HRIS integration via Entra ID SCIM

End-to-end integration between the company's new centralized HRIS and Microsoft Entra ID via the Microsoft Entra SCIM connector, making the HRIS the system of record for employee lifecycle events (hires, role and department changes, departures) that fan out through Entra into the rest of the company's identity, licensing, access, and downstream business-app footprint.

One of four formally-tracked 2026 IT goals, and currently in UAT. It is consolidation work rather than a greenfield build: the lifecycle automation already runs, and this replaces its three upstream inputs with one.

What this is consolidating

The full employee lifecycle is already automated. Joiner, mover, and leaver events all originate from HR submissions and flow through automation into Entra ID, with IT verifying and approving rather than performing the steps by hand. A Power Apps intake front end in Teams and a set of Power Automate flows create the account and place the user in the correct license-assigning group at creation, so licensing applies automatically. Naming-standards-driven dynamic groups handle Conditional Access scoping and distribution list membership from there. Terminations are the exception: conditional, ordered, and scheduled, so they run through the confirm-gated operations agent instead of a flow. The service catalog and onboarding automation write-up covers that machinery in detail.

The interesting constraint is upstream. Lifecycle records arrive from three different HR platforms, a consequence of growth through acquisition, and each carries its own data model and export behavior, so they have to be normalized before they reach Entra ID. Absorbing that heterogeneity is a harder problem than a single clean connector, and it is the work this project is built on top of.

This project takes the next step: one centralized HRIS with native SCIM provisioning, so the three sources collapse into one system of record and the normalization layer stops being load-bearing.

Why this matters

Lifecycle events are still initiated as tickets in Freshservice, which is where the manual surface area lives: every onboarding and offboarding since Freshservice went live has been processed as a ticket. A direct system-of-record sync between HR and identity is what removes the ticket as the trigger.

The integration changes the shape of the work:

• HR maintains the employee record in the HRIS as the source of truth.
• The Entra SCIM connector provisions, updates, and deprovisions Entra ID user objects directly.
• Downstream automation (license assignment via dynamic groups, Conditional Access scoping, distribution lists, Intune targeting, all driven by the Entra ID Department attribute per the naming standards) follows unchanged.
• IT moves further toward exception-handling, with the verify-and-approve step kept deliberately in place.

User attribute standardization

A companion standards document defines the canonical mapping between HRIS employee attributes and Entra ID user attributes. The load-bearing alignment work: without it, Department / Job Title / Manager / Location values arrive in Entra in inconsistent shapes that break the dynamic groups, the M&A naming standards, and the per-region license assignment.

The standards doc covers attribute-by-attribute mapping (HRIS attribute to Entra ID attribute, including the 15 extension attributes already in use), standardized values for Department / Division / Region, required vs optional attribute rules, and validation logic for ingestion.

SCIM connector configuration

The Microsoft Entra SCIM connector configuration covers the technical glue: the HRIS initiates the SCIM provisioning calls against Entra, and Entra interprets those as user-object CRUD operations. A customer-input requirements document captures the company-side decisions:

• Which SCIM operations are enabled (create, update, deactivate, delete).
• Attribute mapping inside the connector.
• Filtering rules (which employee categories sync to Entra, which do not).
• Provisioning cadence and conflict-resolution rules.

IT-side onboarding and configuration checklist

A formal IT-side checklist walks the configuration through end to end: implementation team contacts, IT-team prerequisites, attribute mappings, test plans, UAT gates, go-live criteria. The document the vendor's implementation team works against and the IT team uses to validate.

UAT plan and execution

User Acceptance Testing is the current phase, and the gate that catches the inevitable attribute-mapping edge cases, regional naming inconsistencies, and SCIM-operation surprises before the integration ships to production for the full 1,000-plus-employee user base.

A formal handoff package consolidates the UAT artifacts, the attribute standards, and the configuration checklist into a single deliverable that the vendor's implementation team executes against on their side.

Downstream CRM email-notification flow

Separate but related flow design: when the HRIS raises a lifecycle event relevant to the sales team's CRM (the company CRM), the CRM gets a structured email notification. Decouples the CRM team's onboarding / offboarding awareness from the Freshservice ticket queue and keeps the sales side informed in near-real-time.

What this demonstrates

• HRIS-to-identity integration ownership at the enterprise scale: SCIM connector design, attribute mapping, UAT, vendor handoff, downstream notification flow.
• System-of-record discipline Instead of asking IT to manually mirror HR's state, the integration makes the HRIS the source of truth and Entra ID a derived view, which is the right architectural shape.
• Consolidation over accretion Three upstream HR platforms normalized into one system of record, rather than adding a fourth integration path and living with the branching.
• Cross-team documentation The integration touches HR, IT, the vendor's implementation team, and the CRM / sales team, with separate artifacts targeted at each.
• Attribute-standards work as load-bearing prep Standardizing the user attributes before turning on SCIM is the design choice that prevents the dynamic-groups blast radius from being a release blocker.
• UAT discipline Formal UAT phase with handoff documentation rather than "go straight to prod and watch what breaks."
• Composability with existing architecture The integration writes into the same attribute shape the naming standards already require, so all existing dynamic-group / license-assignment / Conditional Access / Intune work picks up HRIS-driven changes without modification.