AOHSync: HR to Entra ID & Active Directory Lifecycle Automation (Joiner, Mover, Leaver)
par AOHWV
Automate joiner, mover, leaver from your HR system to Entra ID and AD. Runs in your Azure tenant.
Your HR system already knows who should have access. AOHSync makes Entra ID and Active Directory listen.
When someone is hired, changes roles, or leaves, AOHSync updates their accounts and attributes in Microsoft Entra ID and Active Directory, and their Entra ID group memberships. That means no tickets, no emailed spreadsheets, no PowerShell held together with hope.
What you get
- Joiner, mover, leaver automation: HR events become Entra ID and AD changes on a schedule or on demand, including emergency terminations from the dashboard.
- Clean data before automation: AOHSync matches and cleans HR vs. IT records first, so you don't automate garbage.
- Orphaned and stale account detection: every account in a connected system is matched to a person or flagged. Find the "leavers who never left."
- Identity graph: see users, groups, systems, and policies as relationships, so you can spot access creep and excess group membership.
- Works with any HR system, even the old, clunky one: through its API, or a scheduled CSV export when there's no API (a SQL database works too).
- Writes to Active Directory and Entra ID through Microsoft's own provisioning service: one HR source of truth for hybrid environments.
- Audit-ready: declarative mappings, traceable job history, provisioning logs, Teams and email notifications.
- Uses the Entra ID P1 you likely already own: it comes with Microsoft 365 E3, E5 and Business Premium. You need a P1 seat for everyone AOHSync syncs. No separate IGA platform needed for joiners, movers and leavers.
Runs in your Azure subscription. AOHSync deploys as one virtual machine that you control. Your HR and identity data is not sent to AOH's infrastructure. Only the license key and a usage count go to AOH's license server.
Who it's for: IT and identity teams at organizations using Microsoft 365 / Entra ID, especially those with hybrid Active Directory, contractors or shift workers, an HR system without a native Microsoft connector, or an audit or pentest finding about terminated-user access.
Get started in about an hour: register an app → deploy from Marketplace → point a DNS record → connect your HR source, then Entra ID or AD → run your first sync. For AD, Microsoft's provisioning agent also goes on a Windows server in your domain. Paid plans include a proof of concept, version updates, and US-based support by phone, text, and email (8×5).
Under the hood: one VM in your Azure subscription · Microsoft Graph and Microsoft's API-driven inbound provisioning for Entra ID and AD (AD through Microsoft's provisioning agent).
Docs: docs.aohwv.dev · Demo: youtube.com/watch?v=JhqHIrAA67E · Built by AOH, a woman-owned identity security firm in Chicago.