Overview#
Connect Microsoft Entra ID or Google Workspace once, choose the directory groups that matter, review a clear diff of what will change, and import your entire workforce roster with no configuration files or manual CSVs. For most agencies the authoritative staff list already lives in the corporate identity provider, and keeping the platform's workforce records aligned with it by hand means re-typing hundreds of employees or shuttling spreadsheet exports that drift out of date the day they are produced.
This module gives workforce administrators a guided, one-click connection drawer for Microsoft Entra ID and Google Workspace. The provider is pre-selected when the flow is launched from that provider's integration card, the connection is validated before anything is imported, and progress is reported in plain language. A group picker scopes exactly which directory groups become platform workforce members, a staged sync presents a human review step before anything is applied, and the import then hands off safely to batched employee provisioning. Re-imports are safe to repeat, and provisioning failures stop the import rather than silently creating partial accounts.
Key Features#
- Guided Connection Drawer: A one-click, step-by-step drawer connects Microsoft Entra ID or Google Workspace, validates the connection, and reports progress in plain language before any import begins.
- Group-Scoped Import: A group picker lets administrators choose exactly which directory groups are in scope, so contractors, alumni, and service accounts stay out of the workforce roster.
- Staged Sync with Human Review: Every sync is staged first and presented as a clear diff of what will be created or changed; nothing is applied until a person approves it.
- Safe, Repeatable Re-Imports: Imports are idempotent, so periodic re-syncs update the roster without creating duplicates, and duplicate email addresses are attributed to the correct existing person.
- Fail-Closed Provisioning: Imports apply through the platform's account-provisioning chain; if account creation fails, the import halts and reports rather than half-completing with partial accounts.
- Tenant Isolation Throughout: Isolation is enforced on both the user and group sides of membership, so directory data from one organisation can never leak into another tenant's roster.
- Human-Readable Error Reporting: Connection and import problems are surfaced as clear, actionable messages; raw upstream provider errors never leak to the screen.
- Localised Experience: The connection and import flow is localised across the platform's supported languages.
Use Cases#
- Large-Agency Onboarding: An agency administrator onboards 400 staff from selected Entra ID groups in minutes, approving a reviewable diff instead of processing CSV files.
- HR Roster Alignment: An HR manager keeps the authoritative workforce roster in Google Workspace and periodically re-syncs it to the platform without ever creating duplicate records.
- Single-Sitting Rollout: A workforce administrator connects the corporate directory through the guided drawer and imports the entire staff roster in one sitting, with progress reported at every step.
- Scoped Team Provisioning: An operations lead imports only the dispatch and field-response groups from a large corporate directory, keeping unrelated departments out of the operational workforce.
Integration#
Directory import feeds the wider workforce capability directly: imported staff become platform workforce members, taking their place in workforce management and scheduling alongside employees added any other way. The connection flow hands off to the platform's batched employee import, and changes apply through the standard account-provisioning chain, so duplicate handling and fail-closed behaviour stay consistent however people arrive. The Google Workspace connector reads groups and members through service-account delegation against Google's Admin Directory API, and Microsoft Entra ID connection management is fully exposed through the platform's strongly-typed API for administrators who automate their rollout.
Open Standards#
- OAuth 2.0: Directory connections to Microsoft Entra ID and Google Workspace are authorised through the providers' standard OAuth 2.0 authorisation flows.
- RFC 7519 (JSON Web Tokens): Google Workspace service-account delegation authenticates with signed JWT assertions exchanged for scoped access tokens, following Google's published service-account flow.
- TLS: All directory synchronisation traffic between the platform and provider endpoints is encrypted in transit.
- ISO 8601: Timestamps on connection records, staged syncs, and provisioning outcomes are serialised in standard date-time format for consistent auditing and interoperability.
Last Reviewed: 2026-07-16 Last Updated: 2026-07-16