Populate users from an authoritative source

Import your users from a source such as your HR system. An Identity Sync brings their attributes and manager relationships into the Owlie directory and keeps them up to date. Those attributes help Owlie decide who needs access and when it should change.

Start with the Owlie model if the distinction between an identity and an account is new to you. This step builds the identity population. Provisioning application accounts comes later.

Decide where your people come from

Choose the system you trust to describe employment and organizational changes. This is often your HR system, but it may be a directory or another authoritative source. Consider which populations it actually covers: employees, contractors, and external collaborators may not all live in the same place.

Start with one clearly defined population. Identify a stable field that can match a source record to the correct Owlie identity, and decide what should happen when there is no match. Email can work, but only if it is populated, unique, and suitable for matching in your organization. Plan for renamed addresses and rehires rather than assuming every new-looking record is a new person.

If several sources describe the same person, decide which source should own each attribute. For example, HR might own department and employment status while a directory supplies an email address. See attribute source priority.

Plan the attributes you need

Choose attributes that your access policies, approvals, and reviews will need. For example, a policy for Engineering employees needs department and employment-status data.

Information	Why it matters
Stable identifier and work email	Matching source records to identities without creating duplicates.
Name	Recognizing the person in requests, reviews, and administration.
Department, location, and worker type	Selecting the right people for access policies.
Manager	Routing manager approvals and describing reporting relationships.
Employment status and relevant dates	Deciding when someone joins, becomes active, takes leave, or leaves.
Organization-specific attributes	Supporting decisions such as access by cost center or business unit.

Use existing directory attributes where they fit. Create custom attributes for additional data before adding their Sync mappings. Match each attribute's type to its data: use a date attribute for a start date, for example.

Decide how employment becomes lifecycle state

Read Lifecycle state and overrides before configuring this part. It explains how source attributes become a normalized Owlie lifecycle state and how that state can drive joiner, mover, and leaver policies.

Which field in your source tells you whether a person should have access? It might be an employment status such as HIRED, TERMINATED, or ONLEAVE, combined with a start or end date. Those source labels are not an access policy by themselves. A hired person may not have started yet; a person on leave may retain some access and lose other access.

Bring the relevant source attributes into Owlie, then define the lifecycle rules that interpret them. Define how to handle missing values, unfamiliar statuses, future start dates, and departures. Do not silently treat an unrecognized status as active.

An incorrect lifecycle state can give someone access or remove access they need. Check your rules against examples of each employment status before using them in access policies.

Diagram placeholder: From source data to access decisions. Show source status and dates flowing through Sync mappings into identity attributes, then lifecycle rules, normalized lifecycle state, and configured JML policies. Keep the data import and policy decision steps distinct.

Configure the first Sync

Install the connector for your chosen source and configure its connection using the relevant integration guide. Its credentials must be able to read the intended population and the fields you selected above.

In Admin > Integrations > Sync, look for an account Sync job for that integration. If one was not created during installation, use Create sync job to select the integration and its account entity. The connector may call that entity a user, employee, or account.

In the job's Behavior configuration, choose Identity to create and update the directory population. Hybrid also tracks source accounts as assigned resources. Consider it only when you also need to govern those accounts as access, for example, when employees' accounts in the HR system are themselves something you manage. Sync behavior explains the Identity, Resource, and Hybrid choices.

Before running the job, review these decisions:

Configuration	What to check
Fetch scope	The connector can read the intended population and every field your mappings use. Check which records any filters or limits exclude.
Account matching	The matching field reliably identifies one person. Check what happens to both matched and unmatched records.
Identity actions	Matching a person is not the same as updating their attributes. Confirm whether matched identities are updated and unmatched records create identities, are flagged, or are ignored.
Attribute mappings	Required attributes are mapped, expressions return the expected types, and mappings apply on creation and/or update as intended.
Manager relationship	Map the source manager reference to an identity relationship, not just a manager's display name.
Lifecycle inputs	Status and date mappings provide the values your directory's lifecycle rules actually evaluate.
Source changes	Understand the behavior when values change or records disappear, including the difference between full and partial runs.
Schedule	Choose a cadence and time zone appropriate to how quickly employment changes need to reach Owlie.

Screenshot placeholder: Identity Sync behavior. Annotate the Identity selection, matching rule, matched/unmatched actions, and attribute-mapping entry point on the current Behavior screen. Use a neutral example rather than provider-specific instructions.

The detailed configuration lives in account matching, attribute mappings and OXL, and handling source changes. Manager mappings use relationship references; the attribute-mapping guide explains how Owlie resolves them.

Run it, then inspect the people

Before running, check the termination mappings and selected population, especially if the Sync can match existing administrators. Import is not necessarily read-only for existing identities: entering TERMINATED disables their Owlie account, and the active termination deny can start removing managed access. Do not assume these effects wait for you to create your first policy. See Lifecycle state and overrides.

Run a full Sync and follow its status and record results. A completed run means processing has finished, but individual records may have failed. Check failures, created and updated identity counts, and records that were ignored or could not be matched.

Then open Admin > Directory. Check representative people, not just the total count: a new hire with a future start date, an active employee, someone on leave, someone who has left, and a person with a manager. Confirm their attributes, manager relationship, and resolved lifecycle state. Check that existing people were matched rather than duplicated.

If results differ from your expectations, correct source visibility, matching, mappings, or lifecycle rules before using this population to drive access policies. A filtered or limited run does not establish the same cleanup baseline as a full authoritative run; see Sync run types and schedules.

After checking the imported identities, continue to Configure sign-in.