IT onboarding workflow for Tallyfy

Provision new employees with the right access from day one

New hires sitting around waiting for system access wastes everyone's time. This workflow ensures all provisioning happens before their first day, with proper manager approval and security controls in place.

13 steps

1 fields

7 automations

Import into Tallyfy Preview steps

Startup Access Setup

Run this workflow in Tallyfy

Import this template into Tallyfy and assign HR, managers, and IT staff to handle user details, approvals, and system setup steps

Use Tallyfy's multiselect field to capture exactly what needs provisioning: laptop, iPhone, desk phone, Salesforce, Webex, or DocuSign

Track provisioning progress through each system setup in Tallyfy, with manager approval gating IT work and department-based visibility rules

Import this template into Tallyfy

Process steps

Collect new user details

1 days from previous step

task

Start here - you'll need the basics before anything else can happen. Grab their name, work email, department, and figure out what they'll actually need provisioned. Don't guess on the provisioning list - check with their manager if you're not sure. Getting this right saves everyone time later.

Form fields in this step

First name *

Last name *

Work email *

Department? *

What do we need to provision? *

Get manager approval

1 days from previous step

task

Please approve provisioning of the following for {{first-name-7918038}} {{last-name-7918041}} (Employee number: {{employee-number-7918027}}):

Email: {{work-email-7918040}}

They'll be working in {{department-7918042}}

Review the request above and confirm it's correct. If something doesn't look right - wrong department, missing items, or access that doesn't match the role - flag it now. It's much easier to fix before everything gets set up.

Form fields in this step

Approved *

Set up laptop

1 days from previous step

task

Set up the laptop for {{first-name-7918038}} {{last-name-7918041}} ({{work-email-7918040}}). Make sure you've got the right hardware for their role - engineers and designers typically need more power than admin staff.

Follow your standard image and config process. If you're not sure which build to use, check the video below for guidance:

Don't forget to label the asset and update your inventory tracking before handing it over.

Set up iPhone

1 days from previous step

task

Get the company iPhone ready for {{first-name-7918038}} {{last-name-7918041}}. You'll want to enroll it in your MDM solution first, then configure email and any required apps.

Follow Apple's setup instructions here: iPhone setup guide

Make sure you install the required apps (check the list below) and verify they're working before you hand it off. A quick test call and email send confirms everything's good.

Form fields in this step

Insalled

Set up desk phone

1 days from previous step

task

Configure the desk phone with their extension and voicemail. If your office uses a VoIP system, you'll need to assign the extension in your phone admin portal first. Set up voicemail with a temporary PIN they'll change on first use. Test inbound and outbound calls to make sure the line's working. Add them to the company directory so people can actually find their number.

Set up Salesforce

1 days from previous step

task

Create their Salesforce user account and assign the right profile and permission sets for their role. Sales reps, managers, and support staff all need different access levels - don't just copy someone else's profile without checking. Make sure they're added to the correct queues and teams. If your org uses custom apps or dashboards, set those up too.

Set up Webex

1 days from previous step

task

Create their Webex account and add them to the right spaces and teams. They'll need this for meetings from day one, so don't leave it until last. Configure their Webex settings - calendar integration, default meeting preferences, and phone service if they're using Webex Calling. Send them a quick test meeting invite to make sure everything connects properly.

Set up DocuSign

1 days from previous step

task

Provision their DocuSign account with the appropriate permissions. Not everyone needs sending rights - some folks only need to sign. Check what their role actually requires before assigning a license level. Set up their signature block with the correct name, title, and contact details. If they'll be using templates, give them access to the right shared folders.

Verify authorization

1 day from previous step

task

Before you touch any systems, confirm this access request is legit. Who approved it? Does the requested access match what's normal for their role? Check your access control matrix if you've got one. If something looks off - like an intern requesting admin access - don't just process it. Reach out to the requester's manager and get clarity. Unauthorized access isn't just a security problem, it's a compliance headache too.

Create user accounts

1 day from previous step

task

Set up their accounts in Active Directory (or whatever identity provider you're running), email, and any other core systems. Stick to your naming conventions - it's a pain to fix later. Generate a secure temporary password they'll need to change at first login. Turn on MFA right away - don't let accounts exist without it, even for a few hours. That's how breaches happen.

Assign group memberships

1 day from previous step

task

Add them to the right security groups based on their role and department. Groups control what they can get to - file shares, apps, network resources, the works. Use role-based access wherever you can instead of one-off permissions. If you need to grant something outside the standard role, write it down. You'll thank yourself during the next access audit.

Configure application access

1 day from previous step

task

Set up access to the specific apps they need - CRM, ERP, project tools, whatever their job calls for. Each app might have its own provisioning process, so check with the app owners if you're unsure. Don't just add them and move on - actually test that their login works and they can see what they're supposed to see. There's nothing worse than telling someone they're all set when they're not.

Share credentials and verify access

1 day from previous step

task

Send their login info through a secure channel - never put passwords in plain email. A password manager share link or encrypted message works well. Walk them through their first login if they need help. Then verify together that they can reach everything they should and can't reach anything they shouldn't. Log what you've granted for audit records. If this is temporary access, set yourself a reminder for when it's time to pull it.