How our European team uses Rippling IT

I've been in IT long enough to have heard every provisioning nightmare going.

Day one, no login. Day two, login works but nothing's installed. Day three, you're messaging six different people trying to figure out who owns access to Slack. 

No single person is to blame, it's just what happens when onboarding gets cobbled together by hand across IT, HR and payroll. Everyone assumes someone else already sorted it. Nine times out of ten, they haven’t.

So when I say it's different here at Rippling, I get the raised eyebrows. Mine were raised too, right up until I went through everything myself.

They’ve signed on the dotted line. Now what?

When a new hire signs their contract, that signature kicks off a chain reaction. 

Their laptop gets ordered and shipped, and it’s already set up for the exact role they’re stepping into. By the time it lands on their doorstep or desk two or three days later, all that's left for them to do is open the lid and drop in a new password.

In fact, it starts before that. If someone's joining the sales team for instance, I can add them in Slack before their start date and make intros before day one. That access gets set up automatically ahead of time. By the time they officially start, they're already part of the conversation and everyone on our team has had a chance to greet them.

Then everything else they need pops up. Salesforce, Teams, Zoom, Gong, whatever the role actually calls for, all live and waiting from the very first morning. Nothing missing and nothing extra they don’t need. No awkward first morning chasing up logins.

Single sign-on does a lot of the heavy lifting. Log in once and everything's there, because your role and your access were already matched up on the system.

Nobody on our IT team loses an evening manually building out access lists anymore. Everything was already decided the moment the contract was signed.

The joy of access tiers

Nothing drains my energy quite like manually clicking through permission settings. If there's a more effective way to ruin a Tuesday afternoon I haven't found it yet.

There's also something uniquely soul-crushing about a spreadsheet titled ‘Access Tracker FINAL v4’ that nobody's touched since March, sitting open in a tab while you try to remember whether Dave got promoted before or after he switched teams.

Which is why the idea of role-based permissions that update themselves the moment someone changes position genuinely puts me at ease whenever I hear a new team member is joining. I know that sounds pretty sad but hear me out.

A new starter comes in on the lowest tier of access, just what they need to do the job in front of them. Then six months later, that same person gets promoted and suddenly that role calls for more tools and more visibility. And generally more weight behind their login.

The moment their promotion goes through, everything upgrades itself in the background. No tickets raised, no request sitting in someone's queue, no one logging in to manually swap permissions over. It's the same logic any decent permissions system runs on, just applied to who gets which apps, at what level, on any given day.

That means I'm not stuck updating a spreadsheet of who has access to what every time someone changes roles. I'm not chasing three different approvals for someone who moved teams last week. Or worrying about who still has access they shouldn't, months after they've moved on from the role that justified it in the first place.

The platform already knows because the role data and the access data live in the same place and update together, by default. For an IT manager, that's the difference between provisioning being something you manage and something you barely have to think about.

‘Doesn't automation make first impressions feel a bit cold?’

Fair question for anyone handling onboarding. You see the advantage of more automation but don’t want someone’s first day to feel like ‘here's your username, off you go.’

But it actually works the other way round. You’re automating the stuff nobody wants to be doing and freeing up more time for the things that matter.

Think about what the manual version of day one usually involves. Half the conversation is admin. Have you got into Salesforce yet? Is your laptop working alright? Has IT sorted out your VPN? None of that is a warm welcome. It's troubleshooting. And it eats into the time you'd rather be spending getting to know someone.

Take all of that off the table and what's left are the real human conversations. What someone's nervous about. What they want to get good at. What the first few weeks should realistically look like. All the things that make someone feel like a person joining a team, not a ticket working its way through a queue.

So no, it's not colder. If anything, automating the boring bits is what makes room for the warm ones.

The compliance bit nobody thinks about (until they need it)

Nobody ever brings this one up voluntarily. Then an audit lands on the calendar and suddenly it's all anyone wants to talk about.

The big thing about manual access management is that human error is basically baked into the process. An employee leaves the company and their Slack access gets revoked but their Gong login slips through. A contractor's project wraps up and nobody remembers to pull their Sharepoint access for another three months. 

Or the one we see constantly: someone in HR has to call a new hire to ask if they've got access to payroll yet. The new hire says no. Now HR has to go away and figure it out, the new hire feels like an afterthought and everyone's time has been wasted on something that should have been invisible from day one.

This is what happens when IT provisioning lives in someone's head and across disconnected systems, instead of one place. It’s not like anyone’s being careless on purpose. It's just a genuinely bad system for something so important.

Automate provisioning properly and that whole category of risk basically disappears. 

When someone leaves, their access leaves with them, everywhere and all at once. Every permission granted and revoked gets logged automatically, so when an auditor eventually asks ‘can you show me exactly who had access to this system and when’ the answer is already sitting there. It’s not buried in someone's inbox or pieced together from memory three weeks after the fact.

Not the most glamorous thing to get excited about I'll admit. But ask anyone who's scrambled through a surprise audit and they'll tell you it's a lifesaver.

Too good to be true?

Truth is, there's nothing particularly technical about how we manage any of this, at least not in the front end.

But that's sort of the point. None of the above relies on anyone being a tech wizard or playing permission detective every time someone changes roles. It relies on everything (the laptop, the role, the access controls, the compliance) all living in one place, instead of in the heads of a few select people.

That's what great provisioning looks like. Not flashy or something you ever really think about. It just clears the friction before anyone notices it was ever there.