I imagine that's done via JIRA tcket/IT before onboarding.

So if they somehow can get past initial device deployment/user account logon, and get other resources IE; slack....well that speaks to how difficult/pointless it would be to get proper VPN/Jira access.

I believe it was an ancient ServiceNow incantation that all the current employees couldn't seem to hunt down.