Author: Veli-Pekka Vähälummukka, Program Director, Trivore
Imagine this: Mikko starts a new sales role on Monday morning. HR has sent the welcome email, calendar invitations have been shared and his workstation is ready. But when Mikko opens his laptop, all he sees is a login screen. No email. No CRM. No access card to get through the door.
Which systems does Mikko actually need access to? And who knows the answer? HR, his manager, IT, or perhaps a third party responsible for one individual system among many?
For many organisations, this scenario is all too familiar.
The current reality: an endless chain of access requests
When a new employee joins, they do not need access to just one system. They may need dozens. Email, ERP, CRM, payroll, physical access control, document management and industry-specific systems. The list goes on, and every item may require a separate access request.
In the worst case, those requests are not even sent to a single team. Some systems may be outsourced to different providers, leaving HR or the employee’s manager to contact several parties and wait for each provider to process the request at its own pace.
The result is familiar. Mikko spends his first week waiting for access to the tools he needs to do his job, his manager sends reminders, and IT pieces everything together manually. Every manual step also introduces another opportunity for error. An access right may be forgotten entirely, granted too slowly or, at worst, assigned too broadly ‘just in case’.
Why does this happen?
It is not because organisations are careless. It happens because information about an employee’s role and information about access rights live in separate systems that do not communicate with each other. HR knows what role Mikko has been hired for. IT knows which systems the organisation uses. But nothing automatically connects those two pieces of information.
As long as that connection is made manually, every new employee has to go through the same process, no matter how many times the organisation has done it before.
Imagine a different approach: one piece of information is enough
What if HR did not need to know about any of the individual systems at all, only Mikko’s role?
In this model, the HR system tells the identity and access management (IAM) system one thing: Mikko is starting in a sales role, in a particular business unit, on a particular date. From there, an IAM platform such as Trivore eIAM knows what that role requires, which systems Mikko should be given access to, which permission levels belong to the role and which physical access rights he needs for the workplace. One piece of information triggers everything that previously required dozens of separate requests.
There is, of course, some groundwork to do first: roles and their associated access rights need to be defined once. In the Trivore eIAM administration interface, this can be done without coding, and the same definitions can then be used for every new employee who follows. Access rights are provisioned to target systems through ready-made connectors and standard interfaces, even when an external provider operates the system.
In practice, Mikko sees the difference on his very first day. He can log in immediately, his access card works at the door, and the systems he needs are ready to use. Not a week later, but on his first morning.
The next step: no access requests at all
Moving from dozens of requests to one is already a significant improvement, but it does not have to be the end goal. Ideally, neither Mikko nor HR needs to submit or initiate a separate request.
When the HR system and Trivore eIAM are directly integrated, recording a new employment relationship in the HR system is enough. The integration automatically passes the information on, and access rights are provisioned in the background without anyone sending a single request. Because employment details are usually entered into the HR system before the employee’s start date, access rights can be prepared in advance and activated on the agreed date. The first visible sign of the entire process is simply that Mikko logs in and everything works.
Only the standard access rights associated with the role are provisioned automatically. If Mikko needs something outside his role, he can request it through a self-service portal and his manager can approve the request. Access is therefore granted according to actual need and role, rather than ‘just in case’.
The same principle works in reverse. When an employee leaves or changes role, the integration removes or adjusts their access rights just as automatically as it created them in the first place. Access does not remain active after the reason for granting it has disappeared.
What does this look like in practice?
- Healthcare:A new nurse receives access to the patient information system and shift planning as soon as HR records the start of the employment relationship. There is no need to raise a separate IT ticket for every system.
- Local government: A new building inspector receives access to permit and case management systems based on their role, while financial approval rights remain unavailable because the role does not require them.
- Public transport: A new driver receives access to the ticketing and shift planning systems when their employment begins, regardless of how many different providers operate those systems.
The same principle applies in every example: access follows the role, not a manual request.
Summary
A chain of dozens of access requests is not an inevitable part of employee onboarding. It is a sign that role information and access rights are managed separately. By connecting the two through an IAM system, a single piece of information about an employee’s role can trigger everything that needs to happen. And when the HR system and Trivore eIAM communicate directly, the best outcome is that nobody even notices the process, because nobody needs to start it manually.
From Mikko’s perspective, the difference is simple: his first working day starts with work, not waiting.
Want to see how this could work with your HR system? Explore the Trivore eIAM platform or contact us.