UKG and Active Directory Integration: The Complete Guide for IT Teams
Everything IT teams need to know about connecting UKG Pro, UKG Ready or UKG Onboarding to Active Directory and Entra ID, from what to sync to how to go live safely.
If your company runs HR and payroll in UKG, your employee data already lives there. Names, job titles, departments, managers, hire dates and terminations are all entered in UKG first. The problem is that your user accounts live somewhere else: in Active Directory, Microsoft Entra ID, or both.
Without an integration, someone has to copy that information across by hand. This guide explains what a UKG and Active Directory integration does, what you should sync, and how to roll one out without disrupting your users.
Why UKG should drive your directory
HR is the first team to know when someone joins, moves or leaves. When UKG is the source of truth for identity, your directory reflects reality instead of whatever was last typed into a ticket. That brings three clear benefits:
Faster onboarding. New hires get accounts before their first day instead of waiting in a ticket queue.
Stronger security. Terminated employees lose access as soon as HR processes the termination.
Cleaner data. Titles, departments and managers match across UKG, Outlook, Teams and every app that reads from your directory.
The three events every integration must handle
A good integration covers the whole employee lifecycle, not just account creation.
Joiners. A new employee is added in UKG. The integration creates the account with the right logon name, OU, attributes and groups.
Movers. An employee changes job, department, location or manager. The integration updates the directory and adjusts group membership so access follows the role.
Leavers. An employee is terminated. The integration disables the account, removes group access and moves it to a disabled users OU.
Most homegrown scripts handle joiners well and leave movers and leavers for later. Those two are where the risk sits, so plan for them from day one.
What to sync from UKG
Start with the fields your users and apps rely on every day:
First name, last name and preferred name
Job title, department and office location
Manager, so reporting lines show correctly in Outlook and Teams
Employee ID and company code
Phone numbers
Custom UKG fields that other systems need, mapped to extension attributes
With Field Mapping, each directory attribute is mapped to a UKG field or an expression, and each sync only updates what changed.
Active Directory, Entra ID or hybrid
Connect to AD works with on-premises Active Directory, hybrid environments and Microsoft Entra ID. In a hybrid setup, it updates your on-premises directory and your existing Microsoft sync carries the changes to the cloud. In a cloud-only setup, it writes to Entra ID through Microsoft Graph.
Security questions to ask before you connect anything
Your HR data is sensitive, so how an integration runs matters as much as what it does. Ask every vendor:
Where does the software run, and does employee data ever leave our network?
Does it need domain admin rights?
Are connections encrypted, and are credentials stored safely?
Has the vendor’s security been independently audited?
Connect to AD runs as a Windows service on your own server, makes outbound connections only and uses service accounts with read, insert and update permissions instead of domain admin. It is SOC 2 Type 2 verified, and our team has no standing access to your data. You can read the details on our Security page.
How to roll out without surprises
Install on a server in your network and connect UKG and your directory with dedicated service accounts.
Define your rules for naming, OUs, groups and which employees to include. Every license includes 10 implementation hours with an expert who sets these up with you.
Preview the results on a small group of employees before anything is written.
Go live on your schedule, then let the sync run at the interval you choose, from every 5 minutes up to every 30 days.
Getting started
If your team still re-types UKG data into Active Directory, an integration usually pays for itself quickly. Connect to AD has flat pricing with unlimited employees, so the cost stays the same as you grow.
Book a 30-minute demo to see it running with your UKG product, or try Connect to AD for free in your own environment.
