Published by CXJ Labs, an automation company. Not independent. Read our disclosure.
The Automation Index

Can setting up staff accounts and access be automated?

Largely automatable: 61% of task time

The answer

Largely. Creating accounts, assigning licences by role and recording who has access are well suited to automation for tools with APIs. In our model about 60% of provisioning time is automatable. Approving elevated access and setting up physical equipment still need a person, though device management can handle much of the laptop setup.

The tasks, and how much of each is automatable today

Five tasks make up provisioning. Creating accounts and recording access are about 90 to 95% automatable for tools with APIs. Assigning licences and permission groups is about 80% automatable once roles are defined. Laptop setup is about 30% automatable. Approving elevated access stays about 80% human.

TaskActivity typeMin / weekAutomatable
Create accounts in core toolsEmail, chat, CRM and project tools all support API user creation.Processing data
base rate 69%		10090%
Assign licences and permission groups by roleAutomatic once each role has a defined access list. Unusual roles need manual choices.Processing data
base rate 69%		7580%
Approve elevated or sensitive accessRouting the request is automatable. The yes or no is a security decision.Applying expertise
base rate 18%		3020%
Set up and ship laptopsDevice management enrols and configures software automatically. Ordering, imaging exceptions and shipping stay manual.Predictable physical work
base rate 81%		13530%
Record who has access to whatEach automated change is logged automatically, building the register as you go.Processing data
base rate 69%		3095%
Whole process37061%

Base rates are McKinsey Global Institute's technical automation potential for each activity type. The share for each task is our adjusted estimate. Method.

Hours saved per week

For an 80-person company with three joiners and two role changes a week, provisioning takes about 6 hours a week by hand. Automating the tasks above returns about 4 hours a week, around 190 hours a year. It also leaves a record of who has access, which helps every offboarding.

Modelled on: An 80-person company with three joiners and two internal role changes a week, using about 12 software tools.

  • Five provisioning events a week: three new starters and two role changes.
  • About eight of the 12 tools have usable APIs for user creation.
  • Three of the five events need a laptop set up.
  • Access is currently recorded in a spreadsheet, when it is recorded at all.

6 hours a week by hand, 4back with automation. Formula: the sum of each task's minutes multiplied by its automatable share, divided by 60, rounded to the nearest half hour.

Tools that do the job

You need a role definition that lists which tools and permissions each role gets, and an automation layer that calls each tool's API. n8n or Make does the calling. Google Workspace or Gmail and Slack accounts are the usual first steps. Airtable or Google Sheets holds the access register.

n8n
Calls each tool's API to create users, assign groups and log changes.
Gmail
Creates the work account that most other tools sign in with.
Slack
Creates the account, adds role channels and asks managers to approve elevated access.
Airtable
Holds the role access lists and the running access register.
HubSpot
Example of a tool where seats and permission sets are assigned by role.

A simple workflow

The workflow starts from the HR record a week before a start date or role change. It looks up the role's access list, creates accounts, assigns licences and groups, and logs each change. Elevated access waits for a manager's approval. Tools without an API become tasks for IT with a deadline.

  1. TriggerStart date or role change recorded in HR, seven days ahead.
  2. Look upFetch the role's access list: tools, permission groups and licence type.
  3. CreateCreate accounts and assign groups through each tool's API.
  4. ApproveSend elevated access requests to the manager. Grant only after approval.
  5. LogRecord every account, group and date in the access register.
  6. FallbackTools without an API become tasks for the admin with a due date before day one.

Keep these human

  • Approving access to finance, customer data and admin settings.
  • Defining the role access lists in the first place, and reviewing them every quarter.

Where it goes wrong

  • Role creep. Role changes that add access but never remove it leave people with far too much. Make role changes replace access lists, not add to them.
  • Tools outside the system. Tools bought on a company card are invisible to provisioning. Keep a list of every paid tool.
  • Shared logins. Tools on a shared password cannot be provisioned or revoked properly. Move them to individual accounts first.

What most guides miss

Most guides treat provisioning as an onboarding speed problem. Its bigger value is the access register it leaves behind. Every automated grant is logged, so offboarding becomes a lookup rather than a guess. Teams that automate provisioning but not logging lose the benefit; the register is what makes revoking access reliable.

The evidence