Jira onboarding automation can streamline these tasks and make sure employees are onboarded quickly and properly. At the other end of the lifecycle, offboarding automation can make sure employees don’t retain access to critical systems after they leave.
In this article, we’ll look at what employee lifecycle management looks like in JSM without automation. Then we’ll explore the parts of the process that can (and should) be automated, and how you can go about it.
Managing the employee lifecycle manually in Jira Service Management
For most companies, employee lifecycle management—particularly onboarding and offboarding—is a nightmare of tickets, checklists, and endless back-and-forth between HR, IT, management, and compliance.
This is what a Jira employee onboarding workflow typically looks like:
- HR creates a ticket in Jira Service Management for a new hire. This includes the employee’s name and details, and information about their new role such as job title, department, and line manager.
- The IT team receives this ticket and has to enter the information into the company’s identity provider, such as Okta or Azure Active Directory, to create a new user. Then, if required, they will add the new employee to a user group.
- IT adds the new employee to all the individual applications and systems they should have access to on their start date.
Without Jira onboarding automation, these steps are manual and admin-heavy and it takes a lot longer to get employees fully integrated. If the IT team is busy, HR has to wait for the new hire to be added to the identity provider, putting the ability of the employee to start work on their start date in jeopardy. IT can also miss things or make mistakes. They might assign the employee to the wrong department or user group, misspell their name, or assign them access to the wrong apps.
Then there are ad hoc application access requests that come after an employee has been onboarded. For example, an employee may embark on a new project requiring access to an particular application that they haven’t needed to use yet. And so they create a ticket in Jira Service Management, and the IT team undertakes a typically manual process to get access approved and provisioned.
When it comes to offboarding, the process is similarly inefficient. HR submits an offboarding ticket and IT has to remember to deactivate the user from the identity provider on the termination date. Then they have to manually deprovision their access from all the assigned apps. This is time-consuming and prone to error, with ex-employees sometimes retaining access to critical systems.
Another part of employee lifecycle management is conducting user access reviews during the period of employment, in order to prevent privilege creep. Privilege creep is when an employee changes role and receives new permissions without their old ones being revoked. The longer they stay with the company, the more systems they get access to, increasing the attack surface that cybercriminals can target.
But manual access review processes are even more arduous. They involve compiling and maintaining complex spreadsheets of a company’s users and their access privileges, which have to be sent back and forth between managers and IT, who then have to manually deprovision users who no longer need access, before manually pulling data from the spreadsheet to compile audit reports. Yep, that was exhausting to read! Now imagine actually doing it.
To save the IT team time and rigmarole and reduce the risk of security breaches, let’s look at how we can automate some of these processes.
How to leverage employee lifecycle automation
Jira Service Management is IT service management (ITSM) software, not employee lifecycle management software. However, because so much of employee lifecycle management is handed by the IT team, centralizing it in JSM is sensible, rather than adding a whole extra tool to the mix.
Well, it’s sensible if JSM is capable of employee lifecycle automation. Onboarding automation is likely to be top of the agenda, but companies are eager to automate the repetitive steps involved in provisioning ad hoc access, conducting access reviews, and offboarding employees as well.
The problem is, JSM’s native capabilities are limited. Jira automation can’t create new user accounts in an identity provider. Nor can it deactivate a user when they leave.
You can use Jira automation to automate an approval workflow for user access reviews, but it can’t help with the rest of the access review process, e.g. generating lists of users, deprovisioning access, or compiling reports. You can also automate some of the access request management process, like assigning requests to approvers, and alerting IT agents when approval has been granted. But again, automation rules can’t help with user provisioning.
Activating and deactivating users, and provisioning and deprovisioning access to external apps, are the things IT teams really want to be automated. But these are the things Jira Service Management can’t do out of the box.
Your identity provider may offer a way to automate the creation of a user account from a Jira request. Okta, for example, offers an onboarding automation add-on called Okta Workflows. However, its configurability is limited and it can’t handle complex approval workflows well. It’s also a premium add-on that requires additional licensing costs beyond the base Okta subscription.
This means it’s time to look to the Atlassian Marketplace for apps that can help with Jira onboarding and offboarding automation.
Jira onboarding automation with JSM and Multiplier
Instead of trying to automate Jira employee onboarding and offboarding from within your identity provider, you can do it from within Jira Service Management. Multiplier is an Atlassian Marketplace add-on built especially for JSM, which automates employee lifecycle workflows in Jira. It does this in a series of ways, which we’ll look at now.
Jira onboarding automation
After your HR team creates a ticket in JSM for a new hire, instead of copying and pasting the employee’s data into your identity provider, Multiplier can trigger account creation automatically using a trigger action post function. Simply select the issue create transition, add the trigger action post function, and select Create user without credentials. Then map the required fields needed to create the user, such as their name, email, and department.
This can be combined with other actions, such as adding the newly created user to a group that has already been granted access to a pre-approved list of applications.
Multiplier saves a lot of manual data entry and makes sure new employees have access to the systems they need without delay.
Our documentation has more detail on how to automate the employee onboarding process in Jira.
Automated access request management and automated user provisioning
After onboarding, when employees request access to additional tools, Multiplier can automate all the repetitive administrative steps in the access request management process.
Multiplier connects to your identity provider, enabling you to set up a self-service internal app store. After a JSM request is made, Multiplier will automatically validate it, route the ticket to the correct approver, and provision access post-approval.
Our documentation has more detail on how to automate access request management in Jira Service Management.
You can also read our recent article on whether an ITSM platform like JSM makes a suitable access request management tool.
Automated user access reviews and deprovisioning
Multiplier can automate virtually all of the manual tasks involved in conducting user access reviews, dramatically improving efficiency and security. It removes spreadsheets from the equation by generating up-to-date lists of users and access information. Then it sends lists of users to reviewers, flags unusual activity, deprovisions users who no longer need access, and generates audit-ready reports for compliance.
Our documentation has more detail on how to use Multiplier to automate user access reviews and deprovisioning.
You can also read our recent article on how automating user access reviews can cut down review time by up to 90%.
Jira offboarding automation
Multiplier handles Jira offboarding automation in much the same way as it handles onboarding automation. After creating a JSM request type for offboarding an employee, select an appropriate workflow transition where you want the deprovisioning to occur. This is usually issue creation or after an approval step.
Then you add the trigger action post function and, this time, select Deactivate user. Map the necessary fields from your JSM request to your identity provider, and voila, your employee will be automatically deprovisioned.
Our documentation has more detail on how to automate employee offboarding in JSM.
Conclusion
As you can see, automated user provisioning and deprovisioning is a key requirement when we’re talking about employee lifecycle automation in Jira Service Management. It’s the thing everyone needs, and the thing Jira automation rules can’t help with.
Your identity provider may have their own automation feature or add-on, but as with Okta Workflows, these are often costly and limited in configurability.
Multiplier is an affordable and easy-to-use alternative that centralizes employee lifecycle management in the tool IT teams are already using day to day: the ITSM tool. By automating the repetitive steps in your JSM workflows—especially provisioning and deprovisioning—Multiplier makes employee lifecycle management faster, more secure, and more scalable. And, most importantly, it improves the onboarding and offboarding experience for everyone involved.
See the difference you can make with Jira onboarding automation and try Multiplier free for one month.
