Get a demo
All integration guides

HiBobActive Directory

Connect HiBob to Active Directory

Turn HiBob hires, changes and departures into account updates in Active Directory. Follow the setup steps, preview changes with a dry run, then go live.

Book a demoView setup steps
HiBob fields mapped
12
Steps to go live
9
Employee records stored in our cloud
0

Joiners, movers and leavers

How HiBob updates Active Directory

HR updates HiBob. ezOnboard updates accounts based on your rules.

Joiner

An account before day one

A person is added to HiBob with a start date and Hired status.

  • Account created in the role’s OU, disabled until the start date
  • Name, email and attributes set from HiBob
  • Department and site groups added
  • Account enabled on the start date; password change required at first sign-in

Mover

Access for the new role

A job title, department, site or manager changes in HiBob’s Work section.

  • Title, department, office and manager updated
  • Account moved to the OU your rules specify
  • Groups added and removed to match the new role

Leaver

Offboarding on schedule

A termination date is set in HiBob.

  • Account disabled on the termination date, never deleted
  • Groups removed and the account moved to the disabled OU
  • Mail forwarded and licenses recovered with connected Exchange and Microsoft 365 services

Before you start

What to have ready

Work with a HiBob admin and a directory admin to complete the setup.

In HiBob
  • HiBob admin access to create a service user and permission group
  • A work email or employee ID for each person in HiBob to match them to their account
In Active Directory
  • A domain-joined server running Windows Server 2019 or later
  • A group managed service account or service account to run the agent
  • Outbound HTTPS to the HR system and ezOnboard; no inbound access required
  • OUs for staff accounts, disabled accounts and the groups ezOnboard will manage

Step by step

Set up HiBob with Active Directory

Start in HiBob and on your server. Then finish in the ezOnboard portal with our implementation team.

  1. 01

    HiBob

    Create a service user for ezOnboard

    Settings → Integrations → Service users

    ezOnboard uses a service user to read HiBob’s API. The service user has no access until you add it to a permission group.

    Sign in to HiBob as an admin and create a service user named ezOnboard. Copy the ID and token to a secure location before closing the dialog. You’ll need both in step 5.

    Service user dialog. Copy the ID and token before closing it.

  2. 02

    HiBob

    Grant read access to people data

    Settings → Account → Permission groups

    Add the service user to a new or existing permission group. Grant view access only to the categories below. ezOnboard doesn’t write to HiBob, so it needs no edit permissions.

    Under people scope, choose Select people by condition. Include Hired, Employed and Terminated so ezOnboard can read upcoming hires, current employees and leavers.

    • Basic info: first name, surname, display name and email
    • Work: employee ID, job title, department, site, reports to and start date
    • Lifecycle: status and termination date

    Permission group. Include all three statuses and grant view access to the three categories shown.

  3. 03

    Your server

    Install the ezOnboard agent

    The agent runs as a Windows service on a domain-joined server with Windows Server 2019 or later. It connects to HiBob and ezOnboard over outbound HTTPS. No inbound firewall rules are needed.

    Download the signed MSI and enrollment bundle from the portal. Save the install code. The portal shows it only once. Run the MSI, enter the code and choose a service account, preferably a group managed service account. The installer checks the domain connection, LDAP access, outbound access and clock before making changes.

    Installer screen with the setup requirements.

  4. 04

    Active Directory

    Delegate the OUs the agent will manage

    Run the installer’s delegation script once as a domain administrator. It lets the agent’s service account create, update and disable accounts only in the OUs you choose. The agent doesn’t need Domain Admin rights.

    Include the OUs for staff accounts, disabled accounts and managed groups. The agent blocks changes outside these OUs, even if a rule requests them.

    PS C:\> & 'C:\ProgramData\ezOnboard\northwind\ou-delegation.ps1'
Delegated NORTHWIND\svc-ezonboard$ on OU=Staff,DC=northwind,DC=com
Delegated NORTHWIND\svc-ezonboard$ on OU=Disabled,DC=northwind,DC=com
Delegated NORTHWIND\svc-ezonboard$ on OU=Groups,DC=northwind,DC=com
Done

    Run the installer’s delegation script once on a domain controller.

  5. 05

    ezOnboard portal

    Add HiBob as an HR source

    In the portal, add HiBob as an HR source using the service user ID and token. Your credentials are encrypted with your organization’s key and sent to your agent. The agent reads HiBob from your network. Nobody at ezOnboard can read the credentials.

    Choose a field to match people across both systems, usually work email or employee ID. The agent checks HiBob every five minutes and catches up on any missed changes.

    HR source. Your agent uses these credentials to read HiBob.

  6. 06

    ezOnboard portal

    Map HiBob fields to Active Directory attributes

    Choose which HiBob fields update each directory attribute. Start with the defaults below, add custom fields or combine values. For example, build a display name from first and last names, format a job title or look up an office address by site.

    Blank HiBob fields leave directory values unchanged unless you configure the mapping to clear them.

    Field mapping. See the full list of defaults below.

  7. 07

    ezOnboard portal

    Set rules for accounts, OUs and groups

    Rules define who gets an account, which OU it belongs in, how it’s named and which groups it joins. They also control offboarding. Use HiBob fields, such as department and site, to make those choices.

    Our implementation team helps you write the rules. With approvals enabled, your team must approve each rule change before the agent uses it.

    Rules page with the placement rule open.

  8. 08

    ezOnboard portal

    Preview changes with a dry run

    Run a dry run for your whole workforce. The agent matches HiBob records to existing accounts by employee ID, then work email, and previews changes without applying them. If two accounts match one person, that action stops for review.

    Review the planned changes and the rules behind them in the portal. Adjust your rules and repeat the dry run until the results match your expectations.

    Dry run. No changes are applied while dry run is on.

  9. 09

    ezOnboard portal

    Go live

    Turn off dry run to apply changes. If a run would disable or move more accounts than your safety limits allow, it stops and alerts your team before making changes. We review the first runs with you.

    HR continues working in HiBob. Your rules handle new accounts, updates and offboarding on schedule. Get alerts by email, in the portal or by webhook when a run stops, the HR feed stops updating or the agent stops reporting. An inactive feed never triggers offboarding.

    Reports with account activity, tickets avoided and agent uptime.

Field mapping

HiBob fields and Active Directory attributes

Start with these defaults and adjust any mapping. Dates and lifecycle status control when accounts are created, enabled or disabled.

HiBob fieldActive Directory attributeHow it’s used
First nameBasic infogivenNameSets the first name at account creation and keeps it up to date.
SurnameBasic infosnKeeps the surname up to date. Also updates the logon name if your naming rule uses it.
Display nameBasic infodisplayNameSets the name shown in address books and sign-in prompts. You can also build it from the first name and surname.
EmailBasic infomail, userPrincipalNameSets the email address and sign-in name. A mail rule can also generate them from the person’s name.
Employee IDWorkemployeeIDAdded to new accounts and used first to match existing accounts.
Job titleWorktitleKeeps the job title up to date and sets groups based on your rules.
DepartmentWorkdepartmentKeeps the department up to date. Rules can use it to choose account placement and groups.
SiteWorkphysicalDeliveryOfficeNameKeeps the office up to date. A lookup table can also fill in the street, city and country.
Reports toWorkmanagerLinks to the manager’s account to keep approvals and org charts in sync with HiBob.
Start dateWorkuserAccountControlSets when the account is created and enabled. You choose how many days before the start date to create it.
Lifecycle statusLifecycleuserAccountControlEmployed keeps the account enabled. Terminated disables it when no other record keeps the person active.
Termination dateLifecycleuserAccountControlSets the date for disabling the account and starting offboarding. Your rules set the time.

Frequently asked questions

Does ezOnboard write to HiBob?
No. ezOnboard only reads HiBob, so the service user needs view permissions only. Make any corrections in HiBob.
Which HiBob permissions does the service user need?
Add the service user to a permission group with view access to Basic info, Work and Lifecycle. Include Hired, Employed and Terminated in the group’s people scope. No edit permissions are needed.
Do we need HiBob’s Entra ID integration or SCIM?
No. ezOnboard reads HiBob’s API and uses your rules to manage accounts in Active Directory or Entra ID. Its agent runs on your network and can also manage Exchange.
Do we need a server for the agent?
Yes. Use a domain-joined Windows Server with LDAP access to a domain controller and outbound HTTPS to HiBob and ezOnboard. The agent needs no inbound firewall rules or Domain Admin rights. The delegation script grants access only to the OUs it manages.
How quickly does a HiBob change reach Active Directory?
The agent checks HiBob every five minutes and usually applies changes within seconds of finding them. Scheduled changes follow your rules: accounts are created before the start date, enabled on that date and disabled on the termination date at the time you choose.
How does HiBob trigger offboarding in Active Directory?
On the termination date, the account is disabled, removed from its groups and moved to your disabled-accounts OU. It is never deleted. With Exchange and Microsoft 365 connected, your rules also schedule mail forwarding and license recovery. Every step is recorded for audit.
Where does our employee data go?
The agent reads HiBob and updates Active Directory from your server. Names, emails and HR records stay on your network, where your team can view them on a local status page. The portal receives events with pseudonymous IDs, the rule used and the result.
Can ezOnboard also connect HiBob to Entra ID?
Yes. One agent and one set of rules can manage Active Directory, Entra ID and Exchange from HiBob. For accounts synced from Active Directory, the agent updates the on-premises account and assigns licenses and mailboxes in the cloud.

Get a demo

See HiBob connected to Active Directory

Get a demo for your HiBob and Active Directory setup. For questions, email sales@ezonboard.io.

Optional

This site is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.