Skip to content
Keel Docs

Directory sync

Keel keeps a roster of your employees, including people who never sign in to Keel. Access reviews and security-awareness training both work from it, and offboarding someone records the evidence an auditor asks for. The Directory tab under Integrations is where the roster comes from. Managing the people in it happens on the People page.

Only an owner or admin can import, sync or disconnect a source.

Sources

Section titled “Sources”
Source Plans How it works
CSV upload Every plan Upload a spreadsheet export. No setup.
Microsoft Entra ID Pro, Enterprise and the MSP / Partner plan Reads your staff directory from Microsoft 365 / Entra ID through Microsoft Graph.
Google Workspace Pro, Enterprise and the MSP / Partner plan Reads your staff directory through the Google Workspace Admin SDK.

On other plans the Entra ID and Google Workspace cards point you to Billing to upgrade, and CSV import still works. If a card shows Setup required, that source has not been configured on Keel’s side yet; use CSV import in the meantime.

Importing a CSV

Section titled “Importing a CSV”
  1. On the Directory tab, click Download CSV template to get a file with the right headers and sample rows.
  2. Fill in one row per person. Only email is required. The other columns are name, title, department and manager (the manager’s email). An optional groups column takes several groups separated by ;, | or /.
  3. Drop the file on the Directory CSV box and click Import CSV.

Column order does not matter, and common alternative headers are recognized, such as work email, full name, job title, dept and reports to. The file needs a header row and must be under 5 MB.

What a sync does

Section titled “What a sync does”

Click Connect & sync the first time, and Sync now after that. A sync runs when you click it.

  • Everyone the source returns is added to the roster, or updated if they are already there. People are matched within each source, so the same person can come from both a CSV and a synced directory.
  • Anyone from that source who is missing from the latest run is marked deprovisioned. It applies to CSV imports too: re-importing a CSV marks deprovisioned anyone from an earlier CSV who is not in the new file. A sync files no offboarding record. Those people show Offboarding due on the People page until someone completes their offboarding checklist.
  • The confirmation tells you how many people were synced and how many were marked deprovisioned.
  • People added by hand, through the API or from a different source are not touched.

Disconnect stops future syncs. The roster it already brought in stays where it is.

If a sync fails, the card shows the error next to the time of the last successful sync.

Managing the roster

Section titled “Managing the roster”

The People page is where you search, add, edit and offboard people, and see each person’s training. Offboarding a person marks them deprovisioned and files an attestation in Evidence listing the steps that were done, your note, who recorded it and the date. Keel links it to the User provisioning & deprovisioning and Personnel security (HR) controls when your workspace has them. You can reactivate someone later.

For someone a sync already marked deprovisioned, open their page and use Complete the offboarding checklist. Recording it files the same attestation. If a later sync finds the person in the source again and they leave a second time, the checklist is due again.

The same page holds the person’s start and end dates and the joiner checklist; see Onboarding and dates.

Editing and deleting are for people you added by hand. Someone who came from a CSV or a synced directory is changed at the source: update the file or the directory, then import or sync again. Offboarding works for everyone, whatever the source.

From the People page you can go straight to an access review, which starts from this roster.

To leave someone out of access reviews, such as a test account or an outside contractor whose access is reviewed elsewhere, select them, choose Mark out of scope in the bulk bar, give the reason and select Apply. They show Out of scope with the reason, and a sync leaves the mark in place. See Out of scope.

Next steps

Section titled “Next steps”