What is HR-driven provisioning?

HR-driven provisioning creates, updates and disables accounts from HR records. A hire, role change or termination updates Active Directory without an IT ticket.

How does it compare with Microsoft Entra ID provisioning?

Both update accounts from HR records. Microsoft Entra ID has built-in connectors for Workday and SAP SuccessFactors. Other HR systems need API-driven provisioning with a client you build or buy (Microsoft Learn, checked October 7, 2026). Those connectors may cover your needs. ezOnboard connects 20+ HR systems, including UKG, ADP and BambooHR, with rules and safety limits for hires, changes and departures.

Which HR changes does ezOnboard act on?

Hires, terminations, role changes and updates to names, phone numbers and other details. Your rules define what changes in Active Directory, Entra ID and Exchange.

Can it match existing accounts?

Yes. Match HR records to Active Directory accounts using attributes such as employee ID. Multiple matches stop for review.

What happens to a leaver’s account?

The account is disabled, never deleted. Licenses are recovered, mail is forwarded and access is removed on your schedule. Every step is recorded for audit.

Do we need a server for the agent?

Yes. The agent runs on a domain-joined Windows Server in your network. It uses outbound connections only, with no inbound firewall access needed.

Product

HR-driven provisioning for Active Directory

When HR records a hire, a change, or a departure, ezOnboard updates the person’s accounts and access in Active Directory, Entra ID, and Exchange. Without an IT ticket.

Book a demo Contact sales

HR change

09:41:07

Jordan Lee

EMP-10482

Title: ~~Accountant~~Senior Accountant
Department: Finance
Manager: ~~R. Osei~~M. Alvarez
Location: Denver

Active Directory

finance-senior

titleSenior Accountant
managerM. Alvarez
memberOfGL-Approvers
memberOfAP-Clerks
licensePower BI Pro

Moved

1.8s

HR integrations for Active Directory: 20+
Employee records stored in our cloud: 0
Fastest time to go live: 1 week

Joiners, movers, and leavers

Accounts that follow HR changes

Keep your HR process. ezOnboard creates, updates and disables accounts as employee records change.

Joiner Ready on day one: Create accounts from new hire records, with the OU, mailbox, licenses and groups each role needs.
Account created in the role’s OU
Mailbox and licenses assigned
Groups for the role added
Mover Access that follows the role: Update a title, department, manager or location in HR. ezOnboard adds and removes access to match.
Title, manager, and OU updated
New groups and licenses added
Unneeded groups and licenses removed
Leaver Offboard on your schedule: When someone leaves, disable their account, recover licenses, forward mail and remove access on your schedule.
Account disabled, never deleted
Licenses recovered and mail forwarded
Every step recorded for audit

Rules

Your rules applied automatically

ezOnboard applies your rules to each HR change. Choose the OU, groups, licenses and attributes for each role, and define what happens when someone leaves.

Review what each rule will change before it runs.

Rule • finance-seniorMover

IF department = “Finance”
AND title contains “Senior”
THEN place in OU=Finance,OU=Staff
     add group GL-Approvers
     remove group AP-Clerks
     assign license Power BI Pro

Integrations

Connect your HRIS to Active Directory

Connect your HRIS to on-premises Active Directory, Entra ID and Exchange. We add unsupported HR systems during setup. See how yours connects in our HR integration guides.

Safeguards

Stay in control

Preview changes, set limits and get alerts when something needs attention.

Safety limits Set limits on account changes: Limit leavers, moves and attribute clears per run. Runs that would exceed a limit stop for review before making changes.
Dry run Preview changes across your workforce: See which accounts would be created, moved or disabled without changing them. Adjust your rules before going live.
Alerts Know when something stops: Get alerts for stopped runs, delayed HR feeds or an unresponsive agent by email, portal or webhook. A stopped feed never triggers offboarding.
Reconcile Keep accounts in sync: Find and correct differences between accounts and HR records, including manual edits. Preview the fixes with the same safety limits.
Hybrid directory Keep personal data on your network: One local agent manages Active Directory, Entra ID and Exchange. Our portal configures and monitors the agent without storing employee personal data.

Setup

Live in as little as a week

We guide your HR and IT teams through each step. Setup can take as little as a week, depending on coordination between your teams.

01
Connect
Install the agent and connect HR
Install the Windows service on a domain-joined server. It uses outbound connections only. No inbound firewall access is needed.
02
Preview
Review a dry run
We configure your rules and preview changes across your workforce. Existing accounts are matched to HR records. Unclear matches are flagged for review.
03
Go live
Start automatic updates
Accounts update automatically as HR records change, within agreed safety limits. We monitor the first runs with you.

Customers

Customer results

See how customers automate provisioning, or estimate your savings with our ROI calculator.

All case studies

Frequently asked questions

What is HR-driven provisioning?: HR-driven provisioning creates, updates and disables accounts from HR records. A hire, role change or termination updates Active Directory without an IT ticket.
How does it compare with Microsoft Entra ID provisioning?: Both update accounts from HR records. Microsoft Entra ID has built-in connectors for Workday and SAP SuccessFactors. Other HR systems need API-driven provisioning with a client you build or buy (Microsoft Learn, checked October 7, 2026). Those connectors may cover your needs. ezOnboard connects 20+ HR systems, including UKG, ADP and BambooHR, with rules and safety limits for hires, changes and departures.
Which HR changes does ezOnboard act on?: Hires, terminations, role changes and updates to names, phone numbers and other details. Your rules define what changes in Active Directory, Entra ID and Exchange.
Can it match existing accounts?: Yes. Match HR records to Active Directory accounts using attributes such as employee ID. Multiple matches stop for review.
What happens to a leaver’s account?: The account is disabled, never deleted. Licenses are recovered, mail is forwarded and access is removed on your schedule. Every step is recorded for audit.
Do we need a server for the agent?: Yes. The agent runs on a domain-joined Windows Server in your network. It uses outbound connections only, with no inbound firewall access needed.

Get a demo

See it with your HR system

Tell us which HR system and directories you use. We’ll tailor a demo to your setup. Or email sales@ezonboard.io.

HR-driven provisioning for Active Directory

Accounts that follow HR changes

Your rules applied automatically

Connect your HRIS to Active Directory

Stay in control

Live in as little as a week

Install the agent and connect HR

Review a dry run

Start automatic updates

Customer results

Warehouse automation integrator connects Paycor to Entra ID

ezOnboard Integrates HR System, Keeps Employee Identity Information Up-to-Date in Active Directory for Medical Imaging Provider

ezOnboard Creates Single Source of Truth for Global Tool Manufacturer

Frequently asked questions

See it with your HR system