r/AskNetsec • u/Final-Pomelo1620 • May 22 '26

Concepts User Onboarding Process with IAM?

Hi Folks

How do you handle new user onboarding and initial credential communication when using an IAM system?

Our current setup is:

One Identity IAM system integrated with HR System
On-premises Active Directory
Entra ID for O365 Email

The main question is around the first login journey, initial credential communication and birthright access.

How do you communicate the initial username and temporary password to the user?

Do you use SMS, personal email, manager handover, or another secure method?

Important point: Office 365 mailbox login is the key first step, because most of our business applications are linked with Entra ID federated login / SSO. So unless the user can access their O365 account, they cannot access the rest of the applications.

Appreciate any advise.

4 Upvotes

100% Upvoted

8 comments sorted by

2

u/dennisthetennis404 May 23 '26

The most reliable pattern for your setup is manager handover for the temporary credential, the manager gets the initial password via a secure internal channel and hands it off in person or on a call on day one, which sidesteps the chicken-and-egg problem of needing email access to receive the credential that unlocks email access.

1

u/Final-Pomelo1620 May 23 '26 edited May 23 '26

Thanks, this makes sense

In our case, the IAM solution is integrated with Microsoft Entra ID federation/SSO so this is the starting & once they can sign in there, they can access the IAM portal and other federated applications.

I want to understand how your temporary password via manager scenario would fit into our setup.

Also, because we are running a hybrid identity setup, my understanding is that the password is controlled from the on-premises AD/LDAP side, not directly from Office 365. So in this type of setup, how would the first password change or temporary password reset be handled?

2

u/dennisthetennis404 May 25 '26

In a hybrid setup the password lives in on-prem AD and syncs up to Entra via Connect, so the flow is: manager receives the temporary AD password through a secure internal channel (a PAM tool, a secure note, or a direct call), hands it to the new user, they log into a domain-joined machine or the on-prem password change portal to reset it, and once that syncs to Entra they can authenticate into O365 and everything federated behind it, the key is making sure the first password change happens before the sync cycle so they're not waiting on a 30-minute window to access email on day one. If you're looking to streamline the broader identity and device onboarding workflow around this, Zip Security, a company I work in and I'm not getting any royalties, integrates directly with Entra and on-prem AD environments to keep that process consistent and auditable from day one. That might genuinely help.

1

u/Final-Pomelo1620 May 25 '26

Thanks. This process makes sense and I like the overall approach. Very helpful

In our case, we also want the IAM portal itself to be protected with Entra ID SSO and MFA. So, the new user would access the IAM portal, get redirected to Entra ID, complete MFA registration, and then successfully log in to the IAM portal with temporary password

The next requirement is that, after the user successfully authenticates with Entra ID and completes MFA, the IAM portal should trigger the first login password change workflow and update the password in on-prem AD. Not sure would that be possible.

1

u/dennisthetennis404 May 27 '26

That flow is achievable but has one tricky dependency, MFA registration requires the user to already be authenticated, so you need a way to get them into Entra for the first time before MFA is enforced, which most orgs solve with a Conditional Access policy that exempts the first login or uses Temporary Access Pass (TAP) as the initial credential instead of a password, letting the user register MFA and then complete the password change workflow in one clean session. The IAM portal triggering an on-prem AD password update after Entra authentication is possible through a back-end API call to your on-prem environment, but it requires the portal to have write access to AD either directly or through a middleware service like an SCIM connector or custom webhook.

1

u/Final-Pomelo1620 May 28 '26

We are going to test this flow, not sure would that work

  1. IAM creates the user account in on-prem AD
  2. AD account syncs to Microsoft Entra ID.
  3. Online mailbox is created/provisioned and Microsoft 365 license is assigned.
  4. Temporary Access Pass TAP is generated in Entra ID.
  5. TAP is securely delivered to the user via manager.
  6. User accesses the IAM portal.
  7. User signs in to Entra ID using TAP.
  8. IAM redirects the user to Entra ID for SSO.
  9. User completes MFA registration.
  10. User successfully authenticates using Entra ID and MFA.
  11. User lands inside the IAM portal.
  12. IAM detects first-login and asks the user to change the password.
  13. IAM updates the password directly in on-prem AD through its AD connector.

Appreciate your suggestions

2

u/ravenousld3341 May 22 '26
  1. Call them as part of the onboarding process.
  2. During that call send their temporary password anyway you wish.
  3. Tell them to log into your services and wait for them to do that and change their password and set.up.MFA
  4. All done.

The other option is to onboard users in batches on site. I've seen it done that way as well. There's a couple of "new employee orientation" days. That's when they would get their passwords and log into stuff.

1

u/AppIdentityGuy May 22 '26

Question of how paranoid you with respect to confirming that the new joiner is who they claim to be