Personnel directory
Understand how Noru builds canonical personnel records from HR, identity, access, asset, vendor, training, and policy data.
Personnel directory
The directory at /personnel/directory is the canonical people-and-accounts view for the active
organization. It is not a copy of a single HR list. Noru combines records from connected systems and
manual decisions so you can answer who is in scope, which identities belong to them, what they own or
access, and whether training, policy acknowledgement, and MFA expectations are being met.
How data reaches Personnel
Personnel records can be created or updated by:
- HR sources, such as HaileyHR, which contribute lifecycle status, department, role, and profile facts.
- Identity providers, such as Google Workspace and Microsoft Entra ID, which contribute accounts, status, groups, MFA observations, and profile details.
- Engineering and collaboration sources, such as GitHub or GitLab, which can contribute linked identities observed during their syncs.
- SSO application discovery, which links a person to a vendor application and may create a vendor record when a recognizable application has no register entry.
- Manual maintenance and explicit merges, used for scope, type, exceptions, and duplicates the source systems cannot resolve safely.
Provider behavior varies. Read the relevant Data Source page to understand exactly what a connector collects.
How Noru aggregates a person
Normalize and match source identities.
Emails are normalized. Existing provider identities are matched first by provider external reference, then by provider and email. If no match exists, Noru finds or creates a personnel record from the email.
Resolve explicit merges.
When users merge duplicate personnel records, one record becomes canonical and the other record IDs resolve to it. The underlying source identities remain visible for traceability.
Group related facts.
The canonical group includes personnel rows, linked provider identities, vendor SSO observations, training assignments, policy acknowledgement assignments, and manual training completions.
Attach assets.
Assets link by an explicit personnel owner ID. Older or provider-originated records can also resolve by normalized owner email. The asset remains managed in the asset register.
Calculate the directory view.
Noru selects canonical display fields, aggregates groups and sources, resolves lifecycle and MFA posture, counts assets and vendor applications, and summarizes training and signatures.
Important aggregation rules
- HaileyHR department and role metadata takes precedence when available; otherwise canonical and grouped personnel values are used.
- MFA is enabled if any grouped personnel row reports enabled; otherwise it is disabled if a source reports disabled, or unknown when no source can say. An approved exemption is tracked separately with its reason.
- If linked identities disagree between active and inactive, the person becomes Inconsistent. Noru can create a medium-severity security finding so the mismatch is reviewed rather than silently averaged.
- Personnel type resolves conservatively: any service-account record makes the group a service account; otherwise any contractor record makes it a contractor; otherwise it is an employee.
- A canonical group is in scope only when every grouped personnel record remains in scope.
- Training and acknowledgement summaries use the grouped assignments and completions; a total of zero means nothing is currently assigned, not that universal training requirements are satisfied.
What you can set on a person
- name, primary email, role, and department
- lifecycle status
- personnel type: employee, contractor, or service account
- compliance scope
- MFA exemption and required justification
Source-backed values may be updated by future syncs. Use manual changes to add organizational judgment, not to conceal a source disagreement; fix lifecycle facts in the authoritative HR or identity system.
Working with the directory
The directory supports search, sorting, pagination, and filters for status, data source, department, security posture, duplicates, and attention cards such as missing training, missing signatures, or missing MFA. Open a person to review:
- every linked identity and source status
- owned assets
- vendors observed through SSO and recent authentication timing
- training campaigns and manual completions
- policy campaigns and signature completion
- groups, role, department, scope, type, MFA, and exception rationale
Use Merge duplicates only after verifying that the records represent the same person. Similar names or email local-parts are candidate signals, not identity proof. Keep separate records for a human and their service account even if naming is similar.
Relationships to other pages
- Assets use personnel as accountable owners.
- Vendors show personnel whose access was observed through SSO.
- Security findings can be assigned to personnel and include cross-source lifecycle inconsistencies.
- Awareness assigns training and policy campaigns to people, groups, domains, or rule-based audiences.
- Policies, controls, risks, findings, and privacy processing records can use personnel as owners.
- Directory sync produces register evidence, allowing the maintained inventory to support mapped controls.
Compliance interpretation
The directory helps demonstrate population completeness, accountability, training participation, MFA posture, and onboarding/offboarding checks. Commonly relevant areas include ISO 27001 people and access controls, SOC 2 logical-access and competence criteria, and GDPR confidentiality and staff-access accountability.
It does not prove that access in an unconnected system was revoked, that a person understood training, or that an MFA exception is acceptable. Those conclusions require authoritative coverage, review, and evidence.
Resolve “Inconsistent” people at the source. An inactive HR record plus an active identity account is a potential offboarding gap, not a cosmetic data-quality issue.