Provision staff automatically
Create mailboxes, aliases and group membership from your HR system, and remove them the day someone leaves.
soon
This flow needs Workspace administration and Directory. Those are not wired into the API yet, so the walkthrough below is the plan rather than something you can run today. Mail and calendar are live now.
Why anyone does this
Joiners, movers and leavers are the same three events in every company, and doing them by hand is how somebody keeps their mailbox for a month after they left.
What a key needs
Grant these and nothing else. A key can never do more than the person who created it, and one that carries only what the job needs is one you can leave running.
The flow
-
Read the roster from your HR system
Whatever already knows who works here is the source of truth. This flow does not replace it.
-
Create the mailbox
One call per joiner, with the aliases and group membership their role implies.
-
Reconcile rather than replay
Compare the roster against the directory on each run, so a missed run is caught by the next one instead of being lost.
-
Withdraw access on the leave date
The same flow in reverse, driven by the same source, so the day somebody leaves is the day their access does.
What catches people out
Every one of these came from somebody getting it wrong.
- Reconcile, never replay. A queue of events you have to process exactly once is a queue that will eventually be processed twice.
- Admin scopes are held only by an administrator, and a key can never carry more than the person who created it.