Onboarding

Pre-Onboarding IT Requirements

The pre-onboarding checklist is distributed to the customer administrator 5–7 business days before the onboarding session. Each item must be confirmed complete before the call begins. The most common session failure mode is unresolved conditional access policies — the extended lead time is deliberate.

Onboarding Session Flow — Technical Sequence

Total session time: 60 minutes. PanOps team member + customer administrator. All connector authorizations are completed through the PanOps Onboarding Portal — a web-based interface that manages OAuth redirect flows, validates authorization success, and displays real-time connector status.

OAuth App Registration Requirements

PanOps registers once per platform as an authorized third-party application. These registrations must be completed and approved before any customer onboarding can proceed. Review timelines vary significantly by platform.

Employee Enrollment — Data Model

Employee enrollment is the process by which individual employees are mapped across platforms and provide explicit consent for their communications data to be ingested by PanOps. It runs asynchronously after the onboarding session.

Identity Resolution

Email address is the primary identity key across all platforms. Display name is used as a secondary fallback only. At enrollment, each employee reviews a pre-populated identity mapping (their email and display name as resolved from the directory) and confirms or corrects it. This resolved identity is stored in Aurora and used to attribute all ingested communications to the correct employee record.

Consent Data Logged Per Employee

employee_consent table (Aurora, RLS-scoped to customer tenant)
─────────────────────────────────────────────────────
employee_id          UUID (primary key)
customer_id          UUID (foreign key, RLS tenant)
email                VARCHAR (primary identity key)
display_name         VARCHAR
enrollment_timestamp TIMESTAMPTZ
consent_version      VARCHAR (consent text version)
channels_consented   JSONB (array of channel identifiers)
ip_address           VARCHAR (enrollment device)
user_agent           VARCHAR (enrollment browser)
revoked              BOOLEAN (default false)
revoked_at           TIMESTAMPTZ (nullable)

Enrollment Link Generation

Directory query (M365 Graph API / Google Directory API)
  → Per-employee UUID token generated
  → Enrollment URL: https://app.panops.io/enroll/{uuid}
  → Stored in Aurora with employee_id, customer_id, expiry (7 days)
  → Distributed by customer admin via their preferred method

Post-Onboarding Monitoring

Common Onboarding Issues & Resolutions