Introduction

Klef sits between your HRIS and the tools your company uses. When a worker is hired, updated, or terminated, it keeps their accounts and access in sync. You describe the of your workers as . Klef compares that to the current state of your systems and generates a of changes to make reality match your policies. You can review the plan before it applies, or let it apply on a schedule. For example, this policy gives every employee a Microsoft account while they work here, emails them its first sign-in, and deactivates it when they leave:

policy "Employee lifecycle" {
  category = "Company-wide"
  applies  = everyone

  stage active {
    target microsoft_entra.user {
      userPrincipalName = worker.business_email
      displayName       = worker.display_name
      jobTitle          = worker.job.name
      accountEnabled    = true
      licenses          = ["SPE_E3"]
    }

    notify email "welcome" {
      send    = once
      subject = "Your Microsoft account"
      body    = "Get your first sign-in here: {{ microsoft_entra.sign_in_url }}"
      to      = [worker.personal_email]
    }
  }

  stage terminated {
    target microsoft_entra.user {
      userPrincipalName = worker.business_email
      accountEnabled    = false
      licenses          = []
    }
  }
}

Glossary

Terms used across Klef

Policy Anatomy

Explanation of Klef’s policy model

Basics

Connectors

Administration

Introduction

Glossary

Policy Anatomy