Everything Ready on Day One: Onboarding and Offboarding as an Automated Workflow

Weeks often pass between signing the contract and the first working day. Even so, the laptop, CRM access or simply a plan for the first week is surprisingly often missing on day one. The reason is rarely carelessness. Usually the process consists of emails, a spreadsheet and reminders in the heads of individual people.

At the other end of the employment relationship, the same pattern is riskier. People who leave sometimes keep access that should have ended long ago.

The starting point

According to Gallup, only 12 % of employeesU strongly agree that their company does a great job of onboarding. The figure comes from US surveys in 2018. We are not aware of a comparable survey for Germany. Employees who had an exceptional onboarding experience are, according to Gallup, 2.6 times as likelyU to be extremely satisfied with their workplace.

On the way out, the issue is security. In Bitkom's Wirtschaftsschutz 2026 survey, affected companies named intentionally acting current or former employees in 19 %U and unintentionally acting ones in 23 %U of cases as perpetrators of data theft, espionage or sabotage. The category does not distinguish between current and former staff. But it shows how much depends on access.

The workflow

The core idea: the HR system is the single source. As soon as someone is marked as hired there, it triggers everything else. Nobody types name, role or start date a second time.

What runs automatically and what does not

• Accounts, groups, licences: They are created from role templates. Microsoft Entra ID Governance includes Lifecycle Workflows for this, according to Microsoft with 31 built-in tasksH, from the welcome email to removing all licences. The licence costs 7 USD per person a monthP and requires Entra ID P1 or P2. Okta and Google Workspace offer comparable workflows.
• HR system as the trigger: According to its own help pages, Personio syncs one way with Entra ID and revokes access as soon as the status switches to inactive. The account is not deleted. You have to define that step yourself.
• Hardware: The order runs as a ticket with a delivery date before the first working day.
• Onboarding plan: This is where generative AI pays off. It drafts a plan from the role template and team wiki, and the team lead reviews it. Everything else in the workflow is fixed rules.

Create an onboarding plan for the first ten working days. Role: [role]. Team: [team]. Use only the attached role template and the pages from the team wiki. Structure it by day: meetings with people, access that must work by then, and one small real task per day. Mark everything missing from the documents as "OPEN". Do not invent names or dates.

The written statement of terms may be digital

In Germany, since 1 January 2025 the Evidence Act (Nachweisgesetz) allows text form, for example an email with a PDF. Three conditions apply: the document must be accessible, storable and printable, and the employer must request proof of receipt when sending it. On request, the employee receives a signed paper copy.

The deadlines remain staggered. Name, address, pay and working hours must be provided on the first working day at the latest. Start date, place of work, duties and probation period follow by the seventh calendar day, the rest within one month. Violations cost up to 2,000 EURR.

Text form is not permitted in sectors covered by Section 2a of the Act to Combat Undeclared Work, such as construction, hospitality, building cleaning, logistics and the meat industry. For the automation, this means: the workflow sends the statement and tracks the confirmation of receipt. If it is missing after three days, HR gets a reminder.

Offboarding: the same workflow in reverse

The trigger is the leaving date in the HR system. A few days beforehand, the workflow reminds the manager about handover and data transfer. On the last day, it blocks sign-in, ends active sessions and removes licences. Then come the hardware return and the transfer of files to the team.

The BSI's IT-Grundschutz, the German baseline for information security, requires exactly this in module ORP.2: a defined procedure for departures, including return of devices, keys and badges, removal of all access and informing IT and security. The biggest gap is usually software that is not connected to the central directory. It needs a list with named owners.

Data protection and the works council

• Legal basis: Since the CJEU ruling of 30 March 2023 (C-34/21), Section 26(1) of the German Federal Data Protection Act is considered largely inapplicable. For the data needed in onboarding, employers rely on performance of the contract under Art. 6(1)(b) GDPR.
• Test systems count too: In 2025, Germany's Federal Labour Court awarded an employee 200 EUR in damages. His employer had transferred more personnel data to a Workday test environment than the works agreement allowed.
• Co-determination: Automatically logging accounts and access means operating a technical device within the meaning of Section 87(1) No. 6 of the Works Constitution Act. According to the Federal Labour Court, objective suitability for monitoring is enough. Plan for a works agreement.

Limits and risks

• Errors in the template: A wrong role template hands wrong rights to everyone in that role. Version the templates and grant special rights only with a second approval.
• Systems without an interface: They stay manual. Each one needs an owner and an item on the checklist.
• Deletion is a separate step: Blocked accounts are not deleted. Set deadlines for mailbox, files and account.
• Where the numbers come from: The Gallup figures are from the USA, and the Bitkom category mixes current and former employees. The product features are vendor claims.

How to start

1. List all software in which new people need an account, and mark which are connected to the central directory.
2. Define three to five role templates with groups and licences.
3. Connect the HR system and directory and test the workflow with a test profile.
4. Build the offboarding workflow first. It reduces the biggest risk.
5. Measure two values: the share of new hires with complete access on day one and the time to block access after someone leaves.

Sources

1. UGallup: Why the Onboarding Experience Is Key for Retention
2. UGallup: 8 Practical Tips for Leaders for a Better Onboarding Process
3. UBitkom: Wirtschaftsschutz 2026 (economic protection survey)
4. RGerman Evidence Act (Nachweisgesetz), Section 2
5. RGerman Evidence Act (Nachweisgesetz), Section 4
6. RCMS: Bureaucracy relief vs. employers' documentation duties
7. RBSI IT-Grundschutz: Module ORP.2 Personnel
8. HMicrosoft Learn: Lifecycle Workflows
9. PMicrosoft Entra: Pricing
10. HPersonio: Synchronisation with Microsoft Entra ID
11. RFederal Labour Court, 8 AZR 209/21: Damages over a Workday test system
12. RFederal Labour Court, 1 ABR 20/21: Co-determination for Microsoft 365