Automate Employee Onboarding and Offboarding Without Missing a Step

Onboarding and offboarding are two checklists that cross half the tools in a company. Someone is hired, and an account has to be made, groups set, a laptop ordered, a welcome sent, the first week booked and a contract signed. Someone leaves, and all of it has to be undone. Each step lives with a different person in a different system, and the expensive mistakes happen at the edges: a first day with no login, or a last day after which the account still works.

Lodol isn't an HR system, and you don't need to replace yours. It runs the steps around each hire and each departure, across the tools the work already passes through, and waits for a person at the steps that matter. Here's one ready-made workflow to start with, and how to build the rest of each checklist from steps that are already in Lodol.

Start with the welcome

The workflow: every Monday at 7:00, Welcome next week's new starters reads your new starter roster in Google Sheets. Anyone whose start date falls in the next seven days gets a short welcome email, and your team's Slack channel is told who's joining, in what role and on which day, so nobody arrives to a room that wasn't expecting them.

What it won't do: make anything up, or say it twice. The welcome is written from the roster, not by AI: it greets the person by first name and gives their role and start date, so there's nothing to review and nothing to get confidently wrong. Lodol remembers who it has welcomed, so nobody is emailed or announced twice, even if you run it again by hand. A hire with no email address is still announced to the team, and if a start date can't be read, the run is marked as failed and names the people affected, instead of looking like a quiet week.

Build the joiner checklist

A joiner workflow starts when a hire is confirmed and works down the list. A typical one, built in the editor:

1. Start it from the roster. The New row in a Google Sheet trigger starts a run for each new hire you add to your roster, and as of last week each row arrives with its cells named by their column headers, so later steps can read "Start date" and "Team". If your records live in BambooHR, a daily schedule can read them from there instead.
2. Create the accounts. Okta's Create user and Add user to group set up the login and the groups that come with the person's team. If a group opens up finance or customer data, put a Request approval step in front of it, so the person who owns that system says yes first.
3. Order the equipment. Raise a ticket in Freshservice or a request in Jira Service Management with the role and start date, so IT has the laptop ready before day one rather than on it.
4. Book the first week. Google Calendar's Create event puts the first-morning meeting on the calendar with the new hire and their manager as guests.
5. Send the paperwork. DocuSign and Dropbox Sign can send a document for signature from the workflow.
6. Mark them done. Write "Set up" into the roster, or keep a stored value of who has been handled, so a re-run never creates a second account. (Workflows have been able to remember things between runs since earlier this month.)

Build the leaver checklist

Offboarding is where a missed step costs the most, and where a person should confirm before anything irreversible happens. A leaver workflow that follows the same shape every time:

1. Find today's leavers. A schedule every weekday at 4:00 PM, in your own time zone, reads your leavers tab for anyone whose last day is today.
2. Ask first. A Request approval step asks the right person, in Lodol, by email or in a Slack channel: "Remove Dana Whitfield's access at 5:00 PM today, her last day?" Name who may answer, turn on Require a different approver so nobody approves their own request, and set it to escalate to someone else if there's no answer within the hour.
3. Remove access. Once approved, Okta's Deactivate user closes the account and Revoke user sessions signs the person out of Okta everywhere. Turn on its Also revoke app tokens setting too, or an app holding a refresh token keeps its access.
4. Tell IT, and close the loop. Post to your IT channel in Slack saying whose access was removed and when, raise the laptop return in Freshservice, and add a row to an offboarding log.

If the answer is no, build that path to leave the account alone and say so in the channel. The whole thing has the same shape as Handle a data erasure request, with approval, a template from the legal side of the library: find every record, show exactly what was found, act only after a person approves, and write a log entry before anything is changed and again after. It's worth reading as a model for any workflow that removes something for good.

Make failures loud

A leaver workflow that fails quietly is worse than none, because everyone assumes it ran. A few habits help:

• Let a failed step stop the run. If Okta refuses a change, the step fails and shows Okta's error, and Lodol emails you that the run failed. Wrap the Okta steps in a Try / Catch to also post the failure to your IT channel, so the person who can fix it hears first.
• Test on a test account. Every step's menu offers Run only this step, so you can check the deactivation on a test user before the workflow ever touches a real one.
• Keep settings in one place. Put the IT channel and the approver's address in Values, so changing either updates every workflow that uses it. From today, a secret or value can be shared with every workflow or only the ones you name.

Everything on the record

Every run is recorded step by step, so when someone asks whether a leaver's access was removed, and when, the answer is on the record: who was found, who approved, and when each Okta step ran. Every approval decision also goes into the audit log, and on paid plans every change to a workflow is kept in its version history with who made it and when, so you can see who changed the checklist and roll it back in one click.

What to leave where it is

If Okta already creates and removes accounts from BambooHR, keep that, and use Lodol for the approvals, IT tickets, emails and invites around it. And keep the decisions about people with people: the workflow can ask the question, show the facts and do the clicking, but it should never be the one who decides that someone's access goes.

Start with next week's new starters.
Add Welcome next week's new starters, point it at your roster and see Monday's welcomes go out, then build the leaver checklist with an approval in front of every removal. Browse all of the HR and people workflows, or see how Lodol fits a people team on the people ops page. Start free if you don't have a workspace yet.