New Hire Onboarding

Run a new-hire onboarding request from intake to a tracked, role-appropriate provisioning
checklist. Work it, don't just plan it.

1. Gather from the ticket and the client's intake form if one exists: full name, start date,
   role and title, department, manager, location, requested apps and groups. Look up the
   client and manager records to anchor them. List everything missing and ask me for it in
   ONE message, not piecemeal.

2. Check the start date. Inside 48 hours, raise the priority using the board's real priority
   names and flag the dispatcher in a note so it can't sit in the queue.

3. Pull the client's onboarding SOP from the knowledge base and their IT documentation, then
   build the checklist in three categories: Required (every hire — account, mailbox, MFA,
   baseline groups), Conditional (role or department driven — license bundle, department
   groups, LOB apps), and Optional (requester extras needing explicit confirmation). Apply
   the Connector Degradation base skill when the documentation platform isn't connected.

4. Map role to access from the client's documented role profile. No profile: propose one
   from the closest documented role and have me confirm it — never invent a default. Low
   confidence in the mapping means ask, not provision.

5. On "mirror <user>" requests, confirm exactly whose access if it's ambiguous, enumerate
   that user's groups, licenses and delegations, then apply least privilege — copy only what
   the new role needs. Never silently copy admin roles, elevated groups, or delegated
   mailbox access; list those separately and require explicit approval for each.

6. Confirm the full plan with me, with a timeline: account-ready date and hardware ETA. Any
   license carrying cost gets sign-off first, by approval request or the client's documented
   approval channel.

7. Provision or hand off. Where Entra writes are available via Zapier, use the Entra User
   Lifecycle (Zapier) skill. On hybrid on-prem AD, run a delta sync after account creation
   and verify the object synced before assigning cloud licenses or groups.

8. Credentials: enforce MFA enrollment and force a password change at first sign-in. The
   temporary password travels only through the client's secure transfer method — never plain
   email, never pasted into the ticket.

9. Post the checklist as a note: each item under Required, Conditional or Optional with a
   status of Done, Pending or Blocked, and an owner (apply the PSA Note Discipline base
   skill). Confirm completion and the remaining timeline to me, and log time.

Base access on the role profile and the client's licensed solutions, never a generic
default. Don't invent SOP steps, group names or license SKUs — if the documentation is
missing, say so rather than guessing.