Active Directory
Connect Zoho People to Active Directory
Turn Zoho People hires, changes and departures into account updates in Active Directory. Follow the setup steps, preview changes with a dry run, then go live.
Zoho People record
08:02:14
Daniel Kim
2057
- Designation
- Software Engineer
- Department
- Engineering
- Location
- Austin
- Reporting To
- D. Okafor
- Date of joining
- Nov 10, 2026
- Employee Status
- Active
Active Directory
eng-austin
- accountOU=Engineering,OU=Staff
- sAMAccountNamedaniel.kim
- maildaniel.kim@northwind.com
- titleSoftware Engineer
- managerD. Okafor
- memberOfEng-All
- memberOfVPN-Austin
2.3s
- Zoho People fields mapped
- 13
- Steps to go live
- 9
- Employee records stored in our cloud
- 0
Joiners, movers and leavers
How Zoho People updates Active Directory
HR updates Zoho People. ezOnboard updates accounts based on your rules.
Joiner
An account before day one
An employee is added to Zoho People with a Date of joining and Active status.
- Account created in the role’s OU, disabled until the start date
- Name, email and attributes set from Zoho People
- Department and site groups added
- Account enabled on the start date; password change required at first sign-in
Mover
Access for the new role
A designation, department, location or manager changes in the Zoho People Employee form.
- Title, department, office and manager updated
- Account moved to the OU your rules specify
- Groups added and removed to match the new role
Leaver
Offboarding on schedule
A Date of Exit is set in Zoho People, or the person’s Employee Status changes to Resigned or Terminated.
- Account disabled on the termination date, never deleted
- Groups removed and the account moved to the disabled OU
- Mail forwarded and licenses recovered with connected Exchange and Microsoft 365 services
Before you start
What to have ready
Work with a Zoho People admin and a directory admin to complete the setup.
- In Zoho People
- A Zoho People user with the Admin role to register the client and authorize its scopes
- A work email or employee ID for each person in Zoho People to match them to their account
- In Active Directory
- A domain-joined server running Windows Server 2019 or later
- A group managed service account or service account to run the agent
- Outbound HTTPS to the HR system and ezOnboard; no inbound access required
- OUs for staff accounts, disabled accounts and the groups ezOnboard will manage
Step by step
Set up Zoho People with Active Directory
Start in Zoho People and on your server. Then finish in the ezOnboard portal with our implementation team.
01
Zoho People
Register a Self Client for ezOnboard
Zoho API console → Add Client → Self Client → Create
ezOnboard uses an OAuth client registered in the Zoho API console. Its tokens use the authorizing user’s permissions. Sign in with a company-managed Zoho People account that has the Admin role.
Open the Zoho API console for your data center. Add a client and choose Self Client. Copy the ID and secret from the Client Secret tab and store them securely.
Self Client. Copy the ID and secret from the Client Secret tab.
02
Zoho People
Prepare the authorization code
Self Client → Generate Code
On Generate Code, enter the scopes below, select the longest expiry and set the description to ezOnboard. Zoho requires ZOHOPEOPLE.employee.ALL because it has no read-only employee scope. ezOnboard only reads data.
Wait until step 5 to generate the code. It works once and expires within minutes. Paste it immediately with the client ID and secret to obtain a refresh token, which lasts until revoked. Note your data center from the console’s address, such as zoho.com, zoho.eu or zoho.in.
- ZOHOPEOPLE.forms.READ: the Employee form’s records
- ZOHOPEOPLE.employee.ALL: the employee APIs
Generate Code. Enter both scopes, then create the code when you reach step 5.
03
Your server
Install the ezOnboard agent
The agent runs as a Windows service on a domain-joined server with Windows Server 2019 or later. It connects to Zoho People and ezOnboard over outbound HTTPS. No inbound firewall rules are needed.
Download the signed MSI and enrollment bundle from the portal. Save the install code. The portal shows it only once. Run the MSI, enter the code and choose a service account, preferably a group managed service account. The installer checks the domain connection, LDAP access, outbound access and clock before making changes.
Installer screen with the setup requirements.
04
Active Directory
Delegate the OUs the agent will manage
Run the installer’s delegation script once as a domain administrator. It lets the agent’s service account create, update and disable accounts only in the OUs you choose. The agent doesn’t need Domain Admin rights.
Include the OUs for staff accounts, disabled accounts and managed groups. The agent blocks changes outside these OUs, even if a rule requests them.
PS C:\> & 'C:\ProgramData\ezOnboard\northwind\ou-delegation.ps1' Delegated NORTHWIND\svc-ezonboard$ on OU=Staff,DC=northwind,DC=com Delegated NORTHWIND\svc-ezonboard$ on OU=Disabled,DC=northwind,DC=com Delegated NORTHWIND\svc-ezonboard$ on OU=Groups,DC=northwind,DC=com DoneRun the installer’s delegation script once on a domain controller.
05
ezOnboard portal
Add Zoho People as an HR source
In the portal, add Zoho People as an HR source using the client ID, client secret and authorization code. Your credentials are encrypted with your organization’s key and sent to your agent. The agent reads Zoho People from your network. Nobody at ezOnboard can read the credentials.
Choose a field to match people across both systems, usually work email or employee ID. The agent checks Zoho People every five minutes and catches up on any missed changes.
HR source. Your agent uses these credentials to read Zoho People.
06
ezOnboard portal
Map Zoho People fields to Active Directory attributes
Choose which Zoho People fields update each directory attribute. Start with the defaults below, add custom fields or combine values. For example, build a display name from first and last names, format a job title or look up an office address by site.
Blank Zoho People fields leave directory values unchanged unless you configure the mapping to clear them.
Field mapping. See the full list of defaults below.
07
ezOnboard portal
Set rules for accounts, OUs and groups
Rules define who gets an account, which OU it belongs in, how it’s named and which groups it joins. They also control offboarding. Use Zoho People fields, such as department and site, to make those choices.
Our implementation team helps you write the rules. With approvals enabled, your team must approve each rule change before the agent uses it.
Rules page with the placement rule open.
08
ezOnboard portal
Preview changes with a dry run
Run a dry run for your whole workforce. The agent matches Zoho People records to existing accounts by employee ID, then work email, and previews changes without applying them. If two accounts match one person, that action stops for review.
Review the planned changes and the rules behind them in the portal. Adjust your rules and repeat the dry run until the results match your expectations.
Dry run. No changes are applied while dry run is on.
09
ezOnboard portal
Go live
Turn off dry run to apply changes. If a run would disable or move more accounts than your safety limits allow, it stops and alerts your team before making changes. We review the first runs with you.
HR continues working in Zoho People. Your rules handle new accounts, updates and offboarding on schedule. Get alerts by email, in the portal or by webhook when a run stops, the HR feed stops updating or the agent stops reporting. An inactive feed never triggers offboarding.
Reports with account activity, tickets avoided and agent uptime.
Field mapping
Zoho People fields and Active Directory attributes
Start with these defaults and adjust any mapping. Dates and lifecycle status control when accounts are created, enabled or disabled.
| Zoho People field | Active Directory attribute | How it’s used |
|---|---|---|
| First NameBasic Information | givenName | Sets the first name at account creation and keeps it up to date. |
| Last NameBasic Information | sn | Keeps the last name up to date. Also updates the logon name if your naming rule uses it. |
| Nick NameBasic Information | displayName | Uses the nickname for the display name and email. Uses the first name if blank. |
| Email IDBasic Information | mail, userPrincipalName | Sets the email address and sign-in name. A mail rule can also generate them from the person’s name. |
| Employee IDBasic Information | employeeID | Added to new accounts and used first to match existing accounts. |
| DesignationWork Information | title | Keeps the job title up to date and sets groups based on your rules. |
| DepartmentWork Information | department | Keeps the department up to date. Rules can use it to choose account placement and groups. |
| LocationWork Information | physicalDeliveryOfficeName | Keeps the office up to date. A lookup table can also fill in the street, city and country. |
| Reporting ToHierarchy Information | manager | Links to the manager’s account to keep approvals and org charts in sync with Zoho People. |
| Date of joiningWork Information | userAccountControl | Sets when the account is created and enabled. You choose how many days before the joining date to create it. |
| Employee StatusWork Information | userAccountControl | Active keeps the account enabled. Resigned or Terminated disables it when no other record keeps the person active. |
| Employee typeWork Information | userAccountControl | Rules can use Permanent, Contract or Intern to choose groups and licenses. |
| Date of ExitSeparation Information | userAccountControl | Sets the date for disabling the account and starting offboarding. Your rules set the time. |
Frequently asked questions
- Does ezOnboard write to Zoho People?
- No. ezOnboard only reads Zoho People. Zoho requires ZOHOPEOPLE.employee.ALL because it has no read-only employee scope. Make any corrections in Zoho People.
- Which Zoho People permissions does the client need?
- Use ZOHOPEOPLE.forms.READ and ZOHOPEOPLE.employee.ALL. Tokens inherit the authorizing user’s permissions. Use a company-managed Admin account with access to every employee record.
- Do we need Zoho People’s Entra ID integration or SCIM?
- No. ezOnboard reads Zoho People’s API and uses your rules to manage accounts in Active Directory or Entra ID. Its agent runs on your network and can also manage Exchange.
- Do we need a server for the agent?
- Yes. Use a domain-joined Windows Server with LDAP access to a domain controller and outbound HTTPS to Zoho People and ezOnboard. The agent needs no inbound firewall rules or Domain Admin rights. The delegation script grants access only to the OUs it manages.
- How quickly does a Zoho People change reach Active Directory?
- The agent checks Zoho People every five minutes and usually applies changes within seconds of finding them. Scheduled changes follow your rules: accounts are created before the start date, enabled on that date and disabled on the termination date at the time you choose.
- How does Zoho People trigger offboarding in Active Directory?
- On the termination date, the account is disabled, removed from its groups and moved to your disabled-accounts OU. It is never deleted. With Exchange and Microsoft 365 connected, your rules also schedule mail forwarding and license recovery. Every step is recorded for audit.
- Where does our employee data go?
- The agent reads Zoho People and updates Active Directory from your server. Names, emails and HR records stay on your network, where your team can view them on a local status page. The portal receives events with pseudonymous IDs, the rule used and the result.
- Can ezOnboard also connect Zoho People to Entra ID?
- Yes. One agent and one set of rules can manage Active Directory, Entra ID and Exchange from Zoho People. For accounts synced from Active Directory, the agent updates the on-premises account and assigns licenses and mailboxes in the cloud.
Get a demo
See Zoho People connected to Active Directory
Get a demo for your Zoho People and Active Directory setup. For questions, email sales@ezonboard.io.