title: Joiner Templates - Onboarding Automation category: Lifecycle Management tags: joiner, onboarding, new-hire, automation, templates priority: Normal

Joiner Templates - Onboarding Automation

Joiner templates define the automated provisioning workflow that executes when a new identity enters your organization. By configuring a Joiner template, you ensure that every new hire, contractor, or vendor receives the correct accounts, group memberships, and notifications on day one -- without manual IT intervention.

What Joiner Templates Do

A Joiner template is an ordered sequence of actions that provisions a new identity. When triggered, the template:

1. Creates the user's Active Directory account with standard attributes
2. Assigns the user to default security and distribution groups
3. Sets an initial password (or generates one according to policy)
4. Configures the user's mailbox or email-enabled attributes
5. Sends a welcome email to the new hire and their manager

Creating a Joiner Template

Navigate to Administration > Lifecycle Management (/admin/lifecycle) and select New Template. Choose Joiner as the template type.

Step 1: Template Details

Step 2: Trigger Configuration

Select how this Joiner template will be activated:

HR Feed trigger example: When the HR Import detects a new employee record with a start date of today or earlier and no matching AD account exists, the Joiner template fires automatically.

Step 3: Target Criteria

Define which new identities this template applies to. Criteria can include:

• Department -- Match specific departments (e.g., "Engineering", "Sales")
• Employee Type -- Full-time, part-time, contractor, vendor
• Location -- Office or region code
• Job Title Pattern -- Regex or wildcard match on title

If a new identity matches multiple Joiner templates, the template with the highest priority executes. You can also configure templates to chain, allowing a base template to run first followed by department-specific templates.

Step 4: Define Actions

Add actions in the order they should execute. Each action has its own configuration:

CreateAccount

Tip: Username collision handling is automatic. If john.smith already exists, IdentityCenter will try john.smith2, john.smith3, and so on until a unique name is found.

AssignGroups

Dynamic group assignment uses parameter templates to map attribute values to group names. For example:

Department = "Engineering"  -->  "Engineering Team", "GitHub Access", "Dev VPN"
Department = "Sales"        -->  "Sales Team", "CRM Access", "Sales VPN"
Department = "Finance"      -->  "Finance Team", "ERP Access", "Finance Reports"

SendEmail

SetInitialPassword

ConfigureMailbox

Step 5: Error Handling

Configure how the template responds to action failures:

Recommendation: Use "Stop on Error" for critical actions like CreateAccount, and "Continue on Error" for non-critical actions like SendEmail.

Parameter Templates

Parameter templates let you dynamically configure action values based on the identity's attributes. They use a simple placeholder syntax:

Integration with HR Import

When connected to an HR system, Joiner templates can fire automatically:

1. HR Import detects a new employee record (see HR Integration Overview)
2. The import record includes StartDate, Department, Title, and Manager
3. IdentityCenter evaluates all Joiner templates against the new record's attributes
4. The matching template executes, provisioning the account before the employee's first day
5. A lifecycle event is logged with full audit details

This integration ensures zero-touch onboarding for organizations with an authoritative HR source.

Example: Standard Employee Joiner Template

Template: Standard Employee Onboarding
Trigger:  HR Feed (on new hire detection)
Criteria: EmployeeType = "Full-Time"

Actions:
  1. CreateAccount
     - Connection: Corporate AD
     - OU: OU=Users,OU={Department},DC=corp,DC=local
     - Username: {FirstInitial}{LastName}
     - UPN: {FirstName}.{LastName}@corp.com

  2. AssignGroups
     - Static: "All Employees", "Company WiFi", "Building Access"
     - Dynamic: Department-based group set

  3. SetInitialPassword
     - Method: Random (20 chars)
     - Must Change: Yes

  4. ConfigureMailbox
     - Email: {FirstName}.{LastName}@corp.com

  5. SendEmail
     - Template: "Welcome - New Employee"
     - To: Manager, IT Helpdesk

Best Practices

1. Create department-specific templates rather than one monolithic template with complex conditional logic
2. Test with a preview run before enabling HR Feed triggers
3. Use unique username formats that minimize collision (e.g., {FirstName}.{LastName} over {FirstInitial}{LastName})
4. Never send plaintext passwords -- use secure links or encrypted delivery
5. Set "Must Change at First Login" for all initial passwords
6. Log all actions for compliance and troubleshooting

Next Steps

• Mover Templates -- Handle transfers and role changes
• Leaver Templates -- Automate offboarding
• Lifecycle Events -- Monitor template execution
• HR Integration Overview -- Connect your HR source for automatic triggers
• Connections Overview -- Configure the target directory connection