All Case Studies
Roundglass integration at a glance
The client, the two systems and the service that joins them.
| Item | Detail |
|---|---|
| Client | Roundglass (Roundglass Wellbeing Private Limited), wellbeing, India |
| Source of truth | Zoho HR: joining dates, departments, roles, managers, exit dates |
| Target | Microsoft Azure AD (Entra ID): accounts, groups, Microsoft 365 licences |
| Service | Node.js with a PostgreSQL audit table and event log |
| Alerts | Slack, on any failed sync step |
Challenge
Roundglass kept employee records in Zoho HR and staff identities in Microsoft Azure AD, with people bridging the two by hand. Dcrayon built the service that keeps them in step.
Roundglass's two systems for one workforce
Roundglass is a wellbeing company with a growing workforce. Its people records, including joining dates, departments, roles, managers and exit dates, lived in Zoho HR. Email, group membership and Microsoft 365 licences were controlled in Azure Active Directory, now renamed Microsoft Entra ID, which is Microsoft's directory of user accounts and the access each account has. Nothing connected the two. Every joiner and every leaver had to be copied from one system to the other by an IT administrator, and the timing of each step depended on someone remembering to do it.
New starters could arrive without working email or tools
Accounts were created by hand, often only after the joining date. An administrator had to create the Microsoft account, add the person to the right email and security groups, assign a licence and tell the teams concerned. When any of those steps waited for a ticket or a reminder, the new employee's first day started without the access they needed.
Leavers kept access after they had gone
The reverse step was just as manual. Accounts and group memberships of departing staff were not always removed promptly, which left working credentials with people who no longer worked at Roundglass and kept paid Microsoft 365 licences assigned to empty seats. Of the two problems this was the more serious, because an open account belonging to a former employee is a security exposure, not just an inconvenience.
Nobody could show who had been given what, and when
With no automation there was no audit trail. If HR, IT or an auditor asked when an account was created, changed or closed, the answer depended on memory and old tickets.
Roundglass joiner and leaver problems
The issues described above, who they affected and what they cost.
| Issue | Who it affected | Business impact |
|---|---|---|
| Accounts created by hand after joining | New employees and their managers | First days without email or tools |
| Leaver accounts not closed promptly | IT and the business | Open credentials and paid licences on empty seats |
| No record of identity changes | HR, IT and auditors | No reliable answer to who had access and when |
Solution
Treating Zoho HR as the source of truth
Zoho HR already held every date that matters, so we designed the integration around it: Zoho HR decides, and Azure AD follows. The service is written in Node.js with a PostgreSQL database and polls Zoho HR at fixed intervals, checking for new joiners, changed joining dates, role and department changes, and new exit dates or status changes. Polling means the service asks Zoho HR for changes itself instead of waiting for someone to trigger it, so a change made in HR on a Friday evening is still picked up. This is the kind of work our system integration practice covers.
How a Roundglass joiner's account is set up five days early
When a joining date is five days away, the service starts the onboarding workflow. It creates the employee's Microsoft account, adds them to the email distribution groups and security groups that match their department and role, assigns their Microsoft 365 licence, and sends a notification to their manager and the IT team. Distribution groups decide which team mailing lists a person receives; security groups decide which files, applications and systems they can open. Mapping both from department and role means two people in the same team get the same access without anyone choosing it by hand.
The five-day lead time is a setting rather than a fixed rule, and it can be changed per department and role tier. If a joining date moves in Zoho HR, the service reads the new date on its next check, so the workflow follows the record rather than an old ticket.
Offboarding on the last working day
The service also watches for exit dates and status changes in Zoho HR. On the employee's last working day it removes their group memberships, suspends the account and releases the licence assignment. Suspending rather than deleting stops the person signing in while leaving the account's mailbox and files in place for the business, and releasing the licence returns the seat for the next joiner. Our Azure services team works with this kind of directory set-up.
An audit trail for every identity change
Because this service can create and suspend accounts, every action it takes is recorded. Each one is written to an audit table in PostgreSQL with a timestamp, the identity that made the change, and the record's state before and after. That gives HR and IT an answer to the questions that used to depend on memory: when an account was created, which groups were added, when access was removed and by what.
When a sync step fails
Every sync event, successful or not, is written to a durable event log that HR and IT can search and export. When a step fails, the service sends an alert to Slack, so a missed step reaches a person instead of failing silently. The failed event stays in the log with its details, so the fix can be checked against the original record.
How Roundglass's sync service divides the work
Each part of the service and what it does.
| Application part | What it does in this project |
|---|---|
| Zoho HR poller | Checks at fixed intervals for joiners, date changes, role changes and exits |
| Onboarding workflow | Five days before joining: account, groups, licence, manager and IT notice |
| Offboarding workflow | Last working day: groups removed, account suspended, licence released |
| PostgreSQL audit table | Timestamp, acting identity and before-and-after state of every change |
| Event log and Slack alerts | Searchable record of every sync event; alert on any failure |
Results
What changed for Roundglass's HR team, IT and new employees
Account creation, group membership and licence assignment now follow the joining date recorded in Zoho HR, ahead of the employee's first day, instead of waiting for a ticket. Access is removed on the last working day from the same source of truth, so the gap between someone leaving and their account closing no longer depends on who remembers. Every change has a timestamped before-and-after record that HR and IT can review or export, and failures arrive as Slack alerts rather than being discovered later by a new joiner or an auditor.
What Roundglass's sync service now does
The delivered capabilities, one per row.
| Outcome | What changed | Status |
|---|---|---|
| Advance onboarding | Access ready before the first day, lead time set per department | Delivered |
| Scheduled offboarding | Access removed on the last working day from the HR record | Delivered |
| Audit trail | Every identity change recorded with before and after state | Delivered |
| Failure alerts | Failed steps logged and sent to Slack | Delivered |
Key takeaways
Offboarding is a security control, not admin
Joiner and leaver processes are usually treated as administration, but the leaver side is a security control: an account that stays open after someone leaves is a working key. Running both sides from the HR record, with an audit log and alerts, puts the timing in one place and makes every change reviewable. Our data protection strategy work starts from the same question of who holds access and why, and our API development team builds connectors like this one between cloud systems that were never designed to talk to each other.
If your HR and identity systems are still kept in step by hand, tell us how they connect today.
CategoryOther