Birthright access: what does everyone get automatically?

Birthright access is the set of systems every employee should have from day one. Short, clear, almost always the same — and a huge time-saver during onboarding.

A new employee starts on Monday. At 9:00 they're sitting at their laptop. What needs to be working before they've even grabbed their coffee? That answer is your birthright access.

What belongs on the birthright list?

The systems that everyone you hire gets, regardless of role:

\n
• Email account (M365 / Google Workspace with the correct licence)
\n
• Password manager account (1Password / Bitwarden)
\n
• Intranet or company wiki (Notion, Confluence, SharePoint)
\n
• HR system for personal data (holiday days, pay slips)
\n
• Communications (Slack/Teams — same workspace, correct channels)
\n
• Calendar / meeting rooms
\n
• VPN if you use one
\n

What does NOT belong on the birthright list?

Anything that is role-specific. See RBAC for how to define those per role.

And anything that requires a business justification. A new sales hire does NOT automatically get access to payroll data, even if they start on day one.

Why this distinction really matters

\n
• Speed: birthright access can be provisioned automatically on day −1; role-specific access requires manager approval.
\n
• Clarity: everyone knows exactly what should be in place from day one — no more "was I supposed to get that?"
\n
• Audit: you can demonstrate that access was justified, because it is either birthright or approved per role.
\n

Put it in writing

One page on your wiki is enough. Section 1: the birthright list. Section 2: the extras per role. Section 3: the exception procedure.

Review that page every six months. See also periodic access reviews for how this fits into your review cadence.

Tip: you can store birthright and role bundles as AccessProfiles in your access management tool and apply them to a new employee in a single click. Our demo shows this in action.