual processing |

[src1, src3]

### Failure Points in Production

- **Pre-hire race condition**: Workday publishes the hire event but the manager hasn't been synced yet. The IdP creates the user but cannot set the manager reference, leaving the org chart broken. Fix: `Implement a two-pass sync -- first pass creates all users, second pass sets manager references. Or configure manager as a deferred attribute.` [src7]
- **Rehire identity conflict**: An employee leaves and returns within 12 months. The HRIS creates a new worker record, but the old AD account still exists (disabled). SCIM provisioning fails with 409 Conflict. Fix: `Implement rehire detection logic: match on email or employee ID, reactivate existing account, update attributes from new hire record.` [src1]
- **SoD approval bottleneck**: ERP role assignment requires manager + compliance approval. If approvers don't act within 48 hours, the new hire starts work without ERP access. Fix: `Set escalation timers: 24h reminder, 48h escalation to approver's manager, 72h auto-approve for non-critical roles with audit flag.` [src4]
- **Equipment ordering failure on day 1**: ServiceNow catalog request created but procurement SLA is 5-7 business days. New hire arrives with no laptop. Fix: `Trigger equipment request at pre-hire stage (7-14 days before start date), not on start date. Maintain a pool of pre-configured loaner laptops.` [src4]
- **Silent SCIM token expiration**: SCIM bearer token expires after 365 days; provisioning silently stops for that app. No alerts because the IdP logs it as a non-critical warning. Fix: `Set a recurring calendar/PagerDuty reminder 30 days before each SCIM token expiration. Monitor provisioning success rates with weekly automated checks.` [src3]
- **SuccessFactors data lag**: Employee Central replication to the OData API can lag 15-60 minutes. The provisioning service polls before data is available and skips the new hire. Fix: `Configure retry with 30-minute delay after initial 404 from SF API. Use incremental sync with lastModifiedDateTime filter.` [src5]

## Anti-Patterns

### Wrong: Manual IT ticket per new hire

```
# BAD -- HR emails IT with a spreadsheet of new hires
# IT manually creates accounts in each system
# Average time: 5-8 hours per employee across all systems
# Error rate: 15-25% (wrong groups, missing apps, typos in names)
```

### Correct: Event-driven provisioning from HRIS

```
# GOOD -- Hire event in HRIS triggers automated pipeline
# IdP receives event, provisions all downstream systems
# Average time: 5-15 minutes (automated) + approval wait time
# Error rate: <2% (validated mappings, automated collision handling)
```

### Wrong: Provisioning all systems simultaneously without dependency ordering

```python
# BAD -- race condition: ERP role assignment before AD account exists
async def provision_all(employee):
    await asyncio.gather(
        create_ad_account(employee),      # Takes 30s
        create_erp_role(employee),         # Fails: AD account not ready
        create_slack_account(employee),    # Fails: email not active yet
        order_equipment(employee)          # Works (no dependencies)
    )
```

### Correct: Staged provisioning with dependency graph

```python
# GOOD -- respect dependency ordering
async def provision_staged(employee):
    # Stage 1: Identity foundation (no dependencies)
    ad_account = await create_ad_account(employee)
    await wait_for_ad_replication(ad_account, timeout=120)

    # Stage 2: Depends on AD account (can run in parallel)
    await asyncio.gather(
        create_email_account(employee),     # Needs AD account
        assign_ad_groups(employee),          # Needs AD account
        create_slack_account(employee),      # Needs email
    )

    # Stage 3: Depends on AD groups + approval
    await request_erp_role_with_approval(employee)  # Needs AD groups for SoD check

    # Stage 4: Independent (can run at pre-hire stage)
    await order_equipment(employee)
    await send_welcome_email(employee)
```

### Wrong: Hardcoding job-code-to-role mappings in integration logic

```javascript
// BAD -- mapping changes require code deployment
function getERPRole(jobCode) {
  if (jobCode === 'FIN-AP') return 'SAP_FI_AP_CLERK';
  if (jobCode === 'SALES-REP') return 'SF_STANDARD_USER';
  // 200 more if/else statements...
}
```

### Correct: External mapping table maintained by business

```javascript
// GOOD -- mapping table in database/config, maintained by HR/IT ops
async function getERPRole(jobCode) {
  const mapping = await db.query(
    'SELECT erp_system, erp_role, approval_required, sod_check ' +
    'FROM job_role_mappings WHERE job_code = ? AND active = true',
    [jobCode]
  );
  if (!mapping.length) {
    await createManualReviewTicket(jobCode); // Unknown job code
    return null;
  }
  return mapping;
}
```

## Common Pitfalls

- **Not testing with the full HRIS-to-ERP chain in sandbox**: Teams test each integration hop in isolation (HRIS-to-IdP, IdP-to-AD, AD-to-ERP) but never run the full chain end-to-end. An attribute that maps correctly between two systems can fail at hop three. Fix: `Build a complete sandbox chain and run 10+ test hires (including edge cases: rehires, transfers, same-name employees) before go-live.` [src1]
- **Ignoring the offboarding reverse flow**: Teams automate onboarding but leave offboarding as manual. When the HRIS termination event fires, nothing happens downstream. Fix: `Design onboarding and offboarding as a single lifecycle. Every provisioning action must have a corresponding deprovisioning action. Test both simultaneously.` [src6]
- **Relying on scheduled sync instead of near-real-time**: Using a nightly batch sync from HRIS to IdP. New hires who start mid-cycle don't get access until the next sync. Fix: `Configure event-driven or frequent polling (5-15 minute intervals) for hire/termination events. Batch sync is fine for attribute updates (title changes, department moves).` [src7]
- **No monitoring or alerting on provisioning failures**: SCIM provisioning silently fails for specific apps; nobody notices until the new hire reports it on day 1. Fix: `Implement provisioning success monitoring: dashboard showing per-app success/failure rates, alert on >5% failure rate, weekly reconciliation report comparing HRIS headcount to downstream system user counts.` [src1]
- **Over-provisioning with broad role assignments**: Assigning new hires to broad AD groups (e.g., `All-Employees`) that grant access to everything. Fix: `Implement least-privilege role mapping. Map job codes to specific, narrow groups. Require access reviews at 30/60/90 days for any temporary elevated access granted during onboarding.` [src6]
- **Not handling contractor and contingent worker differences**: Using the same onboarding flow for full-time employees and contractors, even though contractors need different license types, limited access, and expiration dates. Fix: `Maintain separate provisioning templates for FTE vs. contractor. Contractors should have account expiration dates tied to contract end date. Different SCIM group assignments.` [src2]

## Diagnostic Commands

```bash
# Check Okta provisioning status for a user
curl -s -H "Authorization: SSWS ${OKTA_API_TOKEN}" \
  "https://${OKTA_DOMAIN}/api/v1/apps/${APP_ID}/users?filter=profile.email+eq+%22newuser@example.com%22" | jq .

# Check Entra ID provisioning logs
az ad audit-log provisioning list \
  --filter "targetIdentity/identityType eq 'user' and targetIdentity/displayName eq 'New User'" \
  --top 10

# Verify AD account creation and group membership (PowerShell)
# Get-ADUser -Identity "newuser" -Properties memberOf,department,title | Format-List

# Check ServiceNow RITM status for equipment order
curl -s -H "Authorization: Bearer ${SN_TOKEN}" \
  "https://${SN_INSTANCE}.service-now.com/api/now/table/sc_req_item?sysparm_query=request.requested_for.email=newuser@example.com" | jq '.result[] | {number, state, short_description}'

# Check SCIM provisioning log in Okta
curl -s -H "Authorization: SSWS ${OKTA_API_TOKEN}" \
  "https://${OKTA_DOMAIN}/api/v1/apps/${APP_ID}/users/${USER_ID}/lifecycle" | jq .

# Reconciliation check -- compare headcount across systems
echo "HRIS headcount: $(curl -s ${HRIS_API}/workers?active=true | jq '.total')"
echo "IdP user count: $(curl -s -H 'Authorization: SSWS ${OKTA_API_TOKEN}' '${OKTA_DOMAIN}/api/v1/users?filter=status+eq+%22ACTIVE%22&limit=1' -I | grep x-rate-limit-remaining)"
echo "AD user count (active): requires Get-ADUser -Filter {Enabled -eq $true} | Measure-Object"
```

## Version History & Compatibility

| Component | Version | Status | Notable Changes |
|---|---|---|---|
| SCIM 2.0 (RFC 7643/7644) | 2.0 | Current standard | Stable since 2015; enterprise extension schema widely adopted |
| Okta Identity Engine | OIE 2024+ | Current | Replaced Classic Engine; lifecycle hooks API changed |
| Microsoft Entra provisioning | 2024+ | Current | Formerly Azure AD; API endpoints unchanged |
| Workday RaaS | 2024R2+ | Current | Added real-time SCIM connector (limited GA) |
| SuccessFactors EC | 2H 2024+ | Current | Improved OData v4 support for provisioning |
| ServiceNow EOT | Vancouver+ | Current | Enhanced lifecycle event APIs |

### Deprecation Policy

SCIM 2.0 is an IETF standard and is not subject to vendor deprecation -- it is the stable foundation for this entire pattern. However, vendor-specific connector versions (Okta-Workday, Entra-SF) follow their own release cycles. Okta deprecates Classic Engine features with 12-month notice. Microsoft Entra provides 24-month deprecation notice for provisioning connectors. [src1, src2]

## When to Use / When Not to Use

| Use When | Don't Use When | Use Instead |
|---|---|---|
| 200+ employees with 10+ hires/month | <50 employees with <5 hires/month | Manual checklist with IT ticket |
| Using cloud HRIS (Workday, SF, BambooHR) + cloud IdP (Okta, Entra) | On-premise HRIS with no API access | MIM/FIM for on-prem identity sync |
| Multiple SaaS apps + ERP systems to provision | Single ERP system with built-in onboarding | Use the ERP's native onboarding module |
| Regulatory requirements for audit trail (SOX, SOC 2, GDPR) | No compliance requirements | Simpler scripted approach may suffice |
| Multinational with regional provisioning differences | Single office, single region | Simplified single-policy provisioning |

## Cross-System Comparison

| Capability | Okta + Workday | Entra ID + SuccessFactors | Google Workspace + BambooHR | Notes |
|---|---|---|---|---|
| HRIS-to-IdP connector | Native (HR-as-master) | Native (Entra provisioning service) | Via iPaaS (Workato, Tray) | Okta and Entra have the deepest HRIS connectors |
| SCIM app catalog | 7,000+ apps | 5,000+ apps (Entra gallery) | Limited native SCIM | Okta has the largest SCIM catalog |
| Pre-hire provisioning | Yes (Pre-Hire Interval) | Yes (future-dated sync) | Depends on iPaaS config | Critical for day-1 readiness |
| ERP role provisioning | Via Okta groups or Workflows | Via Entra groups or Access Packages | Manual or iPaaS | Entra Access Packages best for complex role governance |
| Equipment ordering | Via Okta Workflows + ServiceNow | Via Logic Apps + ServiceNow | Via iPaaS + ServiceNow | All require ServiceNow or equivalent ITSM |
| Offboarding automation | Native (deactivate propagates) | Native (disable propagates) | iPaaS-dependent | Okta and Entra equally strong |
| Governance / access reviews | Okta Identity Governance (add-on) | Entra Access Reviews (P2) | Third-party (ConductorOne, etc.) | Entra P2 most cost-effective for Microsoft shops |
| Cost (IdP component) | $$$ (Okta WIC pricing) | $$ (included in M365 E5 or P1/P2 add-on) | $ (free tier available) | Google cheapest but least capable for enterprise |

## Important Caveats

- This playbook covers cloud-to-cloud integrations. On-premise HRIS (SAP HCM on-prem, PeopleSoft) requires different tooling (MIM, Entra Connect, or iPaaS with on-prem agents). The patterns are similar but the implementation differs significantly.
- SCIM 2.0 compliance varies widely across SaaS vendors. Some apps claim SCIM support but only implement a subset (e.g., no group provisioning, no deactivation). Always test each app's actual SCIM behavior, not just their marketing claims. [src3]
- Provisioning timing is not instantaneous. Even "real-time" SCIM provisioning can take 5-40 minutes depending on the IdP's sync cycle and the downstream app's SCIM implementation. Plan for this in your day-1 experience design.
- SOX, HIPAA, and GDPR compliance requirements may prevent fully automated provisioning for certain system access. Always confirm with your compliance team which systems require human approval gates.
- Rate limits on bulk provisioning (e.g., annual hiring events, M&A user migrations) may require special handling. Contact your IdP vendor for temporary rate limit increases during large-scale events.

## Related Units

- [Workday REST API Capabilities](/business/erp-integration/workday-rest-api/2026)
- [SAP SuccessFactors API Capabilities](/business/erp-integration/sap-successfactors-api/2026)
- [Identity Lifecycle Management Patterns](/business/erp-integration/identity-lifecycle-management/2026)