None of the integrations above talk to each other directly. Every module, attendance, payroll, allowances, notifications, reacts to the same domain events over an internal message bus, so an approved duty request independently and automatically triggers a mandatory attendance period, a granted-allowance calculation and a notification, without one module calling another by name. That decoupling is why a facial-recognition sync and a payroll export can both depend on attendance without depending on each other.verified
Platform · Integrations
Directory sync, single sign-on, and the systems already sitting in your organisation
SkyRoster is not the only system in your organisation that knows who your staff are, when they worked, or what they are owed. This page lists every integration point that matters to a real deployment: what flows, in which direction, and what it is actually for. Where a specific third-party product name would identify a customer rather than describe a mechanism, the category is named instead and the mechanism stays concrete.
| Integration | Direction | What it is for | How it works |
|---|---|---|---|
| Identity provider and single sign-on | Auth | Staff sign in with the credentials they already have, not a separate SkyRoster password. | Identity runs through Keycloak, federated against Microsoft Entra ID (Azure AD) over standard OIDC, or against an on-premises Active Directory over LDAP, with optional Kerberos for a passwordless internal login. An “autologin” mode skips SkyRoster's own sign-in screen entirely for staff, while administrative accounts can be kept on a username/password screen for break-glass access. |
| Directory synchronisation | Inbound | New starters appear in SkyRoster without HR retyping them. | A scheduled job reads employee accounts from your on-premises Active Directory over LDAP and creates the matching SkyRoster employee record, keeping job numbers in sync afterward. It is one-directional and additive by design: it creates and updates job numbers, and stops there.Limit: It does not deactivate a SkyRoster employee when they leave your directory, and it does not sync a later name or email change. Removing an ex-employee's access is a manual step today. |
| Biometric attendance | Inbound | A facial-recognition clock event becomes an approved attendance entry with nobody re-typing a timesheet. | A sync job polls each configured access-control device on a short interval and pushes new clock events into SkyRoster's attendance record, auto-approved on arrival because the device is treated as a trusted witness. Per-device tracking means one offline reader never blocks the rest, and a device catches up automatically once it reconnects.Limit: If an employee edits their own device-sourced entry afterward, it is demoted back to Pending for a supervisor to re-approve. A sync never silently overwrites a correction a person already made. |
| Travel-management duty requests | Inbound | A booked business trip becomes a duty request without anyone typing it in twice. | When a trip is booked, changed or cancelled in your travel management system, a webhook notifies SkyRoster, which creates, updates or cancels the matching duty request for the traveller automatically, splitting a multi-day trip into per-day segments around the employee's own shift pattern and skipping any day that already conflicts with existing schedule. The employee is matched to the request by email and is not notified for a trip they already know they booked, though approvers, attendance and payroll still are. |
| Payroll export | Outbound | A month's overtime, holiday work, absences and allowances leave as a file your payroll system can ingest directly. | SkyRoster resolves every payroll-relevant minute of the month into your own numeric payroll codes and writes a fixed-width text file, one line per item, in the exact layout your payroll system expects, built to be imported directly with no manual reformatting. |
| Calendar synchronisation | Outbound | A published shift shows up next to someone's other meetings, without them checking a second app. | An employee's SkyRoster shifts can sync into their Microsoft 365 / Outlook calendar. It is set up once, tenant-wide, by your IT administrator through an Azure app registration, not a per-user consent screen each employee has to click through.Limit: Today the target is Microsoft 365 / Outlook specifically, and it is single-tenant: one organisation's app registration serves that organisation. A different calendar provider is not wired up as a default. |
| Email delivery | Outbound | The durable, formal copy of a business event, alongside push and the in-app notification centre. | Every business event, a leave approved, a swap requested, a roster published, reaches a transactional email provider as one of three simultaneous surfaces fed by the same stored notification record, the other two being an OS-level push notification and the in-app notification centre. Every notification string is localised, and an employee can opt a whole category of events out without losing the others. |
Underneath
Why one approved leave triggers three unrelated things at once
Bring your own identity provider and payroll system.
A working session is where we confirm your actual Active Directory, payroll target and travel system against this list, and tell you plainly which of these mechanisms apply as they stand and which would need new work.