Get a demo
All integration guides

Sage HRActive Directory

Connect Sage HR to Active Directory

Turn Sage HR hires, changes and departures into account updates in Active Directory. Follow the setup steps, preview changes with a dry run, then go live.

Book a demoView setup steps
Sage HR fields mapped
12
Steps to go live
9
Employee records stored in our cloud
0

Joiners, movers and leavers

How Sage HR updates Active Directory

HR updates Sage HR. ezOnboard updates accounts based on your rules.

Joiner

An account before day one

A person is added to Sage HR with an employment start date.

  • Account created in the role’s OU, disabled until the start date
  • Name, email and attributes set from Sage HR
  • Department and site groups added
  • Account enabled on the start date; password change required at first sign-in

Mover

Access for the new role

A position, team, location or direct manager changes in Sage HR’s Employment tab.

  • Title, department, office and manager updated
  • Account moved to the OU your rules specify
  • Groups added and removed to match the new role

Leaver

Offboarding on schedule

An employee is terminated in Sage HR with a last working day.

  • Account disabled on the termination date, never deleted
  • Groups removed and the account moved to the disabled OU
  • Mail forwarded and licenses recovered with connected Exchange and Microsoft 365 services

Before you start

What to have ready

Work with a Sage HR admin and a directory admin to complete the setup.

In Sage HR
  • Sage HR administrator access with Can access settings to enable API access and generate a key
  • A work email or employee number for each person in Sage HR to match them to their account
In Active Directory
  • A domain-joined server running Windows Server 2019 or later
  • A group managed service account or service account to run the agent
  • Outbound HTTPS to the HR system and ezOnboard; no inbound access required
  • OUs for staff accounts, disabled accounts and the groups ezOnboard will manage

Step by step

Set up Sage HR with Active Directory

Start in Sage HR and on your server. Then finish in the ezOnboard portal with our implementation team.

  1. 01

    Sage HR

    Create a dedicated administrator

    Settings → Permissions → Admin

    A Sage HR API key uses its administrator’s permissions. Create an ezOnboard employee record and set its access level to Administrator on the Employee tab. A dedicated record keeps access independent of staff changes.

    In Permissions → Admin, enable Can access settings for ezOnboard. No other permission roles are needed. Sign in as this administrator for the next step.

    Admin permissions. The ezOnboard administrator needs Can access settings.

  2. 02

    Sage HR

    Enable API access and copy the key

    Settings → Integrations → API

    Open Settings → Integrations → API and choose Enable API access. Copy the value beside Your API key. If access is already enabled, leave it on. Turning it off and on generates new keys and breaks existing connections.

    Store the key securely. Note your company subdomain: the part of your address before .sage.hr. You’ll need both in step 5.

    API access enabled. Turning it off and on creates a new key and breaks existing connections.

  3. 03

    Your server

    Install the ezOnboard agent

    The agent runs as a Windows service on a domain-joined server with Windows Server 2019 or later. It connects to Sage HR and ezOnboard over outbound HTTPS. No inbound firewall rules are needed.

    Download the signed MSI and enrollment bundle from the portal. Save the install code. The portal shows it only once. Run the MSI, enter the code and choose a service account, preferably a group managed service account. The installer checks the domain connection, LDAP access, outbound access and clock before making changes.

    Installer screen with the setup requirements.

  4. 04

    Active Directory

    Delegate the OUs the agent will manage

    Run the installer’s delegation script once as a domain administrator. It lets the agent’s service account create, update and disable accounts only in the OUs you choose. The agent doesn’t need Domain Admin rights.

    Include the OUs for staff accounts, disabled accounts and managed groups. The agent blocks changes outside these OUs, even if a rule requests them.

    PS C:\> & 'C:\ProgramData\ezOnboard\northwind\ou-delegation.ps1'
Delegated NORTHWIND\svc-ezonboard$ on OU=Staff,DC=northwind,DC=com
Delegated NORTHWIND\svc-ezonboard$ on OU=Disabled,DC=northwind,DC=com
Delegated NORTHWIND\svc-ezonboard$ on OU=Groups,DC=northwind,DC=com
Done

    Run the installer’s delegation script once on a domain controller.

  5. 05

    ezOnboard portal

    Add Sage HR as an HR source

    In the portal, add Sage HR as an HR source using the API key and your company subdomain. Your credentials are encrypted with your organization’s key and sent to your agent. The agent reads Sage HR from your network. Nobody at ezOnboard can read the credentials.

    Choose a field to match people across both systems, usually work email or employee ID. The agent checks Sage HR every five minutes and catches up on any missed changes.

    HR source. Your agent uses these credentials to read Sage HR.

  6. 06

    ezOnboard portal

    Map Sage HR fields to Active Directory attributes

    Choose which Sage HR fields update each directory attribute. Start with the defaults below, add custom fields or combine values. For example, build a display name from first and last names, format a job title or look up an office address by site.

    Blank Sage HR fields leave directory values unchanged unless you configure the mapping to clear them.

    Field mapping. See the full list of defaults below.

  7. 07

    ezOnboard portal

    Set rules for accounts, OUs and groups

    Rules define who gets an account, which OU it belongs in, how it’s named and which groups it joins. They also control offboarding. Use Sage HR fields, such as department and site, to make those choices.

    Our implementation team helps you write the rules. With approvals enabled, your team must approve each rule change before the agent uses it.

    Rules page with the placement rule open.

  8. 08

    ezOnboard portal

    Preview changes with a dry run

    Run a dry run for your whole workforce. The agent matches Sage HR records to existing accounts by employee ID, then work email, and previews changes without applying them. If two accounts match one person, that action stops for review.

    Review the planned changes and the rules behind them in the portal. Adjust your rules and repeat the dry run until the results match your expectations.

    Dry run. No changes are applied while dry run is on.

  9. 09

    ezOnboard portal

    Go live

    Turn off dry run to apply changes. If a run would disable or move more accounts than your safety limits allow, it stops and alerts your team before making changes. We review the first runs with you.

    HR continues working in Sage HR. Your rules handle new accounts, updates and offboarding on schedule. Get alerts by email, in the portal or by webhook when a run stops, the HR feed stops updating or the agent stops reporting. An inactive feed never triggers offboarding.

    Reports with account activity, tickets avoided and agent uptime.

Field mapping

Sage HR fields and Active Directory attributes

Start with these defaults and adjust any mapping. Dates and lifecycle status control when accounts are created, enabled or disabled.

Sage HR fieldActive Directory attributeHow it’s used
First namePersonalgivenNameSets the first name at account creation and keeps it up to date.
Last namePersonalsnKeeps the last name up to date. Also updates the logon name if your naming rule uses it.
EmailPersonalmail, userPrincipalNameSets the email address and sign-in name. A mail rule can also generate them from the person’s name.
Employee numberEmploymentemployeeIDAdded to new accounts and used first to match existing accounts.
PositionEmploymenttitleKeeps the job title up to date and sets groups based on your rules.
TeamEmploymentdepartmentKeeps the department up to date. Rules can use it to choose account placement and groups.
LocationEmploymentphysicalDeliveryOfficeNameKeeps the office up to date. A lookup table can also fill in the street, city and country.
Direct managerEmploymentmanagerLinks to the manager’s account to keep approvals and org charts in sync with Sage HR.
Employment start dateEmploymentuserAccountControlSets when the account is created and enabled. You choose how many days before the start date to create it.
Employment statusEmploymentuserAccountControlA current status keeps the account enabled. Rules can also use Full-time, Part-time or Contractor to choose groups and licenses.
TerminatedEmployment › TerminationuserAccountControlDisables the account when the employee is terminated and no other record keeps them active.
Last working dayEmployment › TerminationuserAccountControlSets the date for disabling the account and starting offboarding. Your rules set the time.

Frequently asked questions

Does ezOnboard write to Sage HR?
No. ezOnboard only reads Sage HR using its administrator’s permissions. It doesn’t create, update or terminate employees. Make any corrections in Sage HR.
Which Sage HR permissions does the API key need?
Give a dedicated ezOnboard record Administrator access with Can access settings. Its API key uses those permissions. No other permission roles are needed.
Do we need Sage HR’s Entra ID integration or SCIM?
No. ezOnboard reads Sage HR’s API and uses your rules to manage accounts in Active Directory or Entra ID. Its agent runs on your network and can also manage Exchange.
Do we need a server for the agent?
Yes. Use a domain-joined Windows Server with LDAP access to a domain controller and outbound HTTPS to Sage HR and ezOnboard. The agent needs no inbound firewall rules or Domain Admin rights. The delegation script grants access only to the OUs it manages.
How quickly does a Sage HR change reach Active Directory?
The agent checks Sage HR every five minutes and usually applies changes within seconds of finding them. Scheduled changes follow your rules: accounts are created before the start date, enabled on that date and disabled on the termination date at the time you choose.
How does Sage HR trigger offboarding in Active Directory?
On the termination date, the account is disabled, removed from its groups and moved to your disabled-accounts OU. It is never deleted. With Exchange and Microsoft 365 connected, your rules also schedule mail forwarding and license recovery. Every step is recorded for audit.
Where does our employee data go?
The agent reads Sage HR and updates Active Directory from your server. Names, emails and HR records stay on your network, where your team can view them on a local status page. The portal receives events with pseudonymous IDs, the rule used and the result.
Can ezOnboard also connect Sage HR to Entra ID?
Yes. One agent and one set of rules can manage Active Directory, Entra ID and Exchange from Sage HR. For accounts synced from Active Directory, the agent updates the on-premises account and assigns licenses and mailboxes in the cloud.

Get a demo

See Sage HR connected to Active Directory

Get a demo for your Sage HR and Active Directory setup. For questions, email sales@ezonboard.io.

Optional

This site is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.