Automatic Active Directory and Email Account Provisioning

John Landes's picture

UCSF is implementing an automated process to create Active Directory (AD) and email accounts for new staff on their first day employment.

Please Note: The new automated process is only setup to work with and create campus accounts. Medical Center employees and affiliates that need a new AD and email account will need to use the existing process.

Who Will be Impacted?

Hiring Managers

To have the AD and email account created the hiring manager will no longer have to complete an account request form via ServiceNow. The manager will need to ensure that all other access associated with the AD account for the employee is setup; this includes AD groups, file shares, etc. Additionally, if the new employee fails to show up and is not employed by UCSF the manager must ensure that the AD account is made inactive and marked for deletion.

New Employees

The new employee will receive an email to their personal email address that was input into IID\CLS during the hire process. This email will provide instructions to reset their AD account password and enrollment for Active Directory Manager website.

Help and Support Options

If the new employee does not receive the email to complete the new AD and email account process - the hiring manager or service desk can generate the text for a new email.

If the new employee does not have a personal email address on record (in IID \ CLS ) they will not be able to complete the new automated process. They can have their manager or service desk generate a new email.


1. Does the automation process work for Medical Center staff?

No, not currently. The process only works for CAMPUS employees. We will be looking into the requirements and working on incorporating the faculty, postdoctoral fellows and Medical Center later.

2. Does the new employee have to have their personal email address entered into IID\CLS?

Yes, otherwise the system will not be able to send them the email with the instructions to complete the process.

3. What if my new hire does not have an email address or it did not get entered into IID\CLS?

The manager or Service Desk will have a reset web page to get a new temporary password. They can then copy the information and send it to the new employee to complete the process.

4. What if the new hire did not receive the email with the instructions to complete the setup of their AD \ Email account, who can help them?

They should work with their manager or Service Desk, they will use the reset web page to get a new temporary password.

5. Human Resources just processed my new hire today and the employee started today – will the automation process work?

No, the new hire data must be in IID \ CLS at least 24 hours prior to the first day the new hire is scheduled to start work.

6. My new hire started last week – will the process work?

The process will only work if the employee data is entered in advance of the new employee starting.