Auto-Provision Google Workspace Accounts for Every New BambooHR Hire
When a new employee is added in BambooHR, this workflow automatically creates their Google Workspace account so they are ready to work on day one. HR managers save hours of manual setup and eliminate provisioning delays.
- 1
Poll BambooHR for New Employees
Add an
HTTP Requestnode set to GET against the BambooHR API endpointhttps://<your-subdomain>.bamboohr.com/api/gateway.php/<your-subdomain>/v1/employees/changed/?since={{$now.minus(1,'hour').toISO()}}. In theAuthenticationfield chooseHeader Authand add your BambooHR API key asAuthorization: Basic <base64(apikey:x)>. Set the node to run on a schedule trigger every hour using n8n's built-in cron. This node detects employees added or updated in the last hour. - 2
Fetch Full Employee Details
Add a second
HTTP Requestnode that callshttps://<your-subdomain>.bamboohr.com/api/gateway.php/<your-subdomain>/v1/employees/{{$json["employeeId"]}}?fields=firstName,lastName,workEmail,department,jobTitle. Use the sameHeader Authcredential. This pulls the complete profile needed to build the Google Workspace account. - 3
Check if a Work Email Already Exists
Add an
IFnode with the condition{{$json["workEmail"]}}is not empty. Route thetruebranch to the next step and leave thefalsebranch empty. This prevents creating accounts for employees who were updated rather than newly hired and who already have an email assigned. - 4
Create the Google Workspace User
Add a
Google Workspacenode (typen8n-nodes-base.googleWorkspace), setResourcetoUserandOperationtoCreate. MapPrimary Emailto{{$json["workEmail"]}},First Nameto{{$json["firstName"]}},Last Nameto{{$json["lastName"]}}, andPasswordto a temporary default such asWelcome2024!(employees will be forced to reset on first login). Connect your Google Workspace OAuth2 credential in theCredentialfield. In node notes, add a reminder to enable theChange Password at Next Logintoggle. - 5
Log the Provisioned Account to Google Sheets
Add a
Google Sheetsnode withOperationset toAppend Row. Point it to a sheet namedProvisioned Accountswith columns Date, Full Name, Email, Department, and Job Title. Map{{$now.toISO()}},{{$json["firstName"]}} {{$json["lastName"]}},{{$json["workEmail"]}},{{$json["department"]}}, and{{$json["jobTitle"]}}to the respective columns. This gives HR a live audit log of every account created.
Frequently asked questions
What if the new employee does not have a work email set in BambooHR yet?
The IF node in step 3 filters out any employee record where the workEmail field is empty, so no account creation is attempted. Once HR adds the work email in BambooHR, the next hourly poll will pick it up and trigger provisioning.
Can I assign the new user to a specific Google Workspace organizational unit automatically?
Yes. In the Google Workspace Create User node, expand the Additional Fields section and set the `Org Unit Path` field. You can use an expression like `/{{$json["department"]}}` to route employees into department-named OUs, as long as those OUs already exist in your Google Admin console.
How do I make the temporary password more secure?
Replace the hardcoded password with a `Set` node placed before the Google Workspace node that generates a random string using the expression `{{$randomString(12)}}`. Pass that value into the Password field and also log it temporarily to Google Sheets so HR can share it securely with the new hire before they log in for the first time.