Prepare a new starter's access before their first day, then give them a controlled way to claim it. Avoid making a manager or help desk technician carry a permanent password between systems and people.
Tools4ever NIM Onboarding documents an account-claim process in which users verify their identity, create a password, and receive their account details. They do not need to know their username, email address, or password in advance. Those are current documented capabilities, not a statement about older releases.
Keep preparation and activation separate
Account preparation answers whether the person is eligible, which accounts they need, and which attributes belong on those accounts. Claiming answers how the intended person takes control of prepared access.
That distinction matters when a start date changes. An account can exist without being ready for use. Write down which system owns activation timing, what happens if a hire is canceled, and how a delayed starter is handled.
For source records and target operations, use the NIM lifecycle planning guide before designing the user experience.
Choose a verification route that survives day one
A new employee may not yet have access to their work mailbox. A personal address or phone number may be missing, shared, or incorrectly entered. Decide how the organization establishes that the onboarding channel belongs to the intended person.
A hypothetical pilot could use synthetic records with a valid contact route, an incorrect route, duplicate identifying information, and no contact route. The flow should not quietly direct a verification code to the wrong person or reveal another starter's details.
Treat any invitation or user-specific link according to the access it grants. Do not paste it into broad distribution lists, analytics fields, or support screenshots. A convenient link is still part of an authorization design.
Design a useful failure message
Users need to know the next safe step when verification fails or an account is not ready. Give them an appropriate support route without exposing whether an arbitrary employee identifier exists.
The support team needs a separate view of the underlying problem: missing source data, incorrect matching, incomplete account preparation, or notification failure. Avoid asking users to keep retrying when an administrator must correct the problem.
Verify the whole handoff
Test from the new starter's browser through to a real sign-in with the intended permissions in a safe environment. Check canceled starts and repeated claims as well as the happy path. Keep verification secrets and passwords out of logs.
NIM is worth demonstrating when account claiming currently depends on manual handoffs. Do not assume its onboarding app replaces hiring identity checks, MFA enrollment, or every application's activation process. Assign those responsibilities explicitly.
After access is established, provide a separate self-service recovery process so the next forgotten password does not restart onboarding.