How to automatically provision and deprovision PandaDoc accounts

If you’re managing user access for a growing team, you know the drill: a new sales rep starts on Monday, and you have to manually create their account, assign a license, and configure their workspace in PandaDoc. Worse, when someone leaves, you have to remember to immediately revoke their access to prevent data leakage and ensure compliance. 

This constant manual process is a major time sink. Every minute spent creating or deactivating an account is a minute not spent on higher-value IT tasks. More critically, manual offboarding is a significant security risk. A delay of even a few hours can leave sensitive documents exposed.

This guide is designed for IT admins and Operations teams on the PandaDoc Enterprise plan who are ready to leverage BetterCloud to achieve true zero-touch provisioning and deprovisioning.

How to automatically provision PandaDoc accounts

To save your team the drudgery of adding users one by one, we’ll explore the simple steps to automate new PandaDoc account creation and get your users documenting faster.

Step 1: Install the PandaDoc integration into your workspace

First, you’ll need to connect your PandaDoc account to your BetterCloud instance. 

Once you’ve signed in to your PandaDoc account, navigate to settings then integrations then API. Now generate your key and store it securely in an approved secrets manager (e.g., HashiCorp Vault, AWS Secrets Manager, or Azure Key Vault) or a secure enterprise password vault. Do not store this in plain text or a shared document. Then go over to your BetterCloud instance and add the token to your BetterCloud integration as api_token.

Read this Help Center article for more details.

Step 2: Set up a workflow trigger for onboarding

BetterCloud works off of WHEN/IF/THEN logic. WHEN, IF, and THEN statements act as workflow conditions.

When onboarding employees or contractors, you have a multitude of options to trigger your workflow. Common triggers include:

• A User is created in Bamboo HR, Google, Okta, or Workday
• A Google Form is completed from HR
• A ticket is submitted via Zendesk 
• A form is completed through the BetterCloud Self Service Agent

The best workflow trigger is different for every organization. Think about how you currently onboard employees and contractors and go from there. Should the process start from HR? Or should another program kick it off? The choice is yours.

Step 3: Determine what the IF will be

Next you’ll want to determine what your IF statements should be. This is where you can really customize your workflow depending on what department a user is entering or location.

Common IF statements include: IF User’s Department IS ‘Sales’ (to grant PandaDoc access), AND IF User’s Manager IS NOT ‘Contractor Manager’ (to ensure only full-time employees get an immediate license).

Step 4: Add the “Add User to Workspace” action

When adding the “Add User to Workspace” action you’ll need to define the Workspace and email tokens of your respective instance. 

Step 5: Add additional actions for a comprehensive onboarding experience

Leveraging BetterCloud’s extensive library of actions, IT administrators must refine the onboarding workflow to be inclusive of all necessary integrations. This refinement can be structured by:

• Role-Based Access Control (RBAC): Granting specific application access based on the new hire’s job role.
• Departmental access: Assigning application suites based on the user’s assigned department.

This ensures every new hire gets the correct, specific access required for their position.

How to deprovision PandaDoc accounts automatically

Deprovisioning user accounts is a critical security measure and arguably the most important task to automate, as unauthorized access retention poses a significant risk for data exposure and compliance issues. Automating this process ensures that access to sensitive PandaDoc documents is immediately revoked when an employee departs or changes roles.

Step 1: Install the PandaDoc integration into your workspace

Same as provisioning accounts, in order to deprovision accounts, your BetterCloud instance must be connected to your PandaDoc account.

Step 2: Set up a workflow trigger for offboarding

BetterCloud relies on WHEN/IF/THEN logic. The “WHEN” condition is the event that signals a user’s departure and initiates the deprovisioning workflow.

Common triggers for offboarding include:

• A User is Suspended or Deleted in BambooHR, Google, Okta, or Workday
• A Google Form is completed by HR confirming termination
• A ticket is submitted via Zendesk for offboarding
• A specific attribute changes on the user’s profile indicating termination

Select a trigger that is the definitive, authoritative signal of termination within your organization to ensure timely and accurate deprovisioning.

Step 3: Implement Conditional IF Statements for Targeting

The “IF” step allows you to refine the list of users affected by the workflow, ensuring the action is applied only when necessary.

For PandaDoc deprovisioning, useful IF conditions include:

• IF the user currently possesses an active PandaDoc account license.
• IF the user belongs to a group or department targeted for immediate removal.

Step 4: Execute the Core Action: “Remove User from Workspace”

The most crucial step is adding the “Remove User from Workspace” action. You must specify the PandaDoc Workspace and use the email token corresponding to the departing user to successfully revoke their access rights within PandaDoc.

Step 5: Incorporate Comprehensive Offboarding Steps

A complete offboarding experience requires more than just license removal. IT administrators should add supplementary actions to the workflow to manage data and access across other systems:

• Data Ownership Transfer: Automatically transfer ownership of the departing user’s PandaDoc templates and documents to a manager or designated archive account.
• Cross-Platform Deprovisioning: Add subsequent actions to suspend or delete the user’s accounts in other critical applications (e.g., Google Workspace, Salesforce, Slack) based on company policy.

This multi-step approach ensures that the account is not only removed but that corporate data is retained and secured, completing the offboarding lifecycle.

Your next steps to implementing zero-touch provisioning in PandaDoc

The journey to achieving true zero-touch provisioning and deprovisioning in PandaDoc is now clearer. By integrating BetterCloud and leveraging the powerful WHEN/IF/THEN logic, your IT and Operations teams can eliminate the time sink and significant security risks associated with manual user management. Stop wasting valuable time on repetitive tasks and protect your sensitive data with immediate, policy-driven offboarding. Ready to secure your data, free up your IT team, and ensure every employee gets the right access instantly?

Email your CSM to schedule a consultation with a BetterCloud expert and start building your zero-touch workflows today! 

Or not yet a BetterCloud customer? Chat with our team to get started.