HR-Driven Provisioning in Microsoft Entra ID: Workday, SuccessFactors, Dayforce and Other HR Systems

HR-driven provisioning makes the HR system the source of truth for identity: a hire in the HR platform creates the account, a change of role updates its access, and a termination disables it. Microsoft Entra ID does this with built-in connectors for Workday and SAP SuccessFactors, and with API-driven inbound provisioning for every other HR system, including Dayforce, Oracle HCM, UKG and BambooHR. Accounts can be created in Entra ID, in on-premises Active Directory, or both.

How HR-driven provisioning works in Microsoft Entra ID

HR-driven provisioning in Microsoft Entra ID reads worker records from the HR system, maps HR attributes to directory attributes, and creates, updates or disables accounts to match. The Entra provisioning service handles the sync, and a lightweight provisioning agent writes to on-premises Active Directory where needed.

A typical flow looks like this:

HR record created → account created in Active Directory and Entra ID → groups and licences assigned from job attributes → email and username written back to the HR record → lifecycle workflow sends first-day credentials to the manager

Microsoft's overview of HR-driven provisioning describes the two routes: prebuilt cloud connectors for Workday and SuccessFactors, and API-driven inbound provisioning for other systems of record. Both use the same provisioning service, attribute mapping and logs, so the design work is similar whichever HR platform feeds it.

Workday and SAP SuccessFactors provisioning to Entra ID

Workday and SAP SuccessFactors connect to Microsoft Entra ID through built-in inbound provisioning apps. Each comes in two forms: one that provisions to on-premises Active Directory through the provisioning agent, and one that provisions directly to Entra ID for cloud-only users.

Setup follows the same steps for both platforms, as Microsoft's employee lifecycle deployment guide sets out:

1. Create an integration system user in Workday, or API permissions in SuccessFactors, with read access to the worker data Entra needs.
2. Add the inbound provisioning app in Entra ID and connect it to the HR tenant.
3. Map HR attributes to directory attributes: employee ID, name, department, job code, manager, location, start date and termination date.
4. Set the matching attribute, usually employee ID, so existing Active Directory accounts link to their HR record and no duplicates are created.
5. Add scoping filters to limit the first sync to a pilot population.
6. Turn on writeback so the email address and username created in the directory flow back to the HR record.

The built-in connectors poll the HR system on a provisioning cycle, typically about 40 minutes, so changes appear in the directory within the hour.

Dayforce, Oracle HCM and other HR systems: API-driven inbound provisioning

HR systems without a built-in Entra connector, such as Dayforce, Oracle HCM, UKG, BambooHR, SAP HCM and in-house HR databases, use Microsoft Entra API-driven inbound provisioning. The HR system, or a small integration between it and Entra, sends worker records to the provisioning API as SCIM payloads, and the Entra provisioning service handles the rest the same way it does for Workday.

Common integration options include:

• A scheduled PowerShell script that exports changed workers from the HR system and posts them to the API.
• Azure Logic Apps, which read an HR export or API and call the provisioning endpoint.
• The HR platform's own integration tools, where they can call a REST endpoint with OAuth.
• CSV files dropped by the HR system for platforms with limited APIs.

Because the HR side pushes changes, API-driven provisioning can update Entra soon after the HR change, with no fixed polling cycle. The same API also serves contractor and non-employee sources that live outside the main HR platform, which is often the cleanest answer for populations the HR licence does not cover.

Joiner, mover, leaver design with Entra ID Governance

The connector creates and disables accounts. The access each person gets comes from the joiner, mover and leaver design around it, built from three Entra ID Governance features.

Three Entra ID Governance features carry the design:

• Dynamic groups assign membership from attributes such as department, job code or location, and drive licence and application assignment.
• Access packages in entitlement management bundle groups, applications and SharePoint sites, and an automatic assignment policy grants them to everyone matching an attribute rule.
• Lifecycle workflows carry out tasks on dates and events from the HR record, such as generating a Temporary Access Pass before the start date or removing all group memberships on the last day.

Azure RBAC assignments follow group membership too, so a cloud engineer joining a team inherits the subscription roles that team holds. Administrator roles are best kept out of automatic assignment and granted through Privileged Identity Management with approval and expiry.

Clean HR data decides how well HR-driven provisioning works

HR-driven provisioning follows the HR record as written, so data quality in the HR system decides the quality of access. The fields that cause the most rework are the manager, department and job code, worker type (employee, contractor, intern) and start and end dates.

A short data review before the pilot pays back across every flow. Check that every active worker has a manager, that job codes map to a defined set of access, that rehires reuse their employee ID, and that contractors have end dates. Agree with HR who owns each field, because a typo in a job code becomes a wrong group membership within the hour.

How HR-driven provisioning supports SOC 2 and ISO 27001

HR-driven provisioning produces the records auditors test for access control. SOC 2 CC6.2 requires that user access is registered, authorized and removed on a defined process, and the SOC 2 CC6.2 guide lists the evidence auditors sample. ISO 27001 A.5.16 and A.5.18 cover identity management and access rights.

With HR-driven provisioning, the evidence for a sampled leaver is the HR termination date, the Entra provisioning log showing the disable, and the lifecycle workflow history showing groups and sessions removed, all dated. Companies without automation can still meet these controls with manual steps, as the guide to SOC 2 HR security without automated provisioning describes, and the automated records reduce sampling effort in each audit. Forwarding provisioning logs to the central log store keeps them for the full audit period.

Practical steps to set up HR-driven provisioning in Entra ID

1. Name the HR sources. List every system that holds worker records, including contractor and intern sources, and check which have a built-in Entra connector.
2. Review HR data quality. Managers, job codes, worker types and dates, with a named owner for each field.
3. Define access by role. Map job codes and departments to groups, applications and access packages.
4. Configure the provisioning app. Attribute mappings, matching on employee ID, scoping filter for a pilot group.
5. Build lifecycle workflows. Pre-hire, start date, mover and leaver tasks, including a Temporary Access Pass so new hires register phishing-resistant MFA on the first day, as the guide to phishing-resistant MFA in Entra ID describes.
6. Pilot and compare. Start with one department or region, compare the accounts and access Entra produces with what IT would have set up by hand, and fix mappings.
7. Scale in waves. Extend the scoping filter region by region and retire manual tickets or MIM flows as each population moves. Organizations moving from Microsoft Identity Manager can follow the MIM end of life migration plan.
8. Set the review cadence. Access reviews for privileged roles and high-risk applications, with records kept for audit.

HR-driven provisioning gives every worker the right access from the first day

HR-driven provisioning in Microsoft Entra ID turns the HR record into the account: Workday and SAP SuccessFactors through built-in connectors, Dayforce and other HR systems through API-driven inbound provisioning. Organizations that pair it with clean HR data and a joiner, mover and leaver design get access ready on day one, removed on the last day, and dated records for every audit.

Connecting Workday, SuccessFactors, Dayforce or another HR platform to Entra ID? Truvo's identity architects design the attribute mappings, lifecycle workflows and access model, and roll them out in waves alongside your HR and IT teams. See Microsoft Entra ID consulting or book a strategy call.

Frequently asked questions

What is HR-driven provisioning?

HR-driven provisioning uses the HR system as the source of truth for user accounts. A new hire in the HR system creates the account in the directory, attribute changes update it, and a termination disables it, without IT tickets in between. Microsoft Entra ID supports it for Workday, SAP SuccessFactors and, through API-driven inbound provisioning, any other HR system.

Does Microsoft Entra ID integrate with Dayforce?

Dayforce connects to Microsoft Entra ID through API-driven inbound provisioning. An integration, such as a scheduled PowerShell script, Azure Logic Apps or Dayforce's own integration tools, sends worker records to the Entra provisioning API as SCIM payloads, and Entra creates and updates accounts in Entra ID and Active Directory.

Can Workday provision directly to on-premises Active Directory through Entra?

Yes. The Workday to Active Directory provisioning app in Entra ID uses a provisioning agent installed on a server in the domain to create and update Active Directory accounts. Entra Connect or cloud sync then brings those accounts into Entra ID.

How are contractors handled in HR-driven provisioning?

Contractors can be added to the HR system, provisioned from a separate source through API-driven inbound provisioning, or managed through Entra entitlement management with a sponsor and an expiry date. Each option needs an owner and an end date for every contractor record.

Which licences does HR-driven provisioning need in Entra ID?

Inbound provisioning, lifecycle workflows and entitlement management have different licensing requirements across Microsoft Entra ID P1, P2 and Entra ID Governance. Confirm the current requirements with Microsoft's licensing guidance for each feature and for each population, including contractors, during the assessment.

Sources

• Microsoft Learn, What is HR-driven provisioning
• Microsoft Learn, Deploy employee lifecycle governance (Workday, SuccessFactors, API-driven inbound provisioning)
• Microsoft Learn, Provision custom security attributes from HR sources