day one access missing for new hire: provisioning workflow stuck in pending error fix

TL;DR

Unblock the single step holding the chain instead of restarting the whole workflow. Open the onboarding run, find the first pending step and what it waits on, an approval, a failed connector, or upstream data, clear that wait, then resume the chain and verify every dependent account and assignment completes before the hire first sign-in.

day one access missing for new hire: provisioning workflow stuck in pending

Use this when

• The onboarding workflow shows pending long after the start date and the hire lacks core accounts.
• Earlier steps completed, so the HR trigger and identity creation worked.
• Approvers or connectors named in later steps show no task or no call was made.

Not for this skill when

• The hire start date is in the future and pre-boarding rules intentionally hold access. Confirm the date before intervening.
• The workflow completed but access is wrong. That is a mapping problem, not a stuck workflow.

Steps

1. Open the workflow or onboarding platform run for the hire and list step states in order, marking the first step that is not complete and reading its wait reason, whether an approval task, a connector call, a scheduled time, or a manual task. Verify: the first blocking step and its wait type are identified
2. If the block is an approval, check whether the approver task was actually delivered, whether the approver is the current manager after a reorganization, and whether an escalation timer exists. Reassign or nudge with the start date context rather than silently waiting. Verify: a live approver holds the task with a clear deadline
3. If the block is a connector or API step, pull its last call result from the run history: a silent pending often hides a queued retry after a timeout or a credential that expired since the run started. Fix the connector issue in place, then resume or retry that step from the run controls. Verify: the retried step returns a success result
4. If the block is data, find the empty or invalid field the step validates, usually manager, location, or cost center, correct it in the HR source, and refresh the run data before resuming so later steps use the corrected values everywhere. Verify: the run shows the corrected field values
5. Resume the workflow and walk the remaining steps to completion, confirming the hire ends with directory account, mailbox, key app assignments, and group memberships all present, not merely a green workflow status. Verify: each expected access item is verified in its own system
6. Add monitoring that alerts when any onboarding run stays pending beyond a threshold before the start date, listing the blocking step and owner, so the next stuck hire is found by the system instead of by the hire at the door. Verify: the alert fires on a test run left in pending

Why it happens

Provisioning workflows are chains of dependent steps run over hours or days, and a single wait, an undelivered approval, a connector retry queue, a missing HR field, parks every later step while the overall status innocently reads pending. Because completed early steps make the hire look partly onboarded, the stall is easy to miss until day one. The remedy is always at the first incomplete step: later steps cannot be fixed directly because they were never reached. Step-level alerting converts this silent failure into a visible queue with owners.

Variants and edge cases

Approval stuck with a departed manager

Reassign the task to the acting manager and fix the HR manager value in the same change, otherwise the next workflow for that team stalls identically.

Workflow pending on a scheduled step

Some steps wait for a time relative to start date. If the start date moved earlier, recalculate or manually release the step so access matches the real first day.

Manual task nobody claimed

Hardware or badge tasks assigned to a queue need a named owner per run. Assign the specific task and set queue triage for future runs.

Compatibility: Applies to HR and IT onboarding workflows in platforms such as Okta Workflows, Workday tasks, ServiceNow, and Rippling. Requires workflow admin access for the run.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_TepExoJwarw0GuI5Gi2YxQ