Active Directory
Connect Paycom to Active Directory
Turn Paycom hires, changes and departures into account updates in Active Directory. Follow the setup steps, preview changes with a dry run, then go live.
Paycom record
08:02:14
Chloe Dubois
5529
- Position title
- Software Engineer
- Department
- Engineering
- Location
- Austin
- Primary supervisor
- D. Okafor
- Hire date
- Nov 10, 2026
- Employee status
- Active
Active Directory
eng-austin
- accountOU=Engineering,OU=Staff
- sAMAccountNamechloe.dubois
- mailchloe.dubois@northwind.com
- titleSoftware Engineer
- managerD. Okafor
- memberOfEng-All
- memberOfVPN-Austin
2.3s
- Paycom fields mapped
- 13
- Steps to go live
- 9
- Employee records stored in our cloud
- 0
Joiners, movers and leavers
How Paycom updates Active Directory
HR updates Paycom. ezOnboard updates accounts based on your rules.
Joiner
An account before day one
A person is added to Paycom with a hire date and Active status.
- Account created in the role’s OU, disabled until the start date
- Name, email and attributes set from Paycom
- Department and site groups added
- Account enabled on the start date; password change required at first sign-in
Mover
Access for the new role
A position title, department, location or primary supervisor changes in Paycom.
- Title, department, office and manager updated
- Account moved to the OU your rules specify
- Groups added and removed to match the new role
Leaver
Offboarding on schedule
A termination date is set in Paycom, or the employee status changes to Terminated.
- Account disabled on the termination date, never deleted
- Groups removed and the account moved to the disabled OU
- Mail forwarded and licenses recovered with connected Exchange and Microsoft 365 services
Before you start
What to have ready
Work with a Paycom admin and a directory admin to complete the setup.
- In Paycom
- Paycom API access arranged through your specialist, and admin access to API Setup
- A work email or employee code for each person in Paycom to match them to their account
- In Active Directory
- A domain-joined server running Windows Server 2019 or later
- A group managed service account or service account to run the agent
- Outbound HTTPS to the HR system and ezOnboard; no inbound access required
- OUs for staff accounts, disabled accounts and the groups ezOnboard will manage
Step by step
Set up Paycom with Active Directory
Start in Paycom and on your server. Then finish in the ezOnboard portal with our implementation team.
01
Paycom
Enable API access
User Options → User Access and Security → API Setup
Ask your Paycom specialist or automation team to enable the REST API, create an ezOnboard API user and allow your agent server’s public IP address. Requests from other addresses are blocked.
Open API Setup and edit the new user. Under Function Enablement, enable only the two functions below. Leave payroll, tax and sensitive functions off. ezOnboard only reads Paycom.
- Employee Directory: employee code, names, work email, position, department, location and supervisor
- Employee: hire date, rehire date, employee status and termination date
Function Enablement. Turn on Employee Directory and Employee only.
02
Paycom
Copy the SID and generate a token
User Options → User Access and Security → API Setup
Copy the SID from API Setup. It identifies your company and acts as the API username. Generate a token for ezOnboard to use as the password.
Save the token securely before leaving the page. It is shown only once, and generating a new token replaces it. You’ll need the SID and token in step 5.
API credentials. Copy the SID and the token. The token is shown only once.
03
Your server
Install the ezOnboard agent
The agent runs as a Windows service on a domain-joined server with Windows Server 2019 or later. It connects to Paycom and ezOnboard over outbound HTTPS. No inbound firewall rules are needed.
Download the signed MSI and enrollment bundle from the portal. Save the install code. The portal shows it only once. Run the MSI, enter the code and choose a service account, preferably a group managed service account. The installer checks the domain connection, LDAP access, outbound access and clock before making changes.
Installer screen with the setup requirements.
04
Active Directory
Delegate the OUs the agent will manage
Run the installer’s delegation script once as a domain administrator. It lets the agent’s service account create, update and disable accounts only in the OUs you choose. The agent doesn’t need Domain Admin rights.
Include the OUs for staff accounts, disabled accounts and managed groups. The agent blocks changes outside these OUs, even if a rule requests them.
PS C:\> & 'C:\ProgramData\ezOnboard\northwind\ou-delegation.ps1' Delegated NORTHWIND\svc-ezonboard$ on OU=Staff,DC=northwind,DC=com Delegated NORTHWIND\svc-ezonboard$ on OU=Disabled,DC=northwind,DC=com Delegated NORTHWIND\svc-ezonboard$ on OU=Groups,DC=northwind,DC=com DoneRun the installer’s delegation script once on a domain controller.
05
ezOnboard portal
Add Paycom as an HR source
In the portal, add Paycom as an HR source using the SID and API token. Your credentials are encrypted with your organization’s key and sent to your agent. The agent reads Paycom from your network. Nobody at ezOnboard can read the credentials.
Choose a field to match people across both systems, usually work email or employee ID. The agent checks Paycom every five minutes and catches up on any missed changes.
HR source. Your agent uses these credentials to read Paycom.
06
ezOnboard portal
Map Paycom fields to Active Directory attributes
Choose which Paycom fields update each directory attribute. Start with the defaults below, add custom fields or combine values. For example, build a display name from first and last names, format a job title or look up an office address by site.
Blank Paycom fields leave directory values unchanged unless you configure the mapping to clear them.
Field mapping. See the full list of defaults below.
07
ezOnboard portal
Set rules for accounts, OUs and groups
Rules define who gets an account, which OU it belongs in, how it’s named and which groups it joins. They also control offboarding. Use Paycom fields, such as department and site, to make those choices.
Our implementation team helps you write the rules. With approvals enabled, your team must approve each rule change before the agent uses it.
Rules page with the placement rule open.
08
ezOnboard portal
Preview changes with a dry run
Run a dry run for your whole workforce. The agent matches Paycom records to existing accounts by employee ID, then work email, and previews changes without applying them. If two accounts match one person, that action stops for review.
Review the planned changes and the rules behind them in the portal. Adjust your rules and repeat the dry run until the results match your expectations.
Dry run. No changes are applied while dry run is on.
09
ezOnboard portal
Go live
Turn off dry run to apply changes. If a run would disable or move more accounts than your safety limits allow, it stops and alerts your team before making changes. We review the first runs with you.
HR continues working in Paycom. Your rules handle new accounts, updates and offboarding on schedule. Get alerts by email, in the portal or by webhook when a run stops, the HR feed stops updating or the agent stops reporting. An inactive feed never triggers offboarding.
Reports with account activity, tickets avoided and agent uptime.
Field mapping
Paycom fields and Active Directory attributes
Start with these defaults and adjust any mapping. Dates and lifecycle status control when accounts are created, enabled or disabled.
| Paycom field | Active Directory attribute | How it’s used |
|---|---|---|
| First nameEmployee Directory | givenName | Sets the first name at account creation and keeps it up to date. |
| Last nameEmployee Directory | sn | Keeps the last name up to date. Also updates the logon name if your naming rule uses it. |
| Preferred nameEmployee Directory | displayName | Uses the preferred name for the display name and email. Uses the first name if blank. |
| Work emailEmployee Directory | mail, userPrincipalName | Sets the email address and sign-in name. A mail rule can also generate them from the person’s name. |
| Employee codeEmployee Directory | employeeID | Added to new accounts and used first to match existing accounts. |
| Position titleEmployee Directory | title | Keeps the job title up to date and sets groups based on your rules. |
| DepartmentEmployee Directory | department | Keeps the department up to date. Rules can use it to choose account placement and groups. |
| LocationEmployee Directory | physicalDeliveryOfficeName | Keeps the office up to date. A lookup table can also fill in the street, city and country. |
| Primary supervisorEmployee Directory | manager | Links to the manager’s account to keep approvals and org charts in sync with Paycom. |
| Hire dateEmployee | userAccountControl | Sets when the account is created and enabled. You choose how many days before the hire date to create it. |
| Rehire dateEmployee | userAccountControl | Replaces the hire date for a returning employee. The account is enabled again on this date. |
| Employee statusEmployee | userAccountControl | Active keeps the account enabled. Terminated disables it when no other record keeps the person active. |
| Termination dateEmployee | userAccountControl | Sets the date for disabling the account and starting offboarding. Your rules set the time. |
Frequently asked questions
- Does ezOnboard write to Paycom?
- No. ezOnboard only reads Paycom. Enable Employee Directory and Employee only. Make any corrections in Paycom.
- Which Paycom functions does the API user need?
- Under Function Enablement, turn on Employee Directory and Employee. Leave Employee Sensitive, payroll and tax functions off. ezOnboard never reads pay rates, bank details or Social Security numbers. Paycom also needs your agent server’s public IP address on its allowlist.
- Do we need Paycom’s Entra ID integration or SCIM?
- No. ezOnboard reads Paycom’s API and uses your rules to manage accounts in Active Directory or Entra ID. Its agent runs on your network and can also manage Exchange.
- Do we need a server for the agent?
- Yes. Use a domain-joined Windows Server with LDAP access to a domain controller and outbound HTTPS to Paycom and ezOnboard. The agent needs no inbound firewall rules or Domain Admin rights. The delegation script grants access only to the OUs it manages.
- How quickly does a Paycom change reach Active Directory?
- The agent checks Paycom every five minutes and usually applies changes within seconds of finding them. Scheduled changes follow your rules: accounts are created before the start date, enabled on that date and disabled on the termination date at the time you choose.
- How does Paycom trigger offboarding in Active Directory?
- On the termination date, the account is disabled, removed from its groups and moved to your disabled-accounts OU. It is never deleted. With Exchange and Microsoft 365 connected, your rules also schedule mail forwarding and license recovery. Every step is recorded for audit.
- Where does our employee data go?
- The agent reads Paycom and updates Active Directory from your server. Names, emails and HR records stay on your network, where your team can view them on a local status page. The portal receives events with pseudonymous IDs, the rule used and the result.
- Can ezOnboard also connect Paycom to Entra ID?
- Yes. One agent and one set of rules can manage Active Directory, Entra ID and Exchange from Paycom. For accounts synced from Active Directory, the agent updates the on-premises account and assigns licenses and mailboxes in the cloud.
Get a demo
See Paycom connected to Active Directory
Get a demo for your Paycom and Active Directory setup. For questions, email sales@ezonboard.io.