People sources and precedence
How the people directory combines HR systems and identity providers: status, department and title, MFA, and how leavers are caught.
Summary
- Each person is one row built from every connected source that knows their work email. Their status is derived from what those sources say, so a person an HR system has terminated while an identity provider still has them active shows as Inconsistent and raises a finding.
- Department and title come from an HR system (HaileyHR or Rippling) whenever one is connected and has a value. Otherwise a stored precedence applies: a manual edit, then an HR system, then Microsoft Entra ID, then Google Workspace. An empty value never replaces a filled one.
- HR systems only contribute status, department and title. Names, groups and MFA come from identity providers, and only Google Workspace and Microsoft Entra ID can say whether someone has MFA.
Concepts
| Term | Meaning |
|---|---|
| Source | A connected data source that reports people: an HR system, an identity provider, or a tool such as GitHub |
| Identity | One source's view of one person: their work email, the source's id for them, a status, and source-specific details such as department or title |
| HR system | A source of record for employment: HaileyHR and Rippling. It knows who is employed, not who can sign in |
| Identity provider | A source of record for accounts: Google Workspace and Microsoft Entra ID. It knows who can sign in, their groups and their MFA |
| Complete snapshot | A sync that read the source's whole people list. Only a complete snapshot can remove people |
How it works
Matching a source's people to rows
On each sync, every person a source reports is matched to a row:
- By the identity Noru already holds for that source and that person's id in it.
- Otherwise by the same source and the same work email.
- Otherwise by work email across the directory, creating a row if nobody matches.
Duplicate rows you merged stay merged: a match on a merged row resolves to the primary record. A person missing from a complete snapshot has that source's identity marked deleted. A sync that could not read the whole list removes nobody.
Status
Status is derived, never typed, from the person's identities:
| Identities say | Status |
|---|---|
| Every source has removed the person | Deleted |
| At least one active and at least one inactive | Inconsistent |
| At least one active, none inactive | Active |
| None active, at least one inactive | Inactive |
A row with no identities, such as a person you added by hand, keeps the status set on it.
Each HR system maps its own employment states:
| HR system | Counts as active | Counts as inactive | Not reported |
|---|---|---|---|
| Rippling | Active, hired, offer accepted | Terminated | Draft records |
| HaileyHR | In service, will join, being hired, leaving, garden leave | Has left |
People who have accepted an offer but not started count as active, because their accounts are usually being provisioned.
Catching leavers
When an HR system marks someone as terminated and an identity provider still has their account enabled, the person becomes Inconsistent and Noru raises a security finding, "Cross-source status mismatch", naming them. The finding resolves on its own once the sources agree: the account is disabled, or the HR record is corrected.
Rippling adds two leaver checks of its own, from the accounts and devices it manages: former employees who still have app accounts, and former employees who still have company devices assigned. See Rippling.
Department and title
Two rules decide what the directory shows.
-
What is stored on the row. A source writes department or title only if the row has no value yet, or the source ranks at or above the source that wrote the current value:
Source Rank Manual edit Highest HR system (HaileyHR, Rippling) Second Microsoft Entra ID Third Google Workspace Fourth Any other source Lowest An empty value never replaces a filled one. A row counts as manually edited when its Source is
manual. When an HR system fills an empty field on such a row, the row stays manual, so the HR system cannot overwrite your other edits later. -
What is displayed. When an HR system is connected and has a value for the person, that value is shown, whatever is stored, including a manual edit. Change the value in the HR system instead.
An HR system only ever writes department and title. It does not change the person's name, groups, MFA, or the status of other sources.
Names
Names come from the sources that provide them, usually the identity provider, which refreshes the name on each sync. Rippling is synced without names (Noru does not request the permission that would also expose home addresses and phone numbers), so a person known only to Rippling is shown by work email until another source or a manual edit names them.
MFA
Only Google Workspace and Microsoft Entra ID set MFA on a row. HR systems and other tools never change it. The directory shows Enabled if any source reports MFA enabled, Disabled if one reports it disabled and none enabled, and Exempt when you set an exception.
Edge cases and failure modes
- Someone's work email differs between sources. They become two rows. Merge them; later syncs follow the merge.
- An HR system is connected but has no department for someone. The identity provider's value is shown.
- A sync could not read every person. Nobody is removed. Removals wait for the next complete sync.
- An HR record is corrected after a mismatch. The person returns to a consistent status on the next sync of either source, and the finding resolves.
- Two HR systems are connected. Both rank the same. The value written most recently is stored, and either may be displayed; keep one HR system as the source of record.
What you can influence
- Edit department or title and set Source to
manualto keep identity providers from overwriting it. While an HR system holds a value for the person, the directory still shows the HR value. - Merge duplicate rows so all sources contribute to one person.
- Mark people as contractors, service accounts or out of scope; these are never overwritten by a sync.
- Fix the record in the source system when a synced value is wrong. A manual edit that leaves Source unchanged holds only until that source syncs again.
Related guides
Last updated on