Showcase: Our workflow for onboarding 50 new hires with Banyan in a day.

We recently faced a significant operational challenge: securely onboarding a cohort of 50 new hires across multiple global offices, granting them immediate, principle-of-least-privilege access to internal tools and data platforms. Our legacy, ticket-based VPN and IAM provisioning process would have taken a week. Using Banyan Security, we completed it in one business day.

The core of our workflow was treating access provisioning as a data pipeline problem. We automated the ingestion of finalized employee data from our HR system (Workday) to create and assign Banyan roles. The key was pre-defining our access templates as Banyan Services with precise trust scores and device requirements.

**Our automated setup involved two primary components:**

1. **A Python script** that transformed the HR extract into Banyan's bulk device enrollment format.
2. **A Terraform configuration** to manage our role-to-service mappings as code, ensuring consistency and auditability.

```hcl
# Example Terraform snippet for defining a role and service access
resource "banyan_service_tunnel" "analytics_platform" {
name = "internal-bi-tool"
description = "Access to the Looker instance"
access_tier = "us-west-2-at"
backend {
target {
name = "looker.internal"
port = 443
}
}
policy {
enabled = true
trust_level = "High"
}
}

resource "banyan_policy_tunnel" "data_analyst_policy" {
name = "data-analyst-base"
description = "Base policy for new data analysts"
access {
roles = ["data-analyst"]
trust_level = "High"
device_posture = ["corporate-managed"]
}
}
```

**The day-of workflow sequence:**
* 0800: Initiated bulk device registration via API using the pre-processed CSV. Invitations were emailed simultaneously.
* 1000: First users began registering devices and completing trust requirements.
* 1300: Monitored enrollment dashboard; followed up with ~5 users who had device compliance issues.
* 1600: 48 of 50 users were fully provisioned and accessing required resources. The two remaining cases were manual exceptions handled separately.

**Critical observations:**
* The **TrustScore** and device posture requirements were essential. We mandated "High" trust (corporate-managed device + MFA) for accessing sensitive data platforms.
* Pre-staging the service definitions and policies as IaC eliminated configuration drift and allowed for pre-validation.
* The main bottleneck was not Banyan, but the state of the user's device (e.g., outdated OS). Clear, pre-onboarding communication is vital.

The result was a zero-trust access state from the user's first hour, with full activity logging. The process is now a repeatable template for any future hiring surge.

— DN