Get a demo
All integration guides

isolved People CloudActive Directory

Connect isolved People Cloud to Active Directory

Turn isolved People Cloud hires, changes and departures into account updates in Active Directory. Follow the setup steps, preview changes with a dry run, then go live.

Book a demoView setup steps
isolved People Cloud fields mapped
12
Steps to go live
9
Employee records stored in our cloud
0

Joiners, movers and leavers

How isolved People Cloud updates Active Directory

HR updates isolved People Cloud. ezOnboard updates accounts based on your rules.

Joiner

An account before day one

A new hire is added in isolved with a hire date and Active employment status.

  • Account created in the role’s OU, disabled until the start date
  • Name, email and attributes set from isolved People Cloud
  • Department and site groups added
  • Account enabled on the start date; password change required at first sign-in

Mover

Access for the new role

A job title, department, location or supervisor changes in isolved’s Jobs or Organizations screens.

  • Title, department, office and manager updated
  • Account moved to the OU your rules specify
  • Groups added and removed to match the new role

Leaver

Offboarding on schedule

A termination date and Terminated status are set in isolved.

  • Account disabled on the termination date, never deleted
  • Groups removed and the account moved to the disabled OU
  • Mail forwarded and licenses recovered with connected Exchange and Microsoft 365 services

Before you start

What to have ready

Work with a isolved People Cloud admin and a directory admin to complete the setup.

In isolved People Cloud
  • isolved client administrator access and help from your service bureau or isolved representative to enable the API user
  • A work email or employee number for each person in isolved to match them to their account
In Active Directory
  • A domain-joined server running Windows Server 2019 or later
  • A group managed service account or service account to run the agent
  • Outbound HTTPS to the HR system and ezOnboard; no inbound access required
  • OUs for staff accounts, disabled accounts and the groups ezOnboard will manage

Step by step

Set up isolved People Cloud with Active Directory

Start in isolved People Cloud and on your server. Then finish in the ezOnboard portal with our implementation team.

  1. 01

    isolved People Cloud

    Grant access to your client

    Security → Partner Users → Client Access

    isolved creates API users at the partner level. Ask your service bureau or isolved Customer Service Representative to enable ezOnboard. If Security → Partner Users isn’t available, they can complete this step for you.

    Under Partner Users, filter by isolved HCM Rest API and select ezOnboard. On Client Access, choose Add Client, enter your client code and save. No other access is needed. Run Production Utilities → Refresh System Data to apply the change.

    Client Access tab. Add your client code to the ezOnboard partner user.

  2. 02

    isolved People Cloud

    Save the client code and API credentials

    Security → Partner Users → ezOnboard

    isolved registers the ezOnboard API application and generates a client ID and secret for your environment. Your service bureau or isolved provides them after enabling the partner user. Request secure delivery and store them safely.

    Note the client code you added on Client Access. You’ll need it, the client ID and the secret in step 5.

    API application. Your service bureau or isolved sends you the client ID and secret.

  3. 03

    Your server

    Install the ezOnboard agent

    The agent runs as a Windows service on a domain-joined server with Windows Server 2019 or later. It connects to isolved People Cloud and ezOnboard over outbound HTTPS. No inbound firewall rules are needed.

    Download the signed MSI and enrollment bundle from the portal. Save the install code. The portal shows it only once. Run the MSI, enter the code and choose a service account, preferably a group managed service account. The installer checks the domain connection, LDAP access, outbound access and clock before making changes.

    Installer screen with the setup requirements.

  4. 04

    Active Directory

    Delegate the OUs the agent will manage

    Run the installer’s delegation script once as a domain administrator. It lets the agent’s service account create, update and disable accounts only in the OUs you choose. The agent doesn’t need Domain Admin rights.

    Include the OUs for staff accounts, disabled accounts and managed groups. The agent blocks changes outside these OUs, even if a rule requests them.

    PS C:\> & 'C:\ProgramData\ezOnboard\northwind\ou-delegation.ps1'
Delegated NORTHWIND\svc-ezonboard$ on OU=Staff,DC=northwind,DC=com
Delegated NORTHWIND\svc-ezonboard$ on OU=Disabled,DC=northwind,DC=com
Delegated NORTHWIND\svc-ezonboard$ on OU=Groups,DC=northwind,DC=com
Done

    Run the installer’s delegation script once on a domain controller.

  5. 05

    ezOnboard portal

    Add isolved People Cloud as an HR source

    In the portal, add isolved People Cloud as an HR source using the client ID, client secret and your client code. Your credentials are encrypted with your organization’s key and sent to your agent. The agent reads isolved People Cloud from your network. Nobody at ezOnboard can read the credentials.

    Choose a field to match people across both systems, usually work email or employee ID. The agent checks isolved People Cloud every five minutes and catches up on any missed changes.

    HR source. Your agent uses these credentials to read isolved People Cloud.

  6. 06

    ezOnboard portal

    Map isolved People Cloud fields to Active Directory attributes

    Choose which isolved People Cloud fields update each directory attribute. Start with the defaults below, add custom fields or combine values. For example, build a display name from first and last names, format a job title or look up an office address by site.

    Blank isolved People Cloud fields leave directory values unchanged unless you configure the mapping to clear them.

    Field mapping. See the full list of defaults below.

  7. 07

    ezOnboard portal

    Set rules for accounts, OUs and groups

    Rules define who gets an account, which OU it belongs in, how it’s named and which groups it joins. They also control offboarding. Use isolved People Cloud fields, such as department and site, to make those choices.

    Our implementation team helps you write the rules. With approvals enabled, your team must approve each rule change before the agent uses it.

    Rules page with the placement rule open.

  8. 08

    ezOnboard portal

    Preview changes with a dry run

    Run a dry run for your whole workforce. The agent matches isolved People Cloud records to existing accounts by employee ID, then work email, and previews changes without applying them. If two accounts match one person, that action stops for review.

    Review the planned changes and the rules behind them in the portal. Adjust your rules and repeat the dry run until the results match your expectations.

    Dry run. No changes are applied while dry run is on.

  9. 09

    ezOnboard portal

    Go live

    Turn off dry run to apply changes. If a run would disable or move more accounts than your safety limits allow, it stops and alerts your team before making changes. We review the first runs with you.

    HR continues working in isolved People Cloud. Your rules handle new accounts, updates and offboarding on schedule. Get alerts by email, in the portal or by webhook when a run stops, the HR feed stops updating or the agent stops reporting. An inactive feed never triggers offboarding.

    Reports with account activity, tickets avoided and agent uptime.

Field mapping

isolved People Cloud fields and Active Directory attributes

Start with these defaults and adjust any mapping. Dates and lifecycle status control when accounts are created, enabled or disabled.

isolved People Cloud fieldActive Directory attributeHow it’s used
First NameEmployee Maintenance › GeneralgivenNameSets the first name at account creation and keeps it up to date.
Last NameEmployee Maintenance › GeneralsnKeeps the last name up to date. Also updates the logon name if your naming rule uses it.
Preferred NameEmployee Maintenance › GeneraldisplayNameUses the preferred name for the display name and email. Uses the first name if blank.
Work EmailEmployee Maintenance › Generalmail, userPrincipalNameSets the email address and sign-in name. A mail rule can also generate them from the person’s name.
Employee NumberEmployee Maintenance › GeneralemployeeIDAdded to new accounts and used first to match existing accounts.
Job TitleEmployee Maintenance › JobstitleKeeps the job title up to date and sets groups based on your rules.
DepartmentEmployee Maintenance › OrganizationsdepartmentKeeps the department up to date. Rules can use it to choose account placement and groups.
LocationEmployee Maintenance › OrganizationsphysicalDeliveryOfficeNameKeeps the office up to date. A lookup table can also fill in the street, city and country.
SupervisorEmployee Maintenance › JobsmanagerLinks to the supervisor’s account to keep approvals and org charts in sync with isolved.
Hire DateEmployee Maintenance › EmploymentuserAccountControlSets when the account is created and enabled. You choose how many days before the hire date to create it.
Employment StatusEmployee Maintenance › EmploymentuserAccountControlActive keeps the account enabled. Terminated disables it when no other record keeps the person active.
Termination DateEmployee Maintenance › EmploymentuserAccountControlSets the date for disabling the account and starting offboarding. Your rules set the time.

Frequently asked questions

Does ezOnboard write to isolved?
No. ezOnboard only reads isolved through its partner user. Grant access to your client code and make any corrections in isolved.
Which isolved permissions does the API user need?
The ezOnboard partner user needs your client code on its Client Access tab under Security → Partner Users. Your service bureau or isolved adds it. No client user, role or edit access is needed.
Do we need isolved’s Entra ID integration or SCIM?
No. ezOnboard reads isolved’s API and uses your rules to manage accounts in Active Directory or Entra ID. Its agent runs on your network and can also manage Exchange.
Do we need a server for the agent?
Yes. Use a domain-joined Windows Server with LDAP access to a domain controller and outbound HTTPS to isolved People Cloud and ezOnboard. The agent needs no inbound firewall rules or Domain Admin rights. The delegation script grants access only to the OUs it manages.
How quickly does a isolved People Cloud change reach Active Directory?
The agent checks isolved People Cloud every five minutes and usually applies changes within seconds of finding them. Scheduled changes follow your rules: accounts are created before the start date, enabled on that date and disabled on the termination date at the time you choose.
How does isolved People Cloud trigger offboarding in Active Directory?
On the termination date, the account is disabled, removed from its groups and moved to your disabled-accounts OU. It is never deleted. With Exchange and Microsoft 365 connected, your rules also schedule mail forwarding and license recovery. Every step is recorded for audit.
Where does our employee data go?
The agent reads isolved People Cloud and updates Active Directory from your server. Names, emails and HR records stay on your network, where your team can view them on a local status page. The portal receives events with pseudonymous IDs, the rule used and the result.
Can ezOnboard also connect isolved People Cloud to Entra ID?
Yes. One agent and one set of rules can manage Active Directory, Entra ID and Exchange from isolved People Cloud. For accounts synced from Active Directory, the agent updates the on-premises account and assigns licenses and mailboxes in the cloud.

Get a demo

See isolved People Cloud connected to Active Directory

Get a demo for your isolved People Cloud and Active Directory setup. For questions, email sales@ezonboard.io.

Optional

This site is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.