HRIS Integration: Automated Employee Provisioning & Deprovisioning

Before You Begin

This article covers the configuration steps available after your HRIS connection has been established. To set up the initial connection between your HR system and Xenia, refer to the HRIS Connection Setup guide.

To access HRIS settings: Settings → HRIS

You must be an Owner or Admin to manage this configuration.

How the Integration Works

Once your HRIS is connected, Xenia syncs employee records on a regular cadence. For each employee record received, Xenia:

1. Checks whether the employee's job classification is on your whitelist
2. If whitelisted, maps their job classification to a Xenia role and their HRIS location to a Xenia location
3. Either sends an invitation automatically or stages them for admin review — depending on your provisioning mode setting
4. Monitors for termination or deactivation in the HRIS and removes access automatically when detected

1. Whitelisting

What it does: Whitelisting controls which employees in your HRIS receive access to Xenia. Only employees whose job classification matches a value on your whitelist will be provisioned — everyone else is skipped silently.

This lets you limit platform access to operational roles (store managers, associates) without syncing back-office employees or executives who don't use the app.

How to configure it:

1. Go to Settings → HRIS → Whitelisted Job Profiles
2. Add each job classification value that should receive access to Xenia
3. Values must match your HRIS exactly — including capitalization and spacing
4. To find the right values, pull an export of active employees from your HRIS and identify the job classification field (this may be called Job Profile, Job Title, Position, or similar depending on your HR system)

Things to know:

• Any job classification not on the whitelist is excluded by default — no invite is sent and no error appears
• If you add new job types in your HRIS after go-live, add them to the whitelist manually for those employees to be synced
• A job classification must have at least one active employee currently synced before it appears in the role mapping screen — you cannot pre-configure mappings for job types with no current employees

2. Role Mapping

What it does: Role mapping assigns the correct Xenia permissions to each employee based on their job classification in the HRIS. When an employee is provisioned, Xenia looks up their job classification and assigns the mapped Xenia role automatically.

How to configure it:

1. Go to Settings → HRIS → Role Mapping
2. For each whitelisted job classification, select the corresponding Xenia role
3. Set a Default Role — assigned to any whitelisted employee whose job classification doesn't have an explicit mapping
4. Save your changes

We recommend setting the Default Role to Basic User — this ensures unmapped employees get limited access rather than no access, and prevents anyone from accidentally landing in an admin-level role.

Example mapping:

Review unmapped job classifications regularly to ensure the right access levels are applied. Any role that falls through to the default should be reviewed and explicitly mapped if needed.

3. Location Mapping

What it does: Location mapping assigns each employee to the correct Xenia location based on their location data in the HRIS. This gives employees access to the tasks, checklists, and reporting for their specific site.

How to configure it:

1. Go to Settings → HRIS → Location Mapping
2. For each HRIS location value, select the corresponding location in your Xenia hierarchy
3. Save

Employees with no location assigned in the HRIS will be assigned to the default location depending on your configuration.

4. Provisioning Mode

What it does: Provisioning mode controls what happens after an employee passes the whitelist check — whether they're invited to Xenia automatically or held for admin review first.

Go to Settings → HRIS → Provisioning to choose your mode.

Manual Mode: New employees are synced from the HRIS and placed in a Pending Review queue in the HRIS panel. No invitation is sent until an admin reviews and approves each account.

Use this when you want to validate user data, confirm role and location assignments, or control the pace of rollout — especially during initial launch.

Automatic Mode: As soon as an employee passes the whitelist check, Xenia creates their account and sends an invitation email from alerts@xenia.team. No admin action required.

Use this for steady-state operations once your whitelist, role mapping, and location mapping are fully configured and stable.

Important: Make sure alerts@xenia.team is not blocked by your organization's email security filters. Ask your IT team to allowlist this address if needed.

5. Deprovisioning

What it does: When an employee is terminated or deactivated in your HRIS, Xenia automatically removes their access on the next sync. No manual action required.

How it works: Xenia monitors the employment status and termination date fields in your HRIS. When an employee's status is no longer Active, or a termination date is detected, their Xenia account is deactivated.

Terminated employees are automatically removed from the active employee list in the HRIS panel — they won't appear in the Not Invited queue or be eligible to receive a new invitation.

Things to know:

• Deprovisioning happens on the next sync after the HRIS record is updated. Ensure your HR team updates termination records promptly to minimize the window between an employee's last day and access removal.
• If a terminated employee is unexpectedly retaining access, check whether their employment status and termination date are correctly set in the HRIS.

6. Managing Employees in the HRIS Panel

The HRIS Employees panel (Settings → HRIS → Employees) gives you visibility into every employee record synced from your HR system and their current status in Xenia.

Employee statuses:

Sending and resending invites:

• In Manual mode: Select employees from the Pending Review queue and click Send Invite to approve and invite them
• To resend an invite: Find the employee in the list and use the Resend Invite option — invite links expire when a new invite is sent. Employees who receive a blank screen or error when clicking their link should contact their admin for a resend.
• Bulk invites: Select multiple employees and use the bulk action bar to send invitations at scale

Using HRIS with SSO

Xenia supports using HRIS and SSO together. When both are enabled, they work in tandem:

HRIS handles provisioning — it determines which employees get access, and maps each one to the correct role and location.

SSO handles authentication — it's how users log in.

When a user logs in via SSO, Xenia checks whether they have a pending HRIS invitation. If they do, SSO completes their account setup using the role and location already mapped through HRIS — meaning they can skip the invite link entirely and land directly in the correct account with the right permissions already applied.

To avoid users landing in a default or empty state, ensure your HRIS whitelist and sync are fully configured before broadly enabling SSO login for your organization.

For SSO setup instructions, see the SSO Configuration guide.

Frequently Asked Questions

Why are some employees not appearing in the HRIS panel? The most common causes are: (1) the employee's job classification is not on the whitelist; (2) the employee's status in the HRIS is not Active — for example, they are a pre-hire or have an incorrect employment status set.

How often does the HRIS sync run? Sync frequency depends on your HRIS configuration and plan, but typically runs daily. You can view the last sync time in Settings → HRIS.

A new hire isn't receiving their invitation — what should I check? Confirm: (1) their job classification is on the whitelist; (2) their employment status in the HRIS is Active; (3) your provisioning mode — in Manual mode, an admin must send the invite manually from the Pending Review queue; (4) that alerts@xenia.team is not blocked by your email filters.

An employee was terminated but still has access — what do I do? Check whether their employment status and termination date are correctly set in the HRIS. Deprovisioning happens on the next sync after the record is updated. If the record is correct and access persists after the next sync, contact support at support@xenia.team.

Can I use HRIS without SSO? Yes. HRIS and SSO are independent features. You can use HRIS provisioning with standard email + password login, or combine them. See Using HRIS with SSO above for how they interact when both are active.