--- title: "Stop Impersonation: Verify Identity at Onboarding" description: "Prevent impersonation by verifying identity during onboarding. Why identity proofing must happen before provisioning access to new hires." canonical: "https://adamtheautomator.com/identity-verification-onboarding/" --- # Stop Impersonation: Verify Identity at Onboarding > Prevent impersonation by verifying identity during onboarding. Why identity proofing must happen before provisioning access to new hires. Source: https://adamtheautomator.com/identity-verification-onboarding/ --- ATA Learning Tap to hide [ ATA Learning ](/) * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Search for: * [](https://twitter.com/adbertram) * [](https://github.com/Adam-the-Automator) * [](https://www.linkedin.com/company/adam-the-automator-llc) * [](/feed/) ![Stop Impersonation: Verify Identity at Onboarding](https://adamtheautomator.com/wp-content/uploads/publisher/3f35d9c85b2b812193d4cc7a6d4be13d/1daf00385836df44b470b450d81ec18105c2ccff55f54f2fd2f72592fca6e34c.png) # Stop Impersonation: Verify Identity at Onboarding [![](https://secure.gravatar.com/avatar/d0b9d42e21e5622713f8b693aa5c0f9244d5f7dd200ed29b8398f52dee5de337?s=192&d=mm&r=g)Adam Bertram](https://adamtheautomator.com/author/adam-bertram/)21 October 20264 min. read Categories: [Information Security](/category/infosec/) Tags:[Security](/tag/security/)[Active Directory](/tag/active-directory/)[Microsoft Entra](/tag/microsoft-entra/)[Microsoft 365](/tag/microsoft-365/)[Sponsored](/tag/sponsored/) Table of Contents * [The Identity Proofing Problem](#the-identity-proofing-problem) * [Why Account Creation and Identity Verification Are Different Problems](#why-account-creation-and-identity-verification-are-different-problems) * [AI Is Eroding the Signals We Used to Trust](#ai-is-eroding-the-signals-we-used-to-trust) * [The Moments Identity Matters Most During Onboarding](#the-moments-identity-matters-most-during-onboarding) * [Before Day One: Who Receives the Credential?](#before-day-one-who-receives-the-credential) * [On Day One: Is the Right Person Activating the Account?](#on-day-one-is-the-right-person-activating-the-account) * [After Day One: Can the Service Desk Verify the Caller?](#after-day-one-can-the-service-desk-verify-the-caller) * [Provision Access Only After You’ve Established Who Is Receiving It](#provision-access-only-after-youve-established-who-is-receiving-it) * [How Specops Secure Onboarding Covers Each Checkpoint](#how-specops-secure-onboarding-covers-each-checkpoint) Suppose your onboarding automation runs perfectly for a new hire’s first day: the account exists with the right licenses, and the activation link goes out on schedule. Now suppose the person who clicks that link isn’t the person you hired, and nothing in your process would ever flag it. If that happened, your [secure onboarding](https://specopssoft.com/blog/guide-secure-employee-onboarding-in-2026/?utm_source=adamtheautomator&utm_medium=referral&utm_campaign=adamtheautomator_referral_na&utm_content=article) process would have confirmed that the identity was provisioned correctly without ever confirming that it reached the right person. And if impersonation keeps getting cheaper to produce and harder to spot, that unverified handoff is where an attacker would start. ## The Identity Proofing Problem Provisioning creates the account and decides what it can access; it never asks whether the right person is holding that access. The National Institute of Standards and Technology (NIST) [guideline SP 800-63A](https://pages.nist.gov/800-63-4/sp800-63a.html?utm_source=adamtheautomator&utm_medium=referral&utm_campaign=adamtheautomator_referral_na&utm_content=article) describes identity proofing’s intent as making sure the applicant “is who they claim to be to a stated level of confidence.” Say your [PowerShell onboarding script](https://www.anrdoezrs.net/links/7627660/type/dlg/sid/ata-ps-active-directory-administration-with-powershell/https://www.pluralsight.com/search?q=Active%20Directory%20Administration%20with%20PowerShell) creates a new hire’s Active Directory account, populates every required attribute, assigns the correct Microsoft 365 license, adds the account to the right groups, and triggers downstream provisioning for other applications. Every step completes successfully, so from a provisioning standpoint, it’s a successful onboarding. But if the person logging into that account isn’t the person you hired, you have a problem the provisioning process will never surface. The process did exactly what it was designed to do. It provisioned the wrong person very efficiently. The diagram below puts every check the script passed next to the one question left unanswered. ![Provisioning vs identity](https://adamtheautomator.com/wp-content/uploads/publisher/56a98a37861c9dcd22d6323bc0f333ec63671970ffcdc9fd3f4db0a20177c22e.jpg) ### Why Account Creation and Identity Verification Are Different Problems You’ve already solved account creation: scripts, templates, and IT service management (ITSM) workflows reliably stand up the right account with the right entitlements. [Identity verification is a separate discipline](https://www.anrdoezrs.net/links/7627660/type/dlg/sid/ata-ps-sc-300-microsoft-identity-and-access-administrator-cou/https://www.pluralsight.com/search?q=SC-300%3A%20Microsoft%20Identity%20and%20Access%20Administrator%20Course) entirely, and treating “the account was created correctly” as proof that “the right person received it” is the gap attackers now exploit. ## AI Is Eroding the Signals We Used to Trust Recruitment checks, video calls, personal information, and identity documents have long been used to confirm identity. Each of those signals can be faked, and you need to decide whether any one of them still gives you enough confidence. Generative AI makes it easier to create or manipulate the things people instinctively rely on to establish trust, and it’s now affecting hiring. In 2024, [KnowBe4 disclosed](https://blog.knowbe4.com/how-a-north-korean-fake-it-worker-tried-to-infiltrate-us?utm_source=adamtheautomator&utm_medium=referral&utm_campaign=adamtheautomator_referral_na&utm_content=article) that it had hired someone who turned out to be a North Korean fake IT worker. Before the hire, the company: * Ran background checks * Verified references * Conducted four video interviews The individual had used a stolen identity and AI-assisted imagery to make that identity hold up under scrutiny. KnowBe4 caught the deception before the worker could compromise any data, but the disclosure highlights something unsettling: several familiar verification checks can all produce reassuring results while the underlying identity is still false. In January 2025, [the FBI warned](https://www.fbi.gov/investigate/cyber/alerts/2025/north-korean-it-workers-conducting-data-extortion?utm_source=adamtheautomator&utm_medium=referral&utm_campaign=adamtheautomator_referral_na&utm_content=article) that North Korean IT workers were obtaining remote employment under false identities, the same risk sitting in your own hiring pipeline. The guidance specifically noted that AI and face-swapping technology had been observed during video job interviews. * * * _**Reality Check: Background checks, reference calls, and video interviews were designed for a world where faking all three at once was impractical. That assumption no longer holds.**_ * * * ## The Moments Identity Matters Most During Onboarding Identity proofing keeps mattering after the offer letter is signed, at three distinct points that the timeline below lays out. ![Three identity checkpoints](https://adamtheautomator.com/wp-content/uploads/publisher/e68b0ce15d10da41d5f63eec7458488ba1c1f92f9fa52342532cedd772c8d09f.jpg) ### Before Day One: Who Receives the Credential? If you create a temporary password and send it to the new hire, you’re trusting that the credential reaches the intended employee. That creates an identity handoff risk: an attacker who can intercept or already has access to the employee’s email, phone, or onboarding communications may receive the credential first. Letting new hires set their own password removes that handoff, because you never hold the credential. Before you change any tooling, list every channel a first-day credential travels through today, like a manager’s forwarded email or a text to a personal phone. ### On Day One: Is the Right Person Activating the Account? By the first day, the employee may already have an account, licenses, and application access waiting. You still need confidence that the person activating those resources is the person named in the employee record. This matters most for remote onboarding, where face-to-face identity checks may never happen at all. For remote hires, decide what the first login has to prove beyond knowing the password. * * * _**Reality Check: For a fully remote hire, that first login may be the only moment anyone could check a face against the employee record.**_ * * * ### After Day One: Can the Service Desk Verify the Caller? Attackers also target the service desk with routine requests like password resets or account unlocks. Your service desk agents need a verification step that runs before any sensitive support action, because a voice or message that sounds right is exactly what an AI-assisted impersonator can produce. The [FBI’s January 2025 public service announcement](https://www.fbi.gov/investigate/cyber/alerts/2025/north-korean-it-workers-conducting-data-extortion?utm_source=adamtheautomator&utm_medium=referral&utm_campaign=adamtheautomator_referral_na&utm_content=article) on North Korean IT workers tells employers to “Implement identity-verification processes during interviewing, onboarding, and throughout the employment of any remote worker.” Pull your last few password-reset tickets and check what the agent verified before acting. If it was details anyone could find on LinkedIn or in a phished inbox, like an employee ID or a manager’s name, an attacker could have passed the same check. ## Provision Access Only After You’ve Established Who Is Receiving It Your onboarding process shouldn’t hinge on whether a temporary password stayed in the right inbox, or on a service-desk agent’s gut call about whether a caller sounds legitimate. ### How Specops Secure Onboarding Covers Each Checkpoint Verifying the person before handing over access is the gap [Specops Secure Onboarding](https://specopssoft.com/product/specops-secure-onboarding/?utm_source=adamtheautomator&utm_medium=referral&utm_campaign=adamtheautomator_referral_na&utm_content=article) is designed to close. It provides assurance at each key moment of the identity lifecycle: * Before the first day, new hires get a secure link to create their own Active Directory password, removing the risk of a temporary shared password being intercepted in transit. * On the first day, you can verify a new starter’s identity before first login through [biometric liveness detection](https://specopssoft.com/blog/biometric-liveness-detection-identity-security/?utm_source=adamtheautomator&utm_medium=referral&utm_campaign=adamtheautomator_referral_na&utm_content=article) and government ID scanning, reducing the risk of impersonation at activation. * When a new hire needs service-desk support, an agent can require identity verification before carrying out sensitive actions like password resets or account unlocks. Each of those checks confirms the person at one of the three checkpoints, before the account extends any trust. If you’re looking to secure your onboarding process against AI-powered impersonation threats, [book a demo with Specops today](https://specopssoft.com/contact-us/?utm_source=adamtheautomator&utm_medium=referral&utm_campaign=adamtheautomator_referral_na&utm_content=article) to see how its solutions can help. Share this article [Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fidentity-verification-onboarding%2F&text=Stop%20Impersonation%3A%20Verify%20Identity%20at%20Onboarding)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fidentity-verification-onboarding%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fidentity-verification-onboarding%2F) ## Related Posts ![](https://adamtheautomator.com/wp-content/uploads/2026/08/featured_image.webp) ### [Entra PIM vs. Delinea vs. CyberArk: Don’t Buy the Wrong PAM](/entra-pim-vs-delinea-cyberark/) Entra PIM grants roles; Delinea and CyberArk vault credentials. Compare scope, session recording, audit evidence, and three-year cost. ![](https://adamtheautomator.com/wp-content/uploads/2026/07/featured_image-2.png) ### [Deploy PAWs with Microsoft Entra PIM](/deploy-paws-microsoft-entra-pim/) Harden privileged access by pairing Microsoft Entra PIM with PAWs, Intune compliance, and Conditional Access so admin roles activate only from trusted devices. ![](https://adamtheautomator.com/wp-content/uploads/2026/04/featured_image.webp) ### [7 Tips for an Efficient and Secure Active Directory Setup](/active-directory-setup-tips/) Learn 7 essential best practices for setting up an efficient and secure Active Directory environment, from planning your structure and applying least-privilege ## Categories * [IT Ops](/category/it-ops/) * [Cloud](/category/cloud/) * [DevOps](/category/devops/) * [Home Ops](/category/home-ops/) * [Information Security](/category/infosec/) * [Software Development](/category/software-development/) ## Site * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)