Viewpoint Vista to Entra ID - Payroll-Driven Provisioning

How does Viewpoint Vista to Entra ID work?

We read employee records from Vista's PR (payroll) module and our own framework maintains, orchestrates, and monitors the data integration. We pull only the columns the integration needs - names, employee numbers, work emails, phone numbers, hire and termination dates, and employment status. Sensitive payroll data like Social Security numbers never leaves Vista.

After data is pulled, we synchronize the two systems following the rules your business needs. Vista employees are matched to Entra ID accounts on the employee number, so every account traces back to exactly one payroll record.

What data should sync from Viewpoint Vista to Entra ID?

The specific details will depend on your business processes, but there's a pattern that works well for contractors:

• Account creation - a new employee in Vista gets an Entra ID account with a generated username, a randomized initial password, and their name and contact details filled in.
• Employment status - Vista's active flag and termination date drive whether the account is enabled. A future termination date keeps the account active until the employee's last day.
• Contact details - work email and cell phone stay consistent with payroll.
• Group membership - put every managed employee in the right groups, and clean those memberships up on offboarding.

Usernames are the exception: they're set once, at creation. Renaming a sign-in address after the fact breaks more than it fixes, so when someone's name changes the integration notifies your team and a person decides what to do.

Just make the problem go away

If you're struggling with inconsistent processes and account management headaches, schedule some time with us. We can help you sort through:

• HR vs IT process
• Onboarding and offboarding
• Groups & licenses
• Device management

What about getting everyone on the same page in HR and IT? What's the project plan look like?

Getting the left hand to know what the right hand is doing in business is complicated. At AutoIDM, we have established a proven process to make sure everyone in your business is on the same page. The Viewpoint Vista to Entra ID integration (and our general integration process) is adjusted depending on your needs, but it follows these main points.

1. Initial Meeting - (30 min) Bring all stakeholders together to align on the timeline, expectations, and responsibilities.
2. Access - (30 min) Architect a secure solution that gives AutoIDM access to what we need while keeping your IT team in control.
3. Business Rules - (1 hour) Align Viewpoint Vista with Entra ID, build the rule set, and define the testing plan.
4. Testing - (~2 hours) Iterate with your champion to validate the integration and resolve issues quickly.
5. Deployment - Final deploy and full support for any adjustments or changes. Viewpoint Vista to Entra ID is now up and running.

Your Entra ID tenant already has accounts, and they weren't created with payroll in mind. Before anything is automated, we match your existing accounts to Vista employees and review the report with you - every match and every ambiguity. Only clean one-to-one matches get linked, and nothing runs until you've agreed on the starting state.

Pull data from Viewpoint Vista: Your options depend on how Vista is deployed. Trimble Construction One cloud-hosted Vista customers are eligible to purchase the Vista API, a bidirectional REST API - review the Vista API developer documentation and Trimble's Vista API documentation resources. For on-premises Vista, a read-only SQL login against the Vista database works well - the PR employee tables hold the fields you need. Either way, pull only the columns the integration requires and leave sensitive payroll data alone.

Match up accounts: Once you've got employee data from Vista, you'll need to match it up to existing Entra ID accounts. Store the Vista employee number in Entra ID's employeeId attribute so the link survives name changes and email changes. For the initial backfill, match on name and email, review the ambiguous cases by hand, and only then turn the automation on.

Map data and push to Entra ID: A simple approach is PowerShell. The Import-CSV module is the easiest interface to use, paired with the Microsoft Graph PowerShell SDK, specifically New-MgUser, Update-MgUser, New-MgGroupMemberByRef, and Remove-MgGroupMemberByRef. You'll need an app registration granted User.ReadWrite.All and Group.ReadWrite.All application permissions, with admin consent. You'll also need to figure out record lifecycles: what happens when employees join, leave, change names, etc.

Operationalize: After you've got the logic figured out, you'll want to set up monitoring to catch errors, alerting to let your team know when something requires their time, and training for the technicians who will be responsible. You'll also want to educate your HR and business teams about what to expect and how to get support.