Process Documentation and Links

HR Processes

HR Processes

Staff Member Onboarding

Grace HR On.docx

HR Processes

Receiving new hire info from HR

  1. Is the New Hire a volunteer, intern, or staff member?
  2. First Name
  3. Last Name
  4. Job Title
  5. Expected First Day
  6. Expected Orientation Date
  7. Department
  8. Is the new hire working for "All Campuses (30in30)"? Not just one Campus?
  9. Office Campus (Main Location)
  10. Desk Location
  11. Manager
  12. Any funding necessities? This may be Campus, Shared, or 30in30 related.

Administration Processes

Administration Processes

Contract Signature Process

As our Ministries grow, the requests for my signature on contracts have increased and the need to organize/track all contracts for all of our campuses is becoming increasingly difficult. As you may already know, as the Director of Administration for Grace Church, I am the only individual who can legally bind Grace Church into any/all legal agreements.

Therefore, the Finance Team and I have been working to design a user friendly process to simplify obtaining my signature for all contracts.

To Request a Signature on a contract:

For every contract or agreement, please read and review all terms and conditions of the contract and complete a Contract Detail Form which can be located in the Financial Toolbox ​Folder icon HERE.

This new process, while requiring you to read and understand your contract terms, should be very easy for you to use. It should eliminate the need to send Chelsea or myself an email. All you need to do is fill out a form and upload the contract. This new process will be effective immediately. Please let myself or Chelsea know if you have any questions or concerns about the form.


Staff Processes

Staff Processes

New Hire - Onboarding

These steps of adding new hires to our IT resources are recorded and also outlined on the GraceLink proccess page here: People | Grace Church (ccbchurch.com) (Weblinks don't work on GraceLink descriptions currently). Notes can also be added on there as well.


This book helps document the way IT gets new hires setup technology wise, and aims to streamline this process as efficiently and accurately as possible. It is important to keep this book up to date as much as possible since it ties in several sub processes. It gives a list of each sub process of the Hire process and gives links to the pages that describe each sub process more in detail. Each link opens a new tab that you can close once you are done with a sub process.

Prerequisites 

This information we require from HR and the Hiring Manager before doing the Applicant Process: 

Right now, This information can be gathered from a form that HR can fill out here: https://forms.office.com/Pages/DesignPage.aspx?fragment=FormId%3DtmkE-IFaT0am8UrY5KxEih_2uv0Um4BOp9YIP8-5CSFUNVk5RjQ5RjZYN0VKTkZZMlRKN1pWOVM4OC4u

Application Process

These candidates are in the midst of the hiring process. There may be a tentative hire date while they are going through the process.

Applicant

This person is in the application process and will likely be hired.

Create Microsoft Account

We used to create local AD accounts for everyone, but now we are just creating online Azure AD accounts for new hires.

For more information on how to manually create a Microsoft Account on the Office365 admin page click here.

This sub process is going to be automated some by this Microsoft Flow. This flow also adds the some of the non-automated steps as 'tasks' in the Grace IT Group Planner.

Image Laptop

We are currently looking into Microsoft AutoPilot to help us streamline this step more. It is definitely not required, but it helps in accessibility since theoretically all that a staff member needs to do, who is enrolled in AutoPilot, is grab their "new" computer (either from Grace IT or Best Buy, etc), and just sign into their 365 account. And then their profile/stuff is automatically setup/pulled down.

Prepare laptop for use by staff member

Follow this checklist: 
https://forms.office.com/Pages/ResponsePage.aspx?id=tmkE-IFaT0am8UrY5KxEikQWbS9FJylApu8VjjPKnb5UQVhaVTBKMllOVzNGTjA1VExZNUhOWFc5VSQlQCN0PWcu

Create Phone Account

Create phone account if required

Deploy Laptop

Give the laptop to the staff member

Again, we are looking to use AutoPilot to automate some of this.

Orientation

Staff Processes

Change in Staff Member Role

Change Staff Member

Staff Processes

Exit Staff - Entire Process

These steps of exiting staff  are recorded and also outlined on the GraceLink proccess page here: People | Grace Church (ccbchurch.com) (Weblinks don't work on GraceLink descriptions currently). Notes can also be added on there as well.

This book helps document the way IT cleans up the tech for exiting staff, and aims to streamline this process as efficiently and accurately as possible. It is important to keep this book up to date as much as possible since it ties in several sub processes. It gives a list of each sub process of the Exit Staff process and gives links to the pages that describe each sub process more in detail. Each link opens a new tab that you can close once you are done with a sub process.

Exit Staff Member

When a person is marked as "Done", they will be automatically placed into HR's Offboarding "IT Complete" Queue to let them know that IT has finished the off boarding process for this employee.

Archive Exited Staff Member

Cleanup Exited Staff Member

Staff Processes

Account Creation Automation - Flow Pseudo Code

Flow Success Email

To: [Responder's Email]; [Approver Email]

Subject:  365 Account created

Approver: [Approver Name]

Request for [New Hire First Name] [New Hire Last Name]'s account creation was approved! The user's password is: [Generated Password]

Requestors Email: [Responder's Email]

Account was successfully created!

This message was sent automatically using Microsoft Power Automate.

To: [Responder's Email]

Subject: 365 Account Creation Request rejected

Grace Church IT Representative: [Approver name]

Request [ID of response from Form (List of responses)] for [First Name] [Last Name]'s account creation was denied. Reason: [Responses Comments]

This message was sent automatically using Microsoft Power Automate.

Staff Processes

Receiving New Hire Info From Hiring Manager

  1. Need a laptop (Windows, Mac, None)
  2. Need a phone extension?
  3. Need a desk phone?
  4. Need an Adobe CC License?
  5. Need a Docking Station?
  6. Need a monitor?
  7. Are there any Distribution Groups you need them to have access to? 
  8. Are there any (SharePoint) Sites you need them to have access to?
  9. Are there any other miscellaneous systems that you need them to have access to?

Sabbatical

If there is an unlicensed shared mailbox account in O365, but it has a password and the sign-in status is set to allowed it will behave like a normal mailbox, even allowing Outlook to access it

We receive requests to block Staff members for a period of time from accessing their work account / email. They can still work on their laptop if they choose, they just won't be able to receive new email.

Wipe and Return Lease Laptop

You can print out the Return Prep Form and checkmark each step as you clean the laptop

Return Prep Form.docx (sharepoint.com)

Return Prep Form

Lease ____________________________________

Serial # ___________________________________

____Cleaned (Remove from Find Devices on iCloud if applicable) 

____Formatted

____Inspected for Damage

____Photos

____Remove from Lansweeper

____Remove from Teamviewer / AnyDesk

____Remove from End Point Manager & AutoPilot / ABM & Addigy

____Update lease spreadsheet

____Ready for Return

Wipe Methods from KB: Wipe Mac Clean & Reins... | Grace Church KB (gracechurches.org) | Preparing New and Reim... | Grace Church KB (gracechurches.org)

Leases folders to put pictures in: Grace IT - Leases - All Documents (sharepoint.com)

Lansweeper: https://lansweeper.graceohio.org/Assets.aspx

Removing device from Endpoint Manager & Autopliot / ABM : Devices - Microsoft Endpoint Manager admin center | Windows Autopilot devices - Microsoft Endpoint Manager admin center / Apple Business Manager

Lease Spreadsheet: Leased Equipment.xlsx (sharepoint.com)

If you are giving back or releasing a laptop, make sure to delete it from Windows AutoPilot AND Azure AD/Endpoint Manager. Otherwise, the AutoPilot screen will continue to pop up even when you wipe the laptop, preventing the laptop from being able to sign in a non Grace Church user.

If returning a Mac, Apple Financial Services also has this guide to preparing Apple devices for return: Apple Financial Services (yoursolutionspartner.com)

Traveling Internationally

Add and remove people to the "Traveling Internationally" Security Group when they are going outside of North America on a trip. We have a conditional policy setup that blocks any sign in attempts coming from locations outside of the United States, Canada, and Mexico. Adding to the group will let a person bypass the location block set in place from the conditional policy. 

We excluded the DirSync admin account as a backup account so that we aren't locked out of the Tenant.

image.png

Settings are in Azure Conditional Access Policy here: https://portal.azure.com/#blade/Microsoft_AAD_ConditionalAccess/PolicyBlade/policyId/61826f26-b29d-4032-9de7-40c765d588b9/appId//policyName//preConfiguredPolicy/ 

Volunteers

Volunteers

Account Creation

source: Laptop, Licensing, and... | Grace Church KB (gracechurches.org)