# Connect OneLogin to BambooHR > Keep identity and access management in sync with your HR system of record — automatically. **Canonical page:** https://tray.ai/connectors/onelogin-bamboohr-integrations/ **OneLogin connector:** https://tray.ai/connectors/onelogin-integrations/ **OneLogin documentation:** https://tray.ai/documentation/connectors/service/onelogin **BambooHR connector:** https://tray.ai/connectors/bamboohr-integrations/ **BambooHR documentation:** https://tray.ai/documentation/connectors/service/bamboohr ## Overview OneLogin controls who has access to what. BambooHR tracks everything about your people from hire to retirement. When these two systems don't talk to each other, IT and HR teams spend hours manually provisioning accounts, updating roles, and revoking access when employees leave. Integrating OneLogin with BambooHR through tray.ai automates the entire employee lifecycle — reducing risk, saving time, and making sure every team member has exactly the right access from day one. The business case for connecting OneLogin and BambooHR comes down to security, efficiency, and compliance. Every time a new hire appears in BambooHR, IT has to manually create their OneLogin profile, assign the right apps, and configure role-based access — a process that's slow and prone to mistakes. When an employee changes departments or is terminated, access updates often lag behind, creating security gaps and compliance headaches. Treating BambooHR as the authoritative source of truth and OneLogin as the enforcement layer lets you automate provisioning, deprovisioning, and role changes in real time. New employees get all their tools ready on day one. Departing employees are locked out immediately. Sensitive data stays protected, audits stay clean, and nobody has to file an IT ticket to make it happen. ## Use cases ### Automated New Employee Provisioning When a new hire record is created in BambooHR, tray.ai automatically creates a corresponding OneLogin user account, assigns the appropriate role-based access groups, and activates the relevant app integrations. The new employee has everything they need before their first day — no IT ticket required. - Eliminate manual account creation and cut onboarding time from days to minutes - Assign access consistently based on department, role, and location data from BambooHR - Give new hires their tools on day one, not day three ### Instant Offboarding and Access Revocation When an employee's termination date is reached or their status goes inactive in BambooHR, tray.ai immediately suspends or deletes their OneLogin account and removes access to all connected applications. This closes the security gap that typically exists between an employee's last day and IT action. - Eliminate orphaned accounts that create security and compliance risks - Revoke access the moment an employee departs, not hours or days later - Maintain a clean, auditable record of all deprovisioning actions ### Role and Department Change Access Updates When an employee is promoted, transfers to a new department, or changes roles in BambooHR, tray.ai automatically updates their OneLogin profile, adjusts their group memberships, and modifies their application access. This prevents both over-provisioning and under-provisioning as employees move around the organization. - Give employees the right tools immediately after an internal move - Remove access to systems that no longer apply to their new role - Cut IT workload from internal transfers and promotions ### Employee Directory Synchronization OneLogin user profiles stay continuously updated with the latest employee data from BambooHR — job title, manager, phone number, office location, department. Directory information surfaced through OneLogin-connected apps like Slack, Microsoft 365, and Salesforce always reflects what HR actually has on record. - Keep org charts and directory listings accurate across all connected tools - Eliminate discrepancies between HR records and identity provider profiles - Reduce helpdesk tickets from outdated employee information ### Compliance-Ready Audit Trail Generation Every provisioning and deprovisioning event triggered by a BambooHR change gets automatically logged to a centralized system, creating a timestamped audit trail that links HR actions to OneLogin account changes. This is exactly what SOC 2, ISO 27001, and similar frameworks ask for when they want evidence of access controls. - Walk into compliance audits with automatically generated access event records - Show a clear chain of custody from HR decision to system access change - Reduce audit preparation time and associated professional services costs ### Manager and Approval Workflow Automation When a new manager relationship is established in BambooHR, tray.ai can automatically update OneLogin group hierarchies and notify the new manager about direct reports who need access reviewed. Approval workflows stay accurate, and managers actually have visibility into the tools their team is using. - Keep manager hierarchies in OneLogin aligned with real-time org chart changes - Trigger access review workflows automatically when reporting structures change - Improve governance without piling more manual updates onto IT ### Scheduled Access Review Reporting Periodically pull active employee lists from BambooHR and cross-reference them with active OneLogin user accounts to catch discrepancies — accounts for employees who are no longer active, or employees missing required application access. Reports go automatically to IT and HR stakeholders for action. - Catch mismatches between HR records and active system access before they become problems - Support periodic user access reviews required by compliance frameworks - Reduce risk from stale or unmanaged user accounts ## Templates ### New Hire Provisioning: BambooHR to OneLogin Automatically creates a new OneLogin user account and assigns role-based app access whenever a new employee record is added in BambooHR, using department and job title fields to determine the correct access groups. Connectors used: BambooHR, OneLogin ### Employee Termination: BambooHR Status to OneLogin Deprovisioning Monitors BambooHR for termination events or status changes to inactive, then immediately suspends or deletes the corresponding OneLogin account and logs the action for audit purposes. Connectors used: BambooHR, OneLogin ### Employee Profile Sync: BambooHR Updates to OneLogin Runs on a scheduled or event-driven basis to push updated employee profile fields from BambooHR — such as title, department, manager, and phone number — into the corresponding OneLogin user record. Connectors used: BambooHR, OneLogin ### Department Transfer: Role and Access Update Workflow When an employee's department or job title changes in BambooHR, this template automatically updates their OneLogin group memberships, removes old role-based access, and grants new access appropriate to their updated position. Connectors used: BambooHR, OneLogin ### Orphaned Account Detection and Remediation Report Periodically compares active user accounts in OneLogin against active employee records in BambooHR to surface orphaned or mismatched accounts, then generates a report for IT review and optional auto-remediation. Connectors used: BambooHR, OneLogin ### New Manager Notification and Access Review Trigger When a manager relationship is updated in BambooHR, this template notifies the new manager by email or Slack and creates an access review task for their direct reports in the connected ITSM or ticketing system. Connectors used: BambooHR, OneLogin ## Challenges Tray.ai solves ### Keeping User Attributes Mapped Consistently Between Systems BambooHR and OneLogin use different data models and field naming conventions. Reliably mapping HR attributes — cost center, employment type, custom fields — to the correct OneLogin profile attributes without custom development is harder than it sounds. **How Tray.ai helps:** tray.ai's visual data mapper and flexible transformation logic let teams define precise field mappings between BambooHR and OneLogin without writing code. Custom BambooHR fields can be mapped to OneLogin custom attributes and updated as schemas change, keeping data accurate and consistent. ### Handling Timing Gaps in Offboarding Workflows Deprovisioning delays are one of the most common identity management security risks. If termination events in BambooHR aren't immediately propagated to OneLogin, former employees may retain access to sensitive applications for hours or days after their departure. **How Tray.ai helps:** tray.ai supports both real-time webhook triggers and scheduled polling for BambooHR events, so termination status changes are detected almost instantly. Automated workflows then fire deprovisioning actions in OneLogin right away, shrinking the window of unauthorized access to seconds. ### Managing Conditional Access Logic for Diverse Employee Types Most organizations have multiple employee types — full-time staff, contractors, part-time workers, interns — each requiring different levels of access in OneLogin. Building logic that correctly provisions each type from BambooHR data gets complicated fast and is error-prone at scale. **How Tray.ai helps:** tray.ai's conditional branching and decision logic let teams build provisioning rules based on any combination of BambooHR fields — employment type, department, location. Each branch triggers distinct OneLogin group assignments, so every employee type gets precisely the access they should. ### Maintaining Sync Reliability During API Rate Limits and Downtime Both OneLogin and BambooHR APIs impose rate limits, and any interruption in connectivity or API availability can cause provisioning events to be missed or duplicated, leaving user states inconsistent across the two platforms. **How Tray.ai helps:** tray.ai's built-in retry logic, error handling, and workflow state management make sure failed API calls are automatically retried and provisioning events are never silently dropped. Teams get alerts when errors occur, and execution logs give full visibility into every workflow run. ### Supporting Compliance Audit Requirements Without Manual Logging Demonstrating compliance with SOC 2, ISO 27001, or similar frameworks means showing detailed records of who had access to what and when it was granted or revoked. Maintaining those logs manually alongside BambooHR and OneLogin is time-consuming and leaves room for gaps. **How Tray.ai helps:** tray.ai automatically writes structured audit log entries to a designated data store, Google Sheet, or SIEM platform every time a provisioning or deprovisioning event occurs. Each log captures the triggering HR event, the timestamp, the action taken in OneLogin, and the operator identity — a complete, auditable paper trail with no manual effort. ## Learn more - Intelligent Integration: https://tray.ai/platform/intelligent-ipaas/ - Merlin Agent Builder: https://tray.ai/platform/merlin-agent-builder/ - Agent Gateway for MCP: https://tray.ai/platform/agent-gateway/ - Book a demo: https://tray.ai/contact/