IT onboarding software: day-one ready, from a role template

Onboarding and offboarding are the same system, run in reverse

Most teams treat new-hire setup as an ad-hoc scramble: an admin pulls groups from memory, forgets a license, ships the laptop late, and nobody can later say exactly what access was granted. Passage treats onboarding as the front half of the access lifecycle. A new hire is a joiner run generated from a role template — the same template that, when they leave, becomes the leaver run that takes it all back.

What a joiner run provisions

• Directory account — create the user in Entra / Google Workspace with the correct naming and attributes.
• Least-privilege access — add only the role's standing groups and apps, not "whatever the last hire had."
• Licenses — assign exactly the paid seats the role needs.
• Device — assign and ship hardware via Cairn, linked to the person so it can be reclaimed on exit.
• Human welcome tasks — manager intro, security training, badge — tracked to completion with an owner, not lost in a chat thread.

Role templates make access reproducible — and auditable

Because access is defined once per role, two engineers hired into the same role get identical, correct access. That standing access set isn't just convenient: it's the baseline the mover diff engine compares against on a role change, and the inventory the offboarding run revokes on exit. Reproducible onboarding is what makes provable offboarding possible. Passage ships role templates for engineering, sales, clinical/HIPAA, finance/SOX, support, contractor, office, and executive roles out of the box.

SMB-priced, no implementation project

You shouldn't need a six-week deployment to automate new-hire setup. Passage is free to start, $4 per managed user per month for the core plan, and there's no SSO tax or implementation fee. See pricing or compare Passage vs BambooHR for the IT-provisioning gap that HR suites leave open.