Start with a narrow scope
A school directory often contains students, alumni, contractors, shared accounts, rooms, devices, groups, and disabled users. Begin with an explicit staff group or organizational unit rather than an entire domain.
- Identify the groups, organizational units, or domains that contain current employees.
- List known student, contractor, shared mailbox, service, and automation containers for exclusion.
- Create a read-only integration account with access only to required directory attributes.
- Decide which fields the source should lock, such as employee ID, title, department, and primary email.
Built-in safeguards
- Only active person accounts with a primary email are eligible.
- Groups, organizational units, approved domains, and explicit exclusions narrow the candidate set.
- Credentials are encrypted and are never returned to the browser after saving.
- Saving creates a protected draft and does not immediately publish or delete staff profiles.
Review before recurring sync
Compare the preview with the organization’s expected staff count. Investigate every unexpected account type and a representative sample of excluded staff before enabling a recurring schedule.