Directory Sync — ingest is not publish
How WorkOS Directory Sync brings people into TENSOR, and why syncing a directory never changes who can see whom.
TENSOR can pull your people from your identity provider (Microsoft Entra ID, Active Directory, Okta, or Google Workspace) through WorkOS Directory Sync. A tenant admin connects it at Settings → Directory Sync (/settings/integrations/directory); from then on new joiners, attribute changes, and leavers flow in automatically.
The one idea worth internalising: ingesting people is a separate, separately-gated step from publishing them.
Ingest ≠ publish
Connecting Directory Sync stores accounts and attributes — it does not make anyone visible. Synced people stay hidden until two independent things are true:
- the people directory is enabled (
tenant_directory), and - the works-council acknowledgement is recorded (the BetrVG co-determination gate).
Even then, only the fields you explicitly publish are ever shown; an unpublished attribute never leaves the server, no matter what the IdP sent. Turning Directory Sync on therefore never widens who-can-see-whom on its own — a GDPR data-minimisation guarantee enforced in one place (the directory field projection), not a policy you have to remember.
What syncs, and what you keep
- Matching. People are matched on their IdP key first, falling back to email — so renaming someone in the IdP does not create a duplicate record.
- Local overrides are respected. If you pin a field locally, the next sync will not overwrite it. Everything the IdP owns is marked as such; everything you set by hand is preserved.
- Leavers. When the IdP marks someone inactive, TENSOR deactivates them and revokes their access; their account, the things they owned, and the audit history are all kept.
Credentials and sub-processor
The IdP credentials live in WorkOS, never in TENSOR — we store only an opaque directory handle. WorkOS is a documented sub-processor (EU data residency; SOC 2 Type II / ISO 27001). Every connect, disconnect, mapping change, and per-person sync is written to the tamper-evident audit log.
Who can do this
Connecting, mapping, resyncing, and disconnecting require the directory.sync.admin permission — granted to tenant admins. It is deliberately distinct from directory.admin (which governs publishing the directory and recording the works-council acknowledgement), so the person who ingests and the person who publishes can be different people.