Lifecycle Business Rules (Onboarding)

Lifecycle Business is an Onboarding model that defines the various stages in which a user progresses within an organization. Lifecycle Business Rules provides 3 stages in Onboarding:

1. Onboard
2. Profile Update
3. Rescind

You can select the user lifecycle required for your business use cases. At the runtime, the workflow will only process user which match the selected stages.

Figure 1. Lifecycle Business Rules

Figure 2. Lifecycle Business Rules

Onboard

Create or reactivate users in the Identity Platform upon hire or rehire. Using this operation, you can create an Employee profile in the Identity Platform when an employee is created in the Onboarding system.

Choose password format - You can select one of the formats for the password you intend to create for a newly onboarded user.

1. Passphrase - Select the passphrase to align with your identity platform's password policy. The password will be randomly generated based on the specified length and will include lowercase letters , one uppercase letter and one numeric digit or one special character. If needed, you can opt to receive the password via email by mapping the Password attribute in the Communication Hub.

   

   Figure 3. Choosing passphrase password length during Hiring or Rehiring for users in AD

2. A common password for ALL Employees - Select the "a common password for ALL Employees" format. It will provide the text area in which you can map from the Onboarding Profile or put a user input value for the password. You can also put some conditions using the Excel function.

   

   Figure 4. Choosing a common password during Hiring or Rehiring user in AD

3. Unique System-generated password - Select the initial password length to align with your identity platform's password policy. The password will be randomly generated based on the specified length and will include at least one lowercase letter, one uppercase letter, one numeric digit, and one special character. If needed, you can opt to receive the password via email by mapping the Password attribute in the Communication Hub.

   

   Figure 5. Choosing system-generated password length during Hiring or Rehiring for users in AD

Select User Account Control - You can select the user account control of the user from the dropdown that you want to assign to the user in the Identity Platform during the onboarding process. The user account control available in Hire2Retire are:

1. 512 - Account Enabled: The user account is active and enabled.
2. 66048 - Account Enabled, Password Never Expires: The user account is active and enabled, with the password set to never expire.

Figure 6. Selecting User Account Control

Require user to change their password when they first sign in - This checkbox will prompt the user to change their password upon their initial login. It is selected by default. You can unselect it to not require the user to change their password.

Figure 7. a user to change the password on the first sign-in

Temporary Access Pass - This checkbox will only appear when using the Entra ID Identity Management system. It is used to generate a temporary password (TAP) when a user is created in the Azure portal.

• The user can set the duration for which the TAP is valid, allowing the employee to log in once or multiple times within that time period.

• To use this feature, the application must have the UserAuthenticationMethod.ReadWrite.All permission.

• If a service provider connection is selected, the user must have the Authentication Administrator role.

For more details, how to add these permissions and roles please check this Entra ID.

Figure 8. Temporary Access Pass

Figure 9. Temporary Access Pass checkbox checked

Exclude Employee Attributes on Rehiring - The workflow would update employee attributes on rehiring if any attributes changed in the Onboarding platform. You can select not to change some attributes during rehiring.

Figure 10. Exclude attributes during Rehiring

Handling of Group Membership : For Rehire, groups that are added manually ( not with H2R ) to the user will be preserved, only the one mapped in the group membership step will be added/removed according to the condition specified in that step.

Onboard & Hire

Select the time to execute Onboard and Hire - This field allows you to select when the Onboarding or Hire event should occur. You can use the lookup table (highlighted in red) to define scenarios based on specific attributes. If the conditions are met, the chosen timestamp will be applied. If not, the event will default to the pre-set timestamp.

Figure 11. Time stamp for onboard and hire event

Days in advance of start date to onboard employee - This field is used to enhance the onboard experience for the IT team. Select the number of days before the start date of the new hire that you would like Hire2Retire to create an account for them. If this number depends on details like 'Department' or 'Location,' you can use the lookup table icon to set different rules for different situations.

Figure 12. Days in advance for the onboard event

By default employee is created in disable state, uncheck to enable employee upon creation - This checkbox is visible when you select any number of days from the dropdown 'Days in advance of start date to onboard employee'. This checkbox ensures that the user is created in a disabled state during the onboard event. It is selected by default. You can unselect it to create the an user in enabled state.

Figure 13. Selecting the checkbox to create employee in a disabled state

Time in advance of start date time to enable the account - This checkbox is visible when you select any number of days from the dropdown 'Days in advance of start date to onboard employee'. The checkbox (highlighted in blue) is used to select the time (4, 8, or 12 hours) before the start date time to enable the account.

Figure 14. Time in advance for enabling account

Automatic Termination - Select wait period post onboarding for automatic termination if the candidate does not show up. A termination event will be scheduled based on the start date of the user and selected aging period.

Figure 15. Select the aging period of automatic termination

Note By default, an employee's password will be reset upon their rehire.

Profile Update

Update the user in the Identity Platform when the user's profile is updated in Onboarding system. Using this operation, you can update a user's profile in the Identity Platform when the user is updated in Onboarding system.

Whitelist (retain) some of the security groups and distribution lists

The handling of security groups and distribution lists will be done while updating a candidate profile according to the selection below.

Retain all groups NOT defined in group mapping automation - Groups which are added manually ( not with H2R ) to the user will be preserved, only the one mapped in group membership step will be added/removed according to the condition specified in that step.

Retain ALL existing groups - None of the existing group memberships will be removed and only new groups memberships will be added.

Do not retain any existing groups - All the existing group memberships will be removed and new groups memberships will be added.

Retain below selected groups - The selected group memberships will not be removed, rest will be removed along with the addition of new group memberships.

Handle group type specific membership

It allows user to define individual rules for each group, enabling more precise control over group membership handling. Instead of applying one common rule, user can configure specific retention logic per group type. This is especially useful during employee update, termination and leave lifecycles, where different groups may require different treatment. It ensures flexibility and better alignment with organizational policies.

When both common and group type–specific rules are configured, the group type–specific rule will take precedence over common whitelist group membership.

Figure 16. Updating Group Specific Memberships during Change of Profile or Role in AD

Figure 17. Updating Group Specific Memberships during Change of Profile or Role in AD with MDC

Exclude Employee Attributes on Updating

The selected attributes will not be consider when updating a candidate profile.

Figure 18. Profile update in AD

Rescind

Terminate the user in Identity Platform automatically when the scheduled termination event takes place. This operation allows you to terminate a user's account in Identity Platform when their account is marked for automatic termination by selecting the aging period days under the Onboard tab.

Account Deletion for Non-Onboarded Candidates Select the checkbox, "By default, the identity account will be terminated when the offer is rescinded. Check to delete the account" to automatically mark the candidate's account for deletion according to the selected aging period.

Figure 19. Delete User Account

Choose OU for terminated user - All terminated users will be moved to the selected user group. You can choose "Do not change OU" from the dropdown if you do not want to change an OU.

Figure 20. Terminate user in AD

Selected attributes will be purged when rescind - All the selected Identity Platform attributes will be purged when rescind.

Figure 21. Purge user's AD Attributes when Rescind

Set Description on termination - Users can choose to add description on employee's profile upon termination. This will be an optional field. With the lookup table (highlighted in red), you can set conditions based on attribute values. If the conditions are satisfied, the specified description will be applied. If not, the event will use the default description.

Figure 22. Set Description on Termination

Handling of Group Memberships

The group memberships will be updated upon terminating an employee profile based on the below selection.

Remove ALL assigned groups - All the assigned group memberships will be removed.

Retain ALL assigned groups - None of the existing group memberships will be removed.

Remove Selected groups - The selected group memberships will be removed when a candidate is terminated, rest will be preserved.

Retain selected groups - The selected group memberships will be retained, rest will be removed.

Figure 23. Handling the Group memberships on employee termination

In a multi-domain controller setup, when selecting the 'Retain selected groups' or "Remove Selected groups" option under 'Handling of security group and distribution list memberships', you can select Security Groups and Distribution lists for any of the base DNs in your AD.

Figure 24. Terminate user in AD with Multi-Domain Controller

Handle group type specific membership

It allows user to define individual rules for each group, enabling more precise control over group membership handling. Instead of applying one common rule, user can configure specific retention logic per group type. This is especially useful during employee update, termination and leave lifecycles, where different groups may require different treatment. It ensures flexibility and better alignment with organizational policies.

When both common and group type–specific rules are configured, the group type–specific rule will take precedence over common whitelist group membership.

Figure 25. Updating Group Specific Memberships during Termination

Figure 26. Updating Group Specific Memberships during Termination with MDC

Exclude Employee Attributes when Rescind - The workflow would update employee attributes when rescind if any attributes changed in the ATS platform. You can select not to change some attributes on termination.

Figure 27. Exclude Employee Attributes when Rescind

Remove directly assigned Microsoft licenses - All directly assigned microsoft licenses will be unassigned from the user. If it is unchecked, we will not touch any directly assigned licenses.

To use this feature, the application must have the LicenseAssignment.ReadWrite.All permission.

For more details, how to add these permissions and roles please check Entra ID.

Figure 28. Updating Group Specific Memberships during Termination

Note - By default, the manager attribute will be purged. Additionally, if the attribute ms-Exch-Hide-From-Address-Lists (msExchHideFromAddressLists) in Active Directory or showInAddressList in Azure AD is included in your attribute list, the user will be removed from the corresponding list.