HiBob and Microsoft Entra Integration: Hybrid AD Provisioning, Licensing and Approval Controls

What was announced​

HiBob describes itself as an organizational intelligence platform. It says the integrations help automate onboarding, employee changes and offboarding while strengthening identity governance across cloud and hybrid environments. There are two paths:

• Microsoft Entra ID: for identities managed directly in the cloud. It automatically updates Microsoft Entra user data when changes occur in HiBob.
• Windows Server Active Directory (Hybrid): for organizations that still need on-premises identities. HiBob says it extends the same lifecycle workflows to hybrid environments.

The release quotes HiBob CEO Ronni Zehavi. He argues HR data shouldn't stay confined to HR systems. It also quotes Udi Milo of Microsoft, identified as Partner PM for Access Management and Governance. Milo says the integration helps turn changes in an employee's role, status or responsibilities into timely identity and access actions.

The release gives no pricing, version number or quantified customer results. It says Bob serves more than one million users at over 5,500 companies in more than 170 countries. Those are the company's own figures.

How the hybrid flow works​

Microsoft Learn documents the hybrid path in detail. The data path is HiBob → Microsoft Entra ID → on-premises Active Directory. HiBob doesn't write to AD directly or bypass Entra.

The integration uses Microsoft Entra API-driven provisioning to provision users to Active Directory. The steps are:

1. An HR administrator creates or updates an employee in HiBob.
2. HiBob applies its configured mappings and builds a bulk SCIM payload.
3. HiBob sends the payload to the API endpoint for the Entra API-driven provisioning job.
4. The job checks whether the employee is in scope and maps the attributes.
5. The job sends the create or update operation to the Entra provisioning agent.
6. The agent writes to the chosen AD domain and OU, then reports status back.
7. HiBob queries the Entra provisioning logs for the status of the request. It shows the result in its own synchronization records.

HiBob's materials say lifecycle events can also lead to deactivation of accounts, depending on configuration. A HiBob marketplace page says Entra creates, updates, and disables user accounts in on-prem Active Directory. Microsoft's tutorial focuses on creation and update flows.

Prerequisites before you try it​

Per Microsoft's documentation, you need:

• A HiBob tenant, with permission to install and configure Bob Marketplace integrations.
• A Microsoft Entra tenant connected to the target Active Directory environment.
• A Microsoft Entra ID P1, P2, or Entra ID Governance license. You need enough licenses for every identity sourced through API-driven provisioning.
• The Entra provisioning agent, installed and configured for the target AD domain.
• The AD domain name and the OU where HiBob should create or update users.
• An Entra account holding Privileged Role Administrator or Global Administrator, to grant consent for three API permissions: Application.ReadWrite.OwnedBy, SynchronizationData-User.Upload.OwnedBy and ProvisioningLog.Read.All.
• A test employee record for validating mappings.

Microsoft notes that the HiBob portal labels may change as the product is updated.

Setup in outline​

In HiBob, an administrator goes to Marketplace and finds Microsoft Active Directory Hybrid under Identity and Access. They select Connect, add a connection, then authorize with a privileged Entra account. They enter the domain and OU and confirm the provisioning agent is connected. Microsoft says establishing the connection can take several minutes.

Next comes provisioning scope and mappings. Set Who to provision and check each default mapping from HiBob field to AD attribute. Add any extra fields you need. Two cautions from Microsoft:

• To use Entra ID Governance Lifecycle Workflows, send Start date and End date/Termination date into AD. They then need to reach Entra ID through Entra Connect Sync or Cloud Sync.
• Changing an identifier or other required mapping can affect user matching and updates. Test with a limited group first.

Automatic versus approval-required sync​

The third step is choosing how much automation to allow.

• Automatic synchronization sends eligible changes straight to AD.
• Approval-required synchronization queues selected changes first. Admins can require approval for new accounts. They can pick the fields that trigger review, such as department, and name who gets notified.

Reviewers see the trigger, changed field, old and new values, and effective date. They can then approve or decline. The connection page also keeps audit history and synchronization records, and supports manual sync. This hybrid model suits identity teams that are nervous about HR typos turning into permission changes. Routine updates can stay automated while sensitive ones get a human check.

Troubleshooting​

Microsoft's guidance for failures is consistent. Check these in order:

1. Consent and authorization: retry authorization if needed.
2. Provisioning agent status: confirm it is running and connected.
3. Target domain and OU settings.
4. Whether the employee is inside the Who to provision scope.
5. Required and custom attribute mappings.
6. HiBob's synchronization records for a failure entry.

If those records don't explain the failure, open the Entra admin center and go to Entra ID > Enterprise apps. Select the HiBob to Active Directory user provisioning app and review its provisioning logs for error details.

If a custom AD schema attribute doesn't appear in the mapping list, add it first. In the same enterprise app, choose Provisioning > Edit provisioning, expand Mappings, and select Edit Active Directory attribute list. Add the attribute there, then return to HiBob. A change stuck pending usually means it is waiting in the approval queue, or the notification recipients are wrong.

Analysis: what it does and doesn't solve​

The value is plain. Joiner, mover and leaver changes often travel by ticket, spreadsheet or script, and every handoff can leave an account out of date. HiBob's own blog notes such gaps can leave accounts active longer than intended. A supported connector replaces some of that glue.

There are limits:

• The connector doesn't decide entitlements. Scope, mappings and approvals still do that work. HiBob says the integration doesn't replace Microsoft's identity systems or IT's ownership of access.
• It depends on Entra licensing. P1, P2 or Governance licensing is a real cost line for some shops.
• The evidence is largely vendor-sourced. HiBob's blog cites a beta customer, Novuna. It says a supported integration beat custom development on maintenance. That is a testimonial, not comparative data.
• Alternatives exist. Third-party vendors sell similar HR-to-directory automation. Microsoft's API-driven inbound provisioning also lets teams build their own client, which is the maintenance burden HiBob says it removes.

The "AI era" framing is positioning. The real story is more modest: HR changes can drive Entra and AD provisioning through a documented path, with admin-set controls.

Bottom line​

Pilot it with a test employee and a limited scope. Map the dates you'll need for Lifecycle Workflows. Use approval rules for sensitive attributes such as department, manager and job title. Then check the Entra provisioning logs before widening the rollout.