Create Access Profiles and start an on-boarding case

When someone joins, the question is always the same: do they have everything they need, and nothing they should not? This guide shows how to describe the access a role needs once, as an access profile, and then start a joiner case that turns the matching profiles into a To-Do list you can track until every application is in place.

You will:

1. Create an access profile.
2. Start a joiner case for a new employee.
3. Work through the To-Do list.
4. Keep the case up to date, change its due date, or cancel it.

When someone leaves, the reverse runs as a leaver case — see Off-boarding & Leaver Checks.

Before you start

• The employee exists in AutoCISO (add them under Directory → Employees if not). A joiner case is for an employee who has not left the company.
• The applications they need exist as assets (Directory → Assets). A profile lists assets, so an application that is not in AutoCISO cannot be required by a profile.

1. Create an access profile

An access profile says: “employees who match these attributes need this access.”

1. In the sidebar, open Operations → Lifecycle (JML) and select the Access Profiles tab.
2. Click New access profile.
3. Enter a Name, for example Engineering. Names must be unique; a clash shows “An access profile with this name already exists.” A Description (optional) helps the next person.
4. Decide who it applies to under Applies to:
   • To match by attribute, click Add criterion and choose Department, Job title, Employment type, Country or Office, then enter one or more values. An employee matches when every listed attribute matches one of its values. The dialog shows how many current employees match (“Matches 4 current employees”).
   • To give the same access to everyone (a “base” profile such as email and chat), turn on Applies to every employee. The dialog warns “This profile applies to every employee.” and the list shows an Applies to everyone tag.
5. Under Required access, select the assets the profile requires. At least one is needed (“Select at least one asset.”).
6. Leave Enabled on, and click Save. You see “Access profile saved”.

Keep profiles accurate

• The Access Profiles list shows each profile’s Applies to, Access, Employees matched and Updated. Use the pencil icon to edit and the bin icon to delete.
• An Asset removed tag means an application in the profile no longer exists. Open the profile and remove it from the list.
• If someone else saved the profile while you were editing, you see “This profile was changed by someone else. Reload to see the latest version.” Click Reload, then redo your change.
• Deleting a profile does not touch existing To-Do lists: “Joiner To-Do lists already created keep their items.” New joiners just stop getting that requirement.

2. Start a joiner case

1. Open the Joiner (Onboarding) tab.
2. Click New joiner.
3. Choose the Employee. Optionally set the Due date, the date by which the access should be ready.
4. Check the preview under Access this joiner will get: it shows the Matching profiles and the applications they require. If no profile matches, you see “No access profile matches this employee. The To-Do list will be empty.” with a Manage access profiles link; add or adjust a profile first.
5. Click Create joiner. You see “Joiner created”, and the new joiner appears in the list.

Things that can stop you:

• “This employee already has an open case.” An employee can have only one open joiner case at a time. Click Open the existing case to go to it.
• “This employee cannot be onboarded because they have left the company.”

3. Work through the To-Do list

The Joiner (Onboarding) tab shows Open joiners, Pending access items and Marked done, not yet detected at the top. Use the Show joiners filter to switch between Open, Completed and All. A joiner past their due date with access still pending gets an Overdue tag.

1. Click Show To-Do list on a joiner to expand it. Each row is one application, with its Source (the profiles that require it, or Manual task), its Status and a Detail column.
2. Give the person the access in the application itself. AutoCISO checks your access data and turns the item Granted on its own once it sees the access, usually after the next access scan. You do not have to click anything.
3. If you gave the access but AutoCISO cannot see it yet (an application that is not connected, for example), click Mark as done, write a short Note saying how you confirmed it (up to 500 characters) and click Save. The item becomes Marked done and shows who did it and when, with “Waiting for the next access scan”.
4. Made a mistake? Click Undo done. The item goes back to Pending, and a completed case is reopened.
5. For a Manual task (a step that is not an application), click Complete when it is done.

The case completes by itself when every item is Granted or Marked done.

4. Keep the case up to date

• Refresh from profiles. If you change a profile or the employee’s department or job title after the case was created, open the joiner and click Refresh from profiles, then confirm. The profiles are checked again with the employee’s current details, and new required access is added to the list with a New tag. Nothing is removed or changed. You see “2 items added” or “Already up to date”.
• Edit due date. Click the pencil icon (Edit due date), pick a date and click Save.
• Cancel case. Click the ban icon (Cancel case) and confirm. “Remaining items stop being tracked. This cannot be undone.”

If a case is completed or cancelled you see “This case can no longer be changed.” If someone else changed an item while you were looking at it, you see “This item was changed by someone else. Reload and try again.”

The same data over the API

Everything on the Joiner (Onboarding) tab can be read, but not changed, with a jml:read API token (see scopes). Use it to feed a ticketing tool with the items that are still Pending. See the On-boarding API.