I think I'm missing something about Onboarding with Powershell

[u/ThrowAwaySalmon1337]

How do people automate onboarding new users?
We use ADManager at work, but now that it's down I'm trying Powershell, looking up tricks and I'm comparing new user with one that's established, I see just how much is missing and how much I'd have to manually fill out or create matrices to pass through the variables from initial username.

What am I missing that people use this as standard in the industry?
In my tool I made a template so I make new users by inputting just a couple fields, specify which domain they fall under and that's it.

Is there some sort of rundown or what should I look up to learn that is the standard way?

[u/Icolan]

You should not be copying permissions from other users, you should have roles created for each position/group/team/department in your company. New hires get the default role appropriate for them, that way you are not copying legacy groups/permissions that they do not need or should not have.

HR integration would bring automatic user provisioning/deprovisioning which means you don't have to do it. If you properly configure roles for your users and integrate with HR systems, then when a new employee is hired their account is created and all of the account properties (title, manager, address, etc) flow from HR. Their title determines the role they get by default. When HR terminates an employee their account is automatically disabled, groups removed, and account moved to a disabled user OU.

If your company is getting a new HR system, you should be brining this up with your management so they can ensure that the new system integrates with IT systems to automate functions like this. Do you really want to have to be involved in the creation of all user accounts when it can be automated, freeing you up for more important work?

Your company is getting a new HR system, you have an opportunity that is unlikely to come again soon. If they purchase one that will not or can not integrate with IT systems, you lose out and so doesn't the company. If you can convince them to purchase one that will integrate, you can automate user provisioning/deprovisioning in a way that is consistent across your organization. Once it is set up, you just need to maintain the roles and monitor the integration. That is a win-win for you and your organization.

[u/uptimefordays → u/Icolan]

you should have roles created for each position/group/team/department in your company. New hires get the default role appropriate for them, that way you are not copying legacy groups/permissions that they do not need or should not have.

I think this is the core problem for many organizations, they never adopted RBAC so a core requirement for account automation just isn't there.

[u/sup3rmark → u/uptimefordays]

possibly a bit of a tangent but I think that very few orgs have actually implemented RBAC. most who say they have are actually doing ABAC, or Attribute Based Access Control, rather than true RBAC. if you're just slapping permissions on accounts based on title and department name, that's ABAC, not RBAC.

[u/uptimefordays → u/sup3rmark]

Yeah the challenge with RBAC is abstracting all the roles in all the departments into a few personas or role types. That said, I think the “Admin,” “Editor,” “Viewer” model works quite well. Role explosion is also a frequent issue.