A regulated community bank with about 1000 employees replaced manual onboarding and offboarding with HR-driven automation in a four-week rollout.
Systems
ADP Workforce Now (HR), Active Directory, Entra ID
Drivers
Bank examiner and IT audit expectations for timely deprovisioning and periodic access reviews
Challenges before BalkanID
- New hires and leavers were set up and removed by hand across AD, Entra ID and Okta, with no reliable link to the HR system.
- Leaver deprovisioning depended on email and tickets, so access could outlive employment. This is a recurring audit finding for banks.
- A small IT and security team had to produce access review evidence for examiners without an IGA tool, and enterprise IGA platforms were too heavy for their size.
What they implemented
- HR-driven joiner and leaver playbooks: a status change in ADP triggers account creation or removal in AD, Entra ID.
- Automatic base line access and licenses in EntraID for different types of team members.
- Enable periodic user access reviews with evidence for audit.
- IAM risk scanning for orphaned and terminated-user accounts.
- Rollout plan: weeks 1 and 2 setup and playbooks, week 3 pilot, week 4 rollout.
Outcomes
- Leaver flow tested end to end, from HR termination to access removal across directories.
- Joiner flow tested end to end, from HR employee creation to baseline acccesses.
- Service targets set with the bank: 100% of leavers deprovisioned within 4 hours of the HR status change, and 100% of joiners provisioned within SLA.
- One platform for provisioning, reviews and risk, sized and priced for a community bank.
.svg)
