And Reduced New-User Provisioning From Five Days to Under Five Minutes.
Customer Description
Organisation: Large New Zealand government agency
Industry: Public sector
Workforce: More than 5,000 employees
Workforce activity: Approximately 1,300 new starters, 900 departures and 15,000+ personnel changes annually
Environment: Oracle Cloud HR, Active Directory, Microsoft Entra ID and connected business systems
Jobs to be done: Automate pre-employment, onboarding, role changes
Solution: Activate Identity Lifecycle
The Challenge
Our customer, a large NZ government agency, employs more than 5,000 people. Its workforce generates a significant volume of identity activity each year.
Approximately 1,300 people join the organisation and 900 leave annually. Across new starters, departures, name changes, new roles, transfers and other updates, the agency processes more than 15,000 personnel changes each year.
Previously, every identity change had to be initiated manually by the service desk. Staff created accounts, updated employee details, assigned access and removed permissions when someone left.
This consumed valuable IT capacity and introduced opportunities for incomplete or incorrect access. Delays affected new employees, while mistakes during role changes and offboarding created security and compliance concerns.
The Jobs the Agency Needed to Get Done
The agency needed a more reliable way to:
Begin identity processes before an employee’s first day
Give new starters the access needed for their role
Update accounts when employee information changed
Adjust access when people moved between departments or roles
Remove access consistently when people left
Reduce repetitive service-desk work
Minimise errors and rework
Connect HR information with identity processes
Improve visibility and auditability across the employee lifecycle
The job was not simply to process tickets faster. The agency needed to remove the manual work behind each workforce change.
Where the Hidden Costs Were Building
The hidden cost of identity management was spread across thousands of small tasks. Each new employee required account creation and access provisioning. A change in name, department, location or job title could trigger several updates. Every departure required access to be removed across the connected environment.
The service desk had to initiate and track each task manually. This used skilled IT time for repeatable administration and made the process vulnerable to delays, incomplete information and human error.
The effects extended beyond IT. New starters could wait up to five days for access. Incorrect permissions affected productivity. Access that was not adjusted or removed correctly increased security and compliance risk. With more than 15,000 personnel changes each year, even a small amount of manual effort attached to each change added up quickly.
The Solution: Connect HR Events to Identity Automation
The agency implemented Activate’s User Manager and Roles & Entitlements capabilities, now provided through Activate Identity Lifecycle. Activate connected with Oracle Cloud HR and automated key stages of the workforce lifecycle—from pre-employment and onboarding to internal role changes and secure offboarding.
The solution introduced:
HR-driven joiner, mover and leaver automation
Pre-employment identity processes
Automated account creation
Department-based roles and entitlements
Birthright access for new employees
Updates across Active Directory and Microsoft Entra ID
Tailored deprovisioning based on business requirements
Auditable identity and access changes
Starting Automation Before Day One
Automation begins during the initial offer stage. Activate creates a contingent-worker identity and provides limited access to the tools required to complete contracts and pre-employment paperwork securely.
Once the employment contract is accepted, Activate automatically transitions the person to a full employee and provisions the default access and entitlements needed for their role.
This means identity work can begin before the employee arrives, reducing the access delays that previously affected their first days at work.
Keeping Access Aligned With Each Role
The agency created HR business roles based on departments and job requirements. These roles determine the default systems, data and other entitlements an employee should receive.
For example, a new case worker can automatically receive a duress alarm as part of onboarding rather than relying on a separate manual request.
Activate synchronises with Oracle Cloud HR four times each day. When an employee’s department, job title, location or other details change, Activate updates their identity information across Active Directory, Microsoft Entra ID and connected systems.
Access can then be reviewed and adjusted to reflect the person’s new role, helping prevent old permissions from accumulating over time.
Automating Secure Offboarding
When someone leaves, Activate triggers a tailored deprovisioning process based on their role and the agency’s business requirements.
This provides a more consistent level of security and compliance than the previous manual process. It also reduces the risk of an important access-removal step being delayed, overlooked or completed incorrectly.
The Outcome: Faster Access With Less Manual Administration
Activate now automates more than 54,000 identity changes for the agency each year. New-user provisioning has fallen from five days to under five minutes, giving employees much faster access to the systems and information required for their work.
The agency estimates that automation saves more than 10,000 hours annually. Service-desk and IT teams can spend less time initiating, tracking and correcting repetitive identity tasks.
The organisation has also improved security across role changes and offboarding. Access is updated using current HR information, while tailored deprovisioning helps ensure permissions are removed when someone leaves. Greater visibility across HR, ICT, third-party vendors and business teams has improved the auditability of employee access and entitlements.
The Bottom Line
The cost of manual identity management was hidden across more than 15,000 workforce changes each year. Every starter, departure and employee update created another set of tasks for the service desk.
By connecting HR events directly to identity automation, the agency removed much of that repetitive work and reduced provisioning from five days to under five minutes.
The result was not simply faster onboarding. It was more than 10,000 hours returned to the organisation each year, alongside more consistent access and stronger lifecycle controls.
How Much Time Is Hidden in Your Workforce Changes?
If onboarding, role changes and offboarding still depend on tickets and manual fulfilment, Activate can help automate the work across your HR, directory and business systems.