Active Directory
Connect Paychex Flex to Active Directory
Turn Paychex Flex hires, changes and departures into account updates in Active Directory. Follow the setup steps, preview changes with a dry run, then go live.
Paychex Flex record
08:02:14
Hannah Park
6603
- Job Title
- Software Engineer
- Organization
- Engineering
- Location
- Austin
- Supervisor
- D. Okafor
- Hire Date
- Nov 10, 2026
- Employment Type
- Full Time
Active Directory
eng-austin
- accountOU=Engineering,OU=Staff
- sAMAccountNamehannah.park
- mailhannah.park@northwind.com
- titleSoftware Engineer
- managerD. Okafor
- memberOfEng-All
- memberOfVPN-Austin
2.3s
- Paychex Flex fields mapped
- 13
- Steps to go live
- 9
- Employee records stored in our cloud
- 0
Joiners, movers and leavers
How Paychex Flex updates Active Directory
HR updates Paychex Flex. ezOnboard updates accounts based on your rules.
Joiner
An account before day one
A worker is added to Paychex Flex with a hire date and Active status.
- Account created in the role’s OU, disabled until the start date
- Name, email and attributes set from Paychex Flex
- Department and site groups added
- Account enabled on the start date; password change required at first sign-in
Mover
Access for the new role
A job title, organization, location or supervisor changes in a Paychex Flex employment record.
- Title, department, office and manager updated
- Account moved to the OU your rules specify
- Groups added and removed to match the new role
Leaver
Offboarding on schedule
A worker’s status is changed to Terminated in Paychex Flex with a termination date.
- Account disabled on the termination date, never deleted
- Groups removed and the account moved to the disabled OU
- Mail forwarded and licenses recovered with connected Exchange and Microsoft 365 services
Before you start
What to have ready
Work with a Paychex Flex admin and a directory admin to complete the setup.
- In Paychex Flex
- Paychex Flex Super Admin, Security Admin or a custom role with Integrated Apps Administration
- A work email or employee ID for each person in Paychex Flex to match them to their account
- In Active Directory
- A domain-joined server running Windows Server 2019 or later
- A group managed service account or service account to run the agent
- Outbound HTTPS to the HR system and ezOnboard; no inbound access required
- OUs for staff accounts, disabled accounts and the groups ezOnboard will manage
Step by step
Set up Paychex Flex with Active Directory
Start in Paychex Flex and on your server. Then finish in the ezOnboard portal with our implementation team.
01
Paychex Flex
Create an integrated app for ezOnboard
Company Settings → Integrated Apps → Create App
ezOnboard connects through a Paychex Flex integrated app with its own API key and client secret. Use a Super Admin, Security Admin or custom role with Integrated Apps Administration to create it.
Create an app named ezOnboard. Under Access settings, turn on Company and worker APIs and choose Read only. Leave Payroll and check APIs off. Accept the Legal Notice and API License Agreement, then save.
- Application Name: ezOnboard
- Company and worker APIs: on, Read only
- Payroll and check APIs: off
Create App. Turn on Company and worker APIs with Read only and leave Payroll and check APIs off.
02
Paychex Flex
Copy the API key and client secret
Company Settings → Integrated Apps → ezOnboard
Copy the API Key and Client Secret shown after saving. Store them securely and share them only with people who need access.
To include more companies, add each one under Company Access and turn on Access. You’ll need the API key and client secret in step 5.
App credentials. Copy the API key and client secret to a secure location.
03
Your server
Install the ezOnboard agent
The agent runs as a Windows service on a domain-joined server with Windows Server 2019 or later. It connects to Paychex Flex and ezOnboard over outbound HTTPS. No inbound firewall rules are needed.
Download the signed MSI and enrollment bundle from the portal. Save the install code. The portal shows it only once. Run the MSI, enter the code and choose a service account, preferably a group managed service account. The installer checks the domain connection, LDAP access, outbound access and clock before making changes.
Installer screen with the setup requirements.
04
Active Directory
Delegate the OUs the agent will manage
Run the installer’s delegation script once as a domain administrator. It lets the agent’s service account create, update and disable accounts only in the OUs you choose. The agent doesn’t need Domain Admin rights.
Include the OUs for staff accounts, disabled accounts and managed groups. The agent blocks changes outside these OUs, even if a rule requests them.
PS C:\> & 'C:\ProgramData\ezOnboard\northwind\ou-delegation.ps1' Delegated NORTHWIND\svc-ezonboard$ on OU=Staff,DC=northwind,DC=com Delegated NORTHWIND\svc-ezonboard$ on OU=Disabled,DC=northwind,DC=com Delegated NORTHWIND\svc-ezonboard$ on OU=Groups,DC=northwind,DC=com DoneRun the installer’s delegation script once on a domain controller.
05
ezOnboard portal
Add Paychex Flex as an HR source
In the portal, add Paychex Flex as an HR source using the API key and client secret. Your credentials are encrypted with your organization’s key and sent to your agent. The agent reads Paychex Flex from your network. Nobody at ezOnboard can read the credentials.
Choose a field to match people across both systems, usually work email or employee ID. The agent checks Paychex Flex every five minutes and catches up on any missed changes.
HR source. Your agent uses these credentials to read Paychex Flex.
06
ezOnboard portal
Map Paychex Flex fields to Active Directory attributes
Choose which Paychex Flex fields update each directory attribute. Start with the defaults below, add custom fields or combine values. For example, build a display name from first and last names, format a job title or look up an office address by site.
Blank Paychex Flex fields leave directory values unchanged unless you configure the mapping to clear them.
Field mapping. See the full list of defaults below.
07
ezOnboard portal
Set rules for accounts, OUs and groups
Rules define who gets an account, which OU it belongs in, how it’s named and which groups it joins. They also control offboarding. Use Paychex Flex fields, such as department and site, to make those choices.
Our implementation team helps you write the rules. With approvals enabled, your team must approve each rule change before the agent uses it.
Rules page with the placement rule open.
08
ezOnboard portal
Preview changes with a dry run
Run a dry run for your whole workforce. The agent matches Paychex Flex records to existing accounts by employee ID, then work email, and previews changes without applying them. If two accounts match one person, that action stops for review.
Review the planned changes and the rules behind them in the portal. Adjust your rules and repeat the dry run until the results match your expectations.
Dry run. No changes are applied while dry run is on.
09
ezOnboard portal
Go live
Turn off dry run to apply changes. If a run would disable or move more accounts than your safety limits allow, it stops and alerts your team before making changes. We review the first runs with you.
HR continues working in Paychex Flex. Your rules handle new accounts, updates and offboarding on schedule. Get alerts by email, in the portal or by webhook when a run stops, the HR feed stops updating or the agent stops reporting. An inactive feed never triggers offboarding.
Reports with account activity, tickets avoided and agent uptime.
Field mapping
Paychex Flex fields and Active Directory attributes
Start with these defaults and adjust any mapping. Dates and lifecycle status control when accounts are created, enabled or disabled.
| Paychex Flex field | Active Directory attribute | How it’s used |
|---|---|---|
| First NamePersonal | givenName | Sets the first name at account creation and keeps it up to date. |
| Last NamePersonal | sn | Keeps the last name up to date. Also updates the logon name if your naming rule uses it. |
| Preferred NamePersonal | displayName | Uses the preferred name for the display name and email. Uses the first name if blank. |
| Work EmailContact | mail, userPrincipalName | Sets the email address and sign-in name. A mail rule can also generate them from the person’s name. |
| Employee IDEmployment | employeeID | Added to new accounts and used first to match existing accounts. |
| Job TitleEmployment | title | Keeps the job title up to date and sets groups based on your rules. |
| OrganizationEmployment | department | Keeps the department up to date from the organization unit. Rules can use it to choose account placement and groups. |
| LocationEmployment | physicalDeliveryOfficeName | Keeps the office up to date. A lookup table can also fill in the street, city and country. |
| SupervisorEmployment | manager | Links to the manager’s account to keep approvals and org charts in sync with Paychex Flex. |
| Hire DateEmployment | userAccountControl | Sets when the account is created and enabled. You choose how many days before the hire date to create it. |
| StatusEmployment | userAccountControl | Active keeps the account enabled. Terminated disables it when no other record keeps the person active. |
| Employment TypeEmployment | userAccountControl | Rules can use Full Time or Part Time to choose groups and licenses. Contractors can be included or left out. |
| Termination DateEmployment › Status | userAccountControl | Sets the date for disabling the account and starting offboarding. Your rules set the time. |
Frequently asked questions
- Does ezOnboard write to Paychex Flex?
- No. ezOnboard only reads Paychex Flex, so the integrated app needs Read only access to the Company and worker APIs. Make any corrections in Paychex Flex.
- Which Paychex Flex permissions does the app need?
- Turn on Company and worker APIs with Read only. Leave Payroll and check APIs off. To create the app, use a Super Admin, Security Admin or custom role with Integrated Apps Administration.
- Do we need Paychex Flex’s Entra ID integration or SCIM?
- No. ezOnboard reads Paychex Flex’s API and uses your rules to manage accounts in Active Directory or Entra ID. Its agent runs on your network and can also manage Exchange.
- Do we need a server for the agent?
- Yes. Use a domain-joined Windows Server with LDAP access to a domain controller and outbound HTTPS to Paychex Flex and ezOnboard. The agent needs no inbound firewall rules or Domain Admin rights. The delegation script grants access only to the OUs it manages.
- How quickly does a Paychex Flex change reach Active Directory?
- The agent checks Paychex Flex every five minutes and usually applies changes within seconds of finding them. Scheduled changes follow your rules: accounts are created before the start date, enabled on that date and disabled on the termination date at the time you choose.
- How does Paychex Flex trigger offboarding in Active Directory?
- On the termination date, the account is disabled, removed from its groups and moved to your disabled-accounts OU. It is never deleted. With Exchange and Microsoft 365 connected, your rules also schedule mail forwarding and license recovery. Every step is recorded for audit.
- Where does our employee data go?
- The agent reads Paychex Flex and updates Active Directory from your server. Names, emails and HR records stay on your network, where your team can view them on a local status page. The portal receives events with pseudonymous IDs, the rule used and the result.
- Can ezOnboard also connect Paychex Flex to Entra ID?
- Yes. One agent and one set of rules can manage Active Directory, Entra ID and Exchange from Paychex Flex. For accounts synced from Active Directory, the agent updates the on-premises account and assigns licenses and mailboxes in the cloud.
Get a demo
See Paychex Flex connected to Active Directory
Get a demo for your Paychex Flex and Active Directory setup. For questions, email sales@ezonboard.io.