Lifecycle & Access Governance
Rehire
Rehires receive correct role-based access instantly, reactivating the right accounts.
Completes when a verified rehire puts the user back with the role, OU and dates you set.
https://mcp.avatier.com/mcp
Ask in Plain Language
Run Rehire from the AI Assistant You Already Use
Same policy, approvals and Justification as the console, with step-up MFA first. One completed rehire = one Secure Outcome; failed attempts are never billed.
You: Rehire Jordan Lee to Finance, starting Monday. Avatier: verify: passed · role: Finance · ou: set · request: recorded
Why it matters
Every Identity and Security Failure Starts with Slow, Inconsistent, or Inaccurate Provisioning.
Script-based IAM is fragile, insecure, non-compliant, and unscalable.
What a rehire needs
The right accounts reactivated, with the correct role-based access, in the right OU, from the rehire date, with a fresh password.
What goes wrong by hand
Without automated reconciliation, access that no longer fits can come back with the account.
Why it matters now
A single, outdated user account can be all it takes for a catastrophic breach.
What per-seat pricing charges
Per-seat IAM charges for every licensed seat, whether anyone is rehired this month or not. Pay Per Identity Action™ charges only for completed rehires.
The Action
How a Rehire Runs
Rehire follows the same pattern as every lifecycle action: select the user, fill in the form, check the summary, submit.
Verify in Avabot
In Avabot, Rehire starts with step-up verification: Security Questions, Google Authenticator, PingID Push or Identity Challenge Card.
Step-up MFA
Select the User
Pick the former employee to rehire.
Set the Dates and OU
Enter the Rehire Date and End Date, and choose the OU to rehire to.
Choose Role and Password
Set the role info and role privileges, and reset the password to a random or a new one.
Check the Summary
Review every choice on the Rehire - Summary screen.
Submit
Submit the request. It is recorded with a Request ID.
Available on Web, Avabot chat and MCP.
Secure Outcome
What Counts as Done
A Secure Outcome is a completed, verified, policy-compliant identity action. A rehire completes when a verified rehire puts the user back with the role, OU and dates you set. One completed rehire = one Secure Outcome.
Evidence
- A Request ID
- Request History with Export
- An LCM summary
Guardrails
Your Assistant Asks. Avatier Decides.
Verified First
Avatier verifies the person before sensitive changes, with the methods your policy already allows.
Same Policy as the Console
Approvals, justification and role rules apply exactly as they do on the web.
Acts as the Signed-In User
OAuth sign-in to your own tenant. No shared service account, no API key to manage.
Never Makes Up Values
The connector only sends what the person actually said, and asks when something is missing.
Every Request Recorded
Requests land in Request History, ready to review and export.
Pay Per Identity Action™
Pay per Completed Rehire
Pay per completed rehire. Failed attempts are never billed.
| Compared | Manual or Per-Seat IAM | Rehire, Pay Per Identity Action™ |
|---|---|---|
| What you pay for | Every licensed seat, whether it acts or not | Completed rehires only |
| Failed attempts | No line between an attempt and a result | Attempts, failures and retries are never billed |
| The work | Manual intervention or tickets | Rehires are reactivated with the right role-based access instantly |
| Evidence | Silent failures and missing audit trails | A Request ID on every request, and Request History with Export |
Pay Per Identity Action™ is in invitation-only preview. Pricing is shared with qualified organizations.
Works with the Systems a Rehire Touches
Avatier connects to 70+ of the world's most widely used HR and payroll systems through a single unified integration, including Workday, SAP SuccessFactors, Oracle Cloud HCM, ADP, UKG, and Dayforce in the enterprise, and Paychex, Paylocity, Paycom, Rippling, TriNet, and Deel across mid-market and global payroll.
- UKG
- Dayforce
- Microsoft 365
- Security Questions
- Identity Challenge Card
- Microsoft
- Active Directory, Entra ID, and Microsoft 365 licensing.
- Step-Up Verification
- Security Questions, Google Authenticator, PingID Push, or Identity Challenge Card.
Avatier MCP
New to Avatier MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
Up and Running in Under a Minute
One URL works in every MCP client. Pick yours, copy, paste, sign in.
Claude
Claude Code
GitHub Copilot
Cursor
Gemini CLI
Frequently Asked Questions
What happens when someone transfers, changes their name, or is rehired?
Avatier automatically updates their profile, applies the correct RBAC entitlements, removes outdated permissions, updates groups, updates email aliases, pushes HR properties downstream, and adjusts Microsoft 365 licensing. Rehires are reactivated with the right role-based access instantly, with no manual intervention or tickets needed.
Is Avatier secure enough for large enterprises or regulated industries?
Absolutely. Avatier applies zero-trust controls, maintains fully auditable identity records, and holds SOC 2 Type II and ISO 27001 certifications. It also helps organizations support requirements and evidence needs associated with NIST, SOX, HIPAA, and GDPR. Every provisioning action is policy-enforced and auditable.
What is AI-driven configuration?
Avatier's AI-driven config turns plain-language intent into working policy. Rather than hand-coding rules, connectors, and roles, administrators describe what they need and Avatier recommends and sets up provisioning rules, role mappings, and workflows, then validates them before they go live. It shortens deployment from months to days and keeps configuration consistent, auditable, and free of custom scripting.
What is Pay Per Identity Action™?
Pay Per Identity Action™ is Avatier's pricing mechanic. Customers pay only for completed, verified, policy-compliant identity actions, called Secure Outcomes.
Is it the same as pay-per-action advertising?
No. Pay per action (PPA) is performance-marketing vocabulary for paying when an ad converts. Pay Per Identity Action™ charges for completed identity work.
How do I get started?
Getting started is free, deployment services are included, and a 45-day money-back guarantee applies. Contact Avatier for pricing for your organization.
What is MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
How is it billed?
Pay Per Identity Action™ is in invitation-only preview: each completed, verified action is one Secure Outcome, and attempts, failures and retries are never billed.
Rehire
You've Automated the System. Now Secure the Lifecycle.
Automation can solve most IT tasks, but identity lifecycle management remains a critical, manual risk.