Microsoft renamed Azure Active Directory to Microsoft Entra ID in 2023, but the job hasn’t changed. Entra ID controls who can sign in to Microsoft 365, Teams and the apps connected through single sign-on. If it’s out of date, so is everything that depends on it.

For companies on UKG, the most reliable way to keep Entra ID current is to let UKG drive it.

Cloud-only or hybrid: which one are you?

Before planning a sync, confirm how your identities are managed today:

• Cloud-only. Users are created and managed directly in Entra ID, and on-premises Active Directory isn’t used for identities.

• Hybrid. Users are created in on-premises Active Directory and synchronized to Entra ID with Microsoft Entra Connect or Cloud Sync.

In a hybrid setup, changes belong in your on-premises directory, because synced attributes are generally read-only in the cloud. In a cloud-only setup, changes go straight to Entra ID through Microsoft Graph. Connect to AD supports both, so you can keep your current model and change it later without replacing your HR integration.

What a UKG to Entra ID sync handles

• New hire accounts with the right display name and attributes

• Profile data such as job title, department, office, phone and employee ID

• Manager, so reporting lines show correctly in Teams and Outlook

• Group membership, including Entra ID security groups and Microsoft 365 groups

• Licenses, assigned through group-based licensing

• Terminations, which disable the account and remove group access

Licensing through groups

One of the biggest wins in Entra ID is tying licenses to group membership. With Group Mapping, each group gets a simple true or false rule, for example everyone in a given department or location. When an employee matches, they’re added. When they stop matching, they’re removed.

Combine that with group-based licensing and new hires get the right Microsoft 365 license automatically, while people who leave stop using one.

Why UPN changes need care

Name changes are common, and they’re one of the trickiest parts of identity management. Changing a user principal name can break sign-ins, shared links and connections to other apps. That’s why Connect to AD doesn’t change the UPN automatically. It detects the name change in UKG and can notify your team, so you decide when and how to update it.

Security for cloud connections

Connect to AD runs on a Windows server in your environment and connects outbound over HTTPS to UKG and Microsoft Graph. There’s no vendor cloud in the data path, and connection credentials are encrypted at rest. If your security team needs evidence, our SOC 2 Type 2 report is available from the Security page.

See it with your own tenant

The best way to evaluate a UKG to Entra ID sync is with your own data. Try Connect to AD for free with guided setup sessions, or book a demo to walk through your setup with our team.