Lifecycle & Access Governance
Rehire
Rehires get their existing accounts back, re-enabled in the right OU with the dates you set.
Completes when an approved rehire re-enables the person's existing account with the OU, dates and password you set.
https://mcp.avatier.com/mcp
Ask in Plain Language
Run Rehire from the AI Assistant You Already Use
Same policy, approvals and Justification as the web app, with identity verification first in Avabot and MCP. One completed rehire = one Secure Outcome; failed attempts are never billed.
You: Rehire jlee starting Monday, no expiry date. Justification: returning to the Finance team. Avatier: verify: passed · start: Monday · expiry: never · request: submitted, may need approval
Why it matters
Every Identity and Security Failure Starts with Slow, Inconsistent, or Inaccurate Provisioning.
Script-based IAM is fragile, insecure, non-compliant, and unscalable.
What a rehire needs
The person's existing account re-enabled, with its linked accounts, in the right OU, from the rehire date, with an end date and a fresh password when you want one.
What goes wrong by hand
Turning an old account back on by hand leaves the OU, the dates, the password and the approval to memory, with no request on the record.
Why it matters now
A single, outdated user account can be all it takes for a catastrophic breach.
What per-seat pricing charges
Per-seat IAM charges for every licensed seat, whether anyone is rehired this month or not. Pay Per Identity Action™ charges only for completed rehires.
The Action
How a Rehire Runs
On the web, Rehire walks through these screens. In Avabot and MCP you verify first, then give the start date, expiry and justification.
Verify in Avabot or MCP
Avabot and MCP only. Rehire starts with identity verification in the conversation, with the methods your policy already allows, such as Security Questions, Google Authenticator, PingID Push or Identity Challenge Card. A verification earlier in the same conversation carries over.
Identity Verification (Avabot and MCP)
Select the User
On "Select user you wish to rehire", pick the connector and search for the former employee. Workflow admins are then asked "Would you like to use workflow?"
Set the Dates and Justification
Choose Rehire Now, a date and time, or in a number of days, hours or minutes. Set Account Expiration to Never or a date, and enter a Justification. An admin acting without workflow sets only Account Expiration, and the rehire runs at once.
Choose the Password
On the User Password screen, optionally tick Reset Password and choose "Create a Random Password" or "Create your own password". "User must change password at next logon" applies to Windows and some LDAP accounts.
Choose the OU
On "Organizational Unit (OU) To Which User Shall Be Rehired", pick Current OU, Prior OU, Default or a searched OU.
Check the Summary
Review User Info, Start Date, End Date, Reset Password and Rehire to OU on the Rehire User Final Result screen, and export it to Excel or PDF.
Submit
Choose Submit Request and confirm. The request is recorded in Request History with a Request ID and goes through the Rehire User approval workflow. A workflow admin who chooses not to use workflow is recorded as the approver, and the rehire runs at once.
Approval point
Available on Web, Mobile, Teams, Avabot chat and MCP.
Avabot chat and MCP require the current (.NET 10) Avatier server.
In Avabot chat and MCP, Rehire sets the start date, expiry and justification only: there is no password reset or OU choice, the account stays in its current OU, and the request always goes through workflow.
Secure Outcome
What Counts as Done
A Secure Outcome is a completed, verified, policy-compliant identity action. A rehire completes when the approved request runs: the existing account is re-enabled on its directory and linked systems, given its new expiration date if you set one, its password reset if you chose to, moved to the chosen OU, and its recorded manager restored. One completed rehire = one Secure Outcome.
Evidence
- A Request ID in Request History (exportable)
- An activity-log entry
- Request emails
- The Rehire User Final Result summary (Excel or PDF, on the web)
Guardrails
Your Assistant Asks. Avatier Decides.
Verified First
Avatier verifies the person before sensitive changes, with the methods your policy already allows.
Acts as the Signed-In User
OAuth sign-in to your own tenant. No shared service account, no API key to manage.
Never Makes Up Values
The connector only sends what the person actually said, and asks when something is missing.
Every Request Recorded
Requests land in Request History, ready to review and export.
Pay Per Identity Action™
Pay per Completed Rehire
Pay per completed rehire. Failed attempts are never billed.
| Compared | Manual or Per-Seat IAM | Rehire, Pay Per Identity Action™ |
|---|---|---|
| What you pay for | Every licensed seat, whether it acts or not | Completed rehires only |
| Failed attempts | No line between an attempt and a result | Attempts, failures and retries are never billed |
| The work | Manual intervention or tickets | Once approved, the existing account is re-enabled with the OU, dates and password you set |
| Evidence | Silent failures and missing audit trails | A Request ID in Request History, an activity-log entry and request emails |
Pay Per Identity Action™ is in invitation-only preview. Pricing is shared with qualified organizations.
Works with the Systems a Rehire Touches
Rehire works on the person's existing directory account, in Active Directory (including the OU move) or LDAP, plus the linked accounts on connected systems that your account enable settings cover.
- LDAP
- Microsoft
- Active Directory, including the move to the chosen OU.
- Linked Accounts
- Linked accounts on connected systems, as your account enable settings cover them.
Avatier MCP
New to Avatier MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
Up and Running in Under a Minute
One URL works in every MCP client. Pick yours, copy, paste, sign in.
Microsoft Copilot Studio
Claude Code
OpenAI Codex
Cursor
Frequently Asked Questions
Can we rehire someone whose account was deleted?
No. Rehire re-enables the account the person already has. A deleted account can't be found, so create a new account instead.
Does Rehire give the person their old role or access back?
Not by itself. It re-enables the account and sets the dates, password and OU. Access is requested separately, with Request Role or Request Access, or assigned by HR-feed rehire rules.
Can the rehire start on a future date?
Yes. On the web, pick a date and time, or a number of days, hours or minutes, when you submit through workflow. In Avabot, give a date. An admin who skips workflow rehires immediately.
Is Avatier secure enough for large enterprises or regulated industries?
Absolutely. Avatier applies zero-trust controls, maintains fully auditable identity records, and holds SOC 2 Type II and ISO 27001 certifications. It also helps organizations support requirements and evidence needs associated with NIST, SOX, HIPAA, and GDPR. Every provisioning action is policy-enforced and auditable.
What is AI-driven configuration?
Avatier's AI-driven config turns plain-language intent into working policy. Rather than hand-coding rules, connectors, and roles, administrators describe what they need and Avatier recommends and sets up provisioning rules, role mappings, and workflows, then validates them before they go live. It shortens deployment from months to days and keeps configuration consistent, auditable, and free of custom scripting.
What is Pay Per Identity Action™?
Pay Per Identity Action™ is Avatier's pricing mechanic. Customers pay only for completed, verified, policy-compliant identity actions, called Secure Outcomes.
Is it the same as pay-per-action advertising?
No. Pay per action (PPA) is performance-marketing vocabulary for paying when an ad converts. Pay Per Identity Action™ charges for completed identity work.
How do I get started?
Getting started is free, deployment services are included, and a 45-day money-back guarantee applies. Contact Avatier for pricing for your organization.
What is MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
How is it billed?
Pay Per Identity Action™ is in invitation-only preview: each completed, verified action is one Secure Outcome, and attempts, failures and retries are never billed.
Rehire
You've Automated the System. Now Secure the Lifecycle.
Automation can solve most IT tasks, but identity lifecycle management remains a critical, manual risk.