A new hire's first week is the worst week to learn about phishing - their inbox is brand new, credential-hungry onboarding emails land by the dozen, and nobody has trained them yet. BambooHR already knows when that person starts. Connecting BambooHR to Cyber Aware means the moment HR enters a start date, the training programme is already waiting for them.
TL;DR
- BambooHR knows each hire's start date, department and work email.
- Cyber Aware Auto Enrol places new learners in the default training schedule automatically.
- The safe route is BambooHR to Zapier to Cyber Aware via API or webhooks.
- Welcome emails, branded certificates and leaver removal all follow automatically.
- Test one synthetic employee before connecting the live directory.
Why this matters
Two failure modes hit HR-owned enrolment. First, the lag: HR starts the paperwork, IT provisions the mailbox days later, and training is requested last - so a new starter receives phishing-laced onboarding traffic before their first lesson. Second, the forgotten leaver: HR terminates an employee, training is nobody's checklist item, and the departed account keeps counting in your reports. A sync fixes both by making the HR system the trigger rather than a person's memory.
There is also a compliance angle. BambooHR's own API documentation states that read access requires the API key to belong to a user with the right permissions, and that API keys are created and managed under the account owner's control - which is exactly why the connection should be scoped, owned and tested deliberately rather than wired in on a shared admin login.
Who this is for
MSPs whose clients run BambooHR, and internal people-ops or IT teams at businesses hiring in bursts. If enrolment currently starts with a "can you add these people to the training?" message, this removes the message.
Before you start
- A BambooHR account with admin or API-key rights - BambooHR's API documentation describes keys created by the account owner, visible only at creation, and revocable in Settings under Account and API Keys.
- A Zapier account. BambooHR connects to Zapier as a premium app, with triggers for new employees, employee updates and terminations.
- A Cyber Aware partner account with API or Zapier webhook access.
- The gotcha: BambooHR's Zapier triggers are polling-based - Zapier checks for changes roughly every 15 minutes on free plans. Design your automation for a new employee appearing with a slight delay, not instantly.
Step 1 - Create and scope a BambooHR API key
- In BambooHR, go to Profile and open API Keys, or manage account-wide keys under Settings and Account and API Keys.
- Add a new key and name it for its purpose - for example, Cyber Aware enrolment.
- Copy the key once: BambooHR shows it only at creation.
- Give the key an owner account with read access to the employee fields the sync needs: first name, last name, work email, start date, department.
BambooHR's API documentation covers the error codes to expect: 401 means the key is missing, 403 means the key's owner lacks permission. Both are fixable in the key owner's account settings.
Step 2 - Wire BambooHR to Zapier
- In Zapier, create a new Zap with BambooHR as the trigger app.
- Choose the New Employee trigger, or New Employee Started if you want enrolment keyed to the start date rather than the record's creation.
- Connect the account using the API key from step 1.
- Run a test to pull one real employee record and confirm the fields populate.
Expected result: the test step returns a sample employee with email and start date visible. If a field is missing, it is not mapped in BambooHR - add it to the employee record and retest.
Step 3 - Create the learner in Cyber Aware
- Add an action step to the same Zap: Cyber Aware, using the API or webhooks integration.
- Map first name, last name and work email from the BambooHR trigger.
- Choose the client and the default training schedule the new learner should land in.
- Save and test the action with the sample record.
Expected result: a test learner appears in Cyber Aware's learner list with a welcome email already sent, and their baseline courses are assigned automatically. From that moment the programme runs itself: monthly courses auto-add, due and overdue reminders fire on schedule, and completed courses issue branded certificates under your MSP brand.
Step 4 - Handle leavers the same way
- Duplicate the Zap and set the trigger to BambooHR's employee-updated or terminated-employee event.
- Add a Cyber Aware action that removes or deactivates the learner.
- Confirm in testing that a terminated record produces a learner removal, not an error.
Leaver handling is what turns this from a convenience into an audit control: departed staff stop appearing as active learners, and your human risk reporting stops counting them.
Verification and a clean rollout
- Create a synthetic test employee in BambooHR on a quiet day.
- Watch the Zap fire, the learner appear in Cyber Aware, and the welcome email land.
- Terminate the test employee and confirm removal.
- Then let live hires flow through.
Run the test against a client with no imminent hires, so any plumbing failure surfaces before it affects a real starter.
Troubleshooting
- The Zap does not trigger on a new hire. Polling delay - BambooHR triggers check roughly every 15 minutes on free Zapier plans. Wait one full cycle before diagnosing.
- 401 or 403 errors in the BambooHR step. The API key is missing, revoked, or its owner lacks permission on the employee fields. Recreate the key and re-scope.
- The Cyber Aware action errors on create. A mapped field is empty - usually work email. Require it in BambooHR records before enrolment.
- Duplicate learners. The employee exists in both BambooHR and a prior CSV import. Remove the manual import and let the sync own the list.
What to do next
Enrolment is the on-ramp; the programme itself is security awareness training - story-driven courses, quizzes, leaderboards and branded certificates on a monthly cadence. Pair the BambooHR on-ramp with phishing simulations so a new starter's first encounter with a lure is a test, not a real attack.
FAQ
Can Cyber Aware sync with BambooHR?
Yes - via BambooHR's Zapier triggers feeding Cyber Aware's API or Zapier webhooks. BambooHR exposes new-employee, employee-updated and termination events, and Cyber Aware creates or removes the matching learner.
Does the sync need HR to do anything after setup?
No. Once HR enters a start date in BambooHR, enrolment follows - welcome email, default schedule and reminders included.
What happens when an employee is terminated in BambooHR?
Build a second Zap on the terminated-employee event that removes the learner. Leavers stop counting as active learners on the next flow.
How fast does enrolment happen after hire?
Within the polling interval - roughly every 15 minutes on free Zapier plans, faster on paid plans.
Do new hires get a welcome email?
Yes. Learners created through Auto Enrol land in the default training schedule automatically, welcome email included.
Is the training branded for the client?
Yes - portals, notification emails and certificates carry your brand rather than Cyber Aware's.
What should the first course be for a new hire?
The platform's default baseline, which covers phishing, credentials and data handling. New starters are the highest-risk week for phishing, so front-load that module.
One last thing
Check whether the client's onboarding email traffic is genuine. Recruiters and payroll services routinely send credential-heavy emails in week one, which trains new starters that password requests are normal - that habit is exactly what phishing exploits.