# Employee IT Provisioning

*/Opportunities/Employee_IT_Provisioning*

## Opportunity Overview

**Wedge**: Begin by targeting remote-first tech companies handling hardware procurement and basic Google Workspace and Slack provisioning. This niche feels acute pain from shipping logistics and rapid onboarding, allowing for fast proof of value through immediate time-savings. Expand by adding deeper role-based access configurations for specialized tools like AWS and Salesforce, eventually extending into continuous compliance monitoring and automated offboarding.
**Timing**: Large Action Models and agentic web-browsing capabilities now allow AI to navigate disparate, non-API legacy SaaS portals to configure permissions. Additionally, zero-touch device enrollment APIs from Apple and Microsoft are mature enough to allow software agents to trigger physical hardware shipments directly from distributors.
**Why This I C P**: Mid-market companies experience high enough hiring and turnover volume to break manual spreadsheet-based processes, but lack the resources to build custom integrations or hire dedicated provisioning personnel. They rely heavily on fragmented SaaS stacks rather than unified legacy on-premise infrastructure, making cloud-to-cloud automation highly effective.
**Size Of Prize**: There are approximately 100,000 mid-market companies in the US and Europe with 500 to 5,000 employees. At an average annual IT labor and external MSP spend of $30,000 per company dedicated strictly to routine onboarding and offboarding tasks, the addressable labor replacement prize is roughly $3B annually.
**Gap Narrative**: Mid-market IT teams manually bridge HR systems and SaaS directories to provision access, order hardware, and configure environments for new hires. Existing identity providers handle Single Sign-On but leave the actual procurement, asset tracking, and role-based app configuration to manual ticketing. These teams require a system that translates a new HR record into a fully shipped laptop and provisioned software suite without human routing.
**Defensibility**: Defensibility relies heavily on workflow lock-in and deep integration gravity. Once the system becomes the connective tissue between the HRIS, the Identity Provider, and the hardware supply chain, ripping it out requires rebuilding manual processes across multiple departments. Proprietary data advantages are minimal, but the switching costs compound as more departmental apps are tethered to the platforms provisioning logic.
**Why This Thesis**: A Service-as-Software approach directly absorbs the IT helpdesk ticket queue. Instead of selling a workflow builder that IT must configure, this model consumes the HR trigger and delivers the completed provisioning as a managed service, perfectly matching the ICPs desire to offload headcount rather than buy another tool to manage.

## Opportunity Linked Thesis

**Thesis**: [Service-as-Software](/Theses/Service-as-Software)

## Opportunity Linked I C P

**Icp**: [Technology Startup](/CompanyTypes/Technology_Startup)

## Opportunity Market Sizing

_Illustrative — target and order-of-magnitude estimate figures, not an achieved track record (this Thing is concept-stage)._

**S A M**: ~$1B-1.5B US and European tech startups with 50-500 employees
**S O M**: ~$30M-50M
**T A M**: ~100k-150k global tech startups x ~$25k-35k/yr = ~$2.5B-5.2B
**Growth Rate**: ~15-20%/yr, driven by remote workforce distribution and continuous SaaS application sprawl requiring automated access controls
**Paid Comparable Spend**: ~$15k-30k/yr on outsourced MSP retainers, fragmented MDM licenses, and diverted internal engineering time for manual account creation

## Opportunity Incumbents

- [Rippling IT](/Products/Rippling_IT) — Tool
- [Electric IT](/Products/Electric_IT) — Service
- [Asset Tracking Spreadsheets](/Products/Asset_Tracking_Spreadsheets) — Spreadsheet
- [Jamf Pro](/Products/Jamf_Pro) — Tool
- [Firstbase Remote IT](/Products/Firstbase_Remote_IT) — Service
- [Okta Lifecycle Management](/Products/Okta_Lifecycle_Management) — Tool
- [Microsoft Intune](/Products/Microsoft_Intune) — Tool

## Opportunity Win Conditions

**Kill Thresholds**:
- Manual override rate exceeds 25 percent of all provisioning events
- Sales cycles for 100-person companies stretch beyond 45 days
- Less than 30 percent of activated accounts provision a second employee within 30 days
- Willingness to pay caps at $5 per user per month
**Leading Metrics**:
- Time from HR record creation to active device enrollment (minutes)
- Percentage of automated software license allocations without IT intervention
- Average SaaS applications automatically provisioned per new hire
- Manual override rate for role-based access controls
**What Proves Right**: Users connect their HR system and successfully provision a secure laptop and 10 core SaaS accounts without writing custom scripts. Cohorts of companies with 50 to 200 employees retain at 90 percent over 12 months because the platform eliminates IT onboarding tickets. Price points of $20 per user per month stick when the system demonstrably reclaims at least 10 hours of engineering time per new hire.
**What Proves Wrong**: Onboarding fails because target customers require highly customized access control lists that standard role mapping cannot handle. Users revert to spreadsheets and outsourced MSPs when hardware shipping exceptions require manual intervention. The bet is invalid if companies refuse to pay more than basic MDM license costs, treating automated provisioning as a minor feature rather than a core platform.

## Opportunity Build Profile

**Hardest Part**: Maintaining the deterministic state machine that handles partial failures, rate limits, and rollback sequences across dozens of brittle third-party SaaS APIs during a single user creation event.
**Min Viable Scope**: Restrict v1 to automated account creation and role assignment for software engineering tools via Google Workspace and GitHub. Exclude hardware procurement, laptop MDM enrollment, software offboarding, and physical access badge generation.
**Cold Start Problem**: Delivering a comprehensive integration catalog requires live enterprise accounts to test edge cases and API quirks. Break this by targeting early-stage engineering teams to access their core Google Workspace, Slack, and GitHub environments as design partners.
**Time To First Value**: 1 onboarding cycle to trigger the first automated software provisioning flow
**Data Moat Available**: false
**Technical Difficulty**: Moderate

## Neighborhood

### Embodied by

- [Agent](/Theses/Agent) — embodies · Theses

### Applies thesis

- [Technology Startup](/CompanyTypes/Technology_Startup) — applies thesis · CompanyTypes

### Incumbent in

- [Asset Tracking Spreadsheets](/Products/Asset_Tracking_Spreadsheets) — incumbent in · Products
- [Electric IT](/Products/Electric_IT) — incumbent in · Products
- [Firstbase Remote IT](/Products/Firstbase_Remote_IT) — incumbent in · Products
- [Jamf Pro](/Products/Jamf_Pro) — incumbent in · Products
- [Microsoft Intune](/Products/Microsoft_Intune) — incumbent in · Products
- [Okta Lifecycle Management](/Products/Okta_Lifecycle_Management) — incumbent in · Products
- [Rippling IT](/Products/Rippling_IT) — incumbent in · Products

### Embodies

- [Service-as-Software](/Theses/Service-as-Software) — embodies · Theses

### Similar Opportunities

- [Day-One Provisioning Agent](/Opportunities/Day-One_Provisioning_Agent) — similar · Opportunities
- [Automated Onboarding Agency](/Opportunities/Automated_Onboarding_Agency) — similar · Opportunities
- [Onboarding Orchestration Agent](/Opportunities/Onboarding_Orchestration_Agent) — similar · Opportunities
- [Autonomous Deprovisioning for IT](/Opportunities/Autonomous_Deprovisioning_for_IT) — similar · Opportunities
- [Identity Lifecycle Automation](/Opportunities/Identity_Lifecycle_Automation) — similar · Opportunities
- [Autonomous Provisioning for Enterprise IT](/Opportunities/Autonomous_Provisioning_for_Enterprise_IT) — similar · Opportunities
- [Managed Auth Operations](/Opportunities/Managed_Auth_Operations) — similar · Opportunities
- [Automated Triage for IT](/Opportunities/Automated_Triage_for_IT) — similar · Opportunities
- [Velocity Desk](/Opportunities/Velocity_Desk) — similar · Opportunities
- [Autonomous L1 Responder](/Opportunities/Autonomous_L1_Responder) — similar · Opportunities
- [Shared Services Resolver](/Industries/Management_of_Companies_and_Enterprises/Opportunities/Shared_Services_Resolver) — similar · Opportunities
- [Autonomous Task Runner](/Opportunities/Autonomous_Task_Runner) — similar · Opportunities
- [Zero-Touch De-Provisioning for HR](/Opportunities/Zero-Touch_De-Provisioning_for_HR) — similar · Opportunities
- [Autonomous Sourcing for IT](/Opportunities/Autonomous_Sourcing_for_IT) — similar · Opportunities
- [Vendor Onboarding Service](/Opportunities/Vendor_Onboarding_Service) — similar · Opportunities
- [Procurement as a Service](/Opportunities/Procurement_as_a_Service) — similar · Opportunities
- [AI Onboarding Concierge](/Opportunities/AI_Onboarding_Concierge) — similar · Opportunities
- [Attrition Arbitrage](/Opportunities/Attrition_Arbitrage) — similar · Opportunities
- [Predictive Role Mining for Security](/Opportunities/Predictive_Role_Mining_for_Security) — similar · Opportunities
- [Vendor Onboarding as a Service](/Opportunities/Vendor_Onboarding_as_a_Service) — similar · Opportunities