Preparing Workspace ONE Access for Day Zero Onboarding in Workspace ONE Intelligent Hub

Workspace ONE Access with Hub Services provides a pre-hire onboarding experience through Workspace ONE Intelligent Hub on a web browser. Pre-hire onboarding gives users that are hired, but have not started to work, access to resources before their start date. Workspace ONE Access generates a one-time-use access token, called a magic link, that you send in an email to pre-hires. Pre-hires click the link to access a Welcome page in the Workspace ONE Intelligent Hub portal.

Workspace ONE Access Prerequisites for Day Zero Onboarding

• An Active Directory group created that is dedicated to pre-hire users. All pre-hires are added to this group when they sign the offer letter. The user remains in the pre-hire group until their start date.
• The Active Directory pre-hire group must be synced to the Workspace ONE Access directory.
• Workspace ONE Access enabled for user authentication in the Workspace ONE UEM console.

You configure Workspace ONE Access APIs to set up the authentication token and the magic link.

• You configure the API to enable the Token Auth authentication method in Workspace ONE Access for Day Zero Onboarding. In the API, you enable the authentication method, set the length of time that the generated magic link is valid, and add the pre-hire group UUID. If the pre-hire user email addresses can be used, the Active Directory user email attribute is configured.
• You configure the API to create the magic link. Two different API actions can be configured. The API can produce and email the magic link to the pre-hire user. This API can be used when the pre-hire email is available in Active Directory. When the pre-hires email address is not available in Active Directory, you can configure the API to create the magic link login token. You can add this token to an email that your send to the pre-hire.

After the APIs are configured, you enable Token Auth and add it to the built-in identity provider that is associated with the directory that is syncing the pre-hire user group from Active Directory.

See the How to Set Up a Pre-Hire Onboarding Experience in VMware Workspace ONE Intelligent Hub for information about how to set up the APIs and configure the onboarding features in Workspace ONE Access.