Intro

Lucca will not create or remove the SaaS accounts used by your employees your people actually use. It runs the HR side of every joiner and leaver (the employee record, the documents, the onboarding checklist), but it never opens a Jira, Figma, or Notion to create accounts and set permissions. That still falls to whoever owns IT.

That leaves you with a recurring headache. A new product manager starts Monday, and someone spends the morning clicking through admin consoles to set up each tool by hand. When they leave, the same work runs in reverse, one console at a time, except this time you hope you revoke all the tools. Past 50 or so people, doing this by hand stops being viable.

You can automate provisioning in Lucca in two main ways. Route Lucca through API connectors that you set up yourself (which requires technical setup and ongoing maintenance). Or connect an access management tool on Lucca's integration marketplace, like AccessOwl, that automates provisioning to 400+ apps without SCIM required.

In this blog:

• Native SaaS provisioning features with Lucca alone

• Adding SaaS provisioning automation to Lucca with AccessOwl

• SaaS provisioning with Lucca and DIY workflows (scripts, its open API, spreadsheets)

Comparing each provisioning method

Method 1 - SaaS provisioning with Lucca alone

What Lucca handles on its own

Lucca pitches its onboarding as orchestration. A 'conductors baton' for joiners and leavers. On the HR side it delivers. Through Poplee Core HR and its Workelo tooling it collects documents, handles e-signatures, sends templated welcome emails, and keeps one central employee record.

Does Lucca have an IT module to automate SaaS provisioning?

Lucca does not provision apps itself and it points customers to a dedicated tool to do it. AccessOwl is listed in Lucca's marketplace as a tool to provisions and deprovision access across applications.

There is no Lucca IT product or access management add-on. Its single sign-on logs people into Lucca with a Google or Microsoft account, which is login only, not provisioning. It does not create or delete Google Workspace or Microsoft 365 accounts, and it does not use SCIM or SAML to reach your other apps.

Why teams add a dedicated access management tool on top of Lucca

With an HR system alone onboarding and offboarding usually end ups partially automated. Creating and removing accounts across your third-party apps is still left to you and that blocka the smooth start you set up everywhere else. From conversations with our own customers, teams reach for an access management tool when they want to extend that automation.

This tends to happen when you are growing fast, run a SaaS-heavy stack, or have no IT team so account creation lands on a non-technical person whose time it drains. Motion hit this while scaling and chose AccessOwl over the SCIM and SAML route (hear how Motion handles it):

"I was impressed that with AccessOwl I could grant users access and programmatically provision their accounts without having to upgrade to the enterprise tier of the company's applications. Other solutions I'd investigated worked only with specific APIs (SCIM and/or SAML), which would often require enterprise upgrades."

Ethan Yu, Cofounder and COO, Motion

Method 2 - Automating SaaS Provisioning with Lucca + AccessOwl

AccessOwl sits on top of Lucca to handle access management for SaaS onboarding, offboarding, and access controls.

A mature access management setup keeps three systems in sync: Lucca as the HRIS, Google Workspace or Microsoft 365 as the IdP, and every third-party app your team touches. Access comes from templates instead of someone wiring up each new hire, and every grant, approval, and removal is recorded in one place rather than buried in tickets and spreadsheets.

Here is what AccessOwl adds:

• A start, role change, or end date in Lucca is the trigger, so joiners, movers, and leavers all fire on their own.

• Access follows attribute-based templates (role, team, department, entity), adjustable per person.

• People request and approve in Slack or the dashboard, and self-serve what they can.

• Onboarding lands in minutes. offboarding is one click or zero-touch.

• Every action is logged as it happens, so an access review is evidence you already hold.

• You see who has access to what in one view.

• Shadow IT discovery that Lucca and your IdP never catch shows up.

What onboarding and offboarding looks like with Lucca + AccessOwl

Onboarding, start to finish:

1. Lucca says a product manager starts Monday.

2. AccessOwl loads the access template for that role: Jira, Figma, Notion, Amplitude, and the product Slack channels.

3. The relevant managers approve with one click in Slack.

4. AccessOwl provisions each app through its own connected integration, so no one on your team opens an admin console. Every action is logged for audit evidence later.

During offboarding AccessOwl removes the person's licenses across their apps and reassigns their owned assets to their manager. AccessOwl runs a Shadow IT scan that catches apps your IT team may not have known about, including free accounts and username-and-password logins that sit outside SSO. A 2023 Gartner prediction put it at 75% of employees acquiring or creating technology outside IT's visibility by 2027, up from 41% in 2022 (Gartner, 2023).

FinCompare, a 50-person fintech, once had paid software licenses go uncancelled for months after people left, because the manual handoff between admins broke down. With AccessOwl offboarding is a single click (FinCompare customer story).

"The biggest advantage is the documentation that allows an easy offboarding of employees. It's a single click and every stakeholder gets the information they need."

Robert Pötzsch, Office Manager, FinCompare

How AccessOwl integrates with Lucca (and Google Workspace or Microsoft 365)

Lucca stays your source of truth for joiners, movers, and leavers. AccessOwl reads those events and works alongside your existing Google Workspace or Microsoft 365, and Okta too if you run it, rather than replacing any of them. AccessOwl has native integrations with Google Workspace, Microsoft 365, and Okta, and it is an access-automation tool listed in Lucca's own marketplace.

What access review compliance looks like with Lucca + AccessOwl

Because every grant, approval, and removal is logged, an access review for SOC 2 or ISO 27001 becomes a report you pull, not a spreadsheet you build. Instead of exporting a user list from each app, screenshotting the ones with no export, and pasting it all together, you have one record of who has access to what and how they got it. In practice that takes a review from around 2 hours per app down to about 10 minutes per app (detailed guide to SOC 2 access reviews).

Method 3 - SaaS provisioning with Lucca + DIY automation

Another route teams on Lucca can take is to layer do-it-yourself automation on top. If you have technical people they might own this: tickets in Jira or Linear, spreadsheets, or scripts against Lucca's API.

Lucca helps you here more than most HR tools do, because it has a genuinely open, well-documented public API (OAuth2), so a build is more feasible than on tools that gate their API. Microsoft shops often lean on PowerShell, Google shops on GAM (Google Apps Manager), wiring the APIs themselves.

Under 30 people or 5 third-party apps this can work if someone technical owns it. Where the cracks become clear is during offboarding. A script that does not cover an app leaves that access open, and no one notices until an audit or an incident does.

FAQs

Does Lucca offer features to automate provisioning of SaaS apps to automate onboarding and offboarding?

Not natively. To automate provisioning you have two options: Connect an access management tool from Lucca integration marketplace, like AccessOwl, that layers on top of Lucca itself to provisions and derovsion across 400+ apps with no SCIM required. Alternatively, you can manually set up connectors via APIs that can create accounts, delete accounts, and pull user lists.

If I'm using Lucca, why use AccessOwl over Okta?

If you have not rolled out Okta yet, AccessOwl gives you the onboarding, offboarding, and access control you were after for a fraction of the cost and is live in days rather than a months-long rollout. If you already run Okta, AccessOwl layers on top of it and adds app coverage and lifecycle automation without ripping anything out.

Can Lucca automatically create and delete SaaS accounts in Google Workspace, Microsoft 365, or Slack?

No. Lucca's Google and Microsoft single sign-on lets people log into Lucca with those accounts. It does not create or delete accounts in Google Workspace, Microsoft 365, or your other apps. AccessOwl provisions across 400+ apps without requiring SCIM.

Can I automate SaaS provisioning on top of Lucca without setting up SCIM for every app?

Yes, and it is the reason teams pick a tool like AccessOwl over an IdP-plus-SCIM project. Instead of configuring SCIM or SAML per app, and paying the enterprise-tier upgrades they need, AccessOwl provisions through admin-level service accounts and browser-based automation. That covers the long tail of apps that never supported SCIM in the first place.

Our team uses Lucca, how do I make sure all app access is revoked when an employee leaves?

Lucca flags the departure and reminds IT, but it does not remove access in your third-party apps. AccessOwl uses the termination date in Lucca to remove licenses across every connected app and reassign owned assets to the manager, and it surfaces Shadow IT accounts your HRIS never saw, so offboarding is complete and logged.

Can I use role, team, or department from Lucca to decide app access automatically?

Yes. Lucca holds each person's role, team, department, and legal entity. AccessOwl maps access to those HR attributes and lets you customize per person, so a Product Manager in a given entity gets exactly the right apps and permissions on day one, and a later role change updates them.