Org & HR Data

Overview

Section HQ analyzes AI adoption and usage across your organization, and it becomes far more useful when it can break those metrics down by department, manager, and team. To do that, Section needs your org and HR data: your employee directory and how your people are organized.

There are three ways to send it:

SCIM directory sync (recommended). If you use SSO to connect to Section, your identity provider can send employee and org attributes to Section over the same connection that provisions users. This is how most customers send HR data today. See the SCIM Connection Guide under Identity & Access.
Finch HRIS connector. If you would rather connect your HRIS system directly, or your org data is not in your identity provider, Section can read your directory through Finch, a unified HRIS connection layer.
HRIS via SSO (SAML claim). The lightest path to set up. If you already sign in to Section with SAML SSO, add a department claim to that connection and Section reads it on each sign-in. It updates only on sign-in, so it is the least current of the three, and it carries department and employee name only. See the HRIS via SSO section below.

Please reach out to your Customer Success representative if you have questions or want a recommendation for your setup.

Choosing a Path

	SCIM directory sync (recommended)	Finch HRIS connector	HRIS via SSO (SAML claim)
Best for	You use SSO (Okta or Entra ID) and want the full directory kept in sync.	You would rather connect your HRIS directly, or your org data is not in your IdP.	You already use SAML SSO and want department quickly, with no extra setup.
Data sent	Department, manager, level, active status, and more.	Full HRIS directory.	Department and employee name only.
How data flows	Your IdP pushes users and attributes to Section over SCIM 2.0.	Finch reads your HRIS and passes the directory to Section.	Department rides your SAML login assertion; Section reads it on each sign-in.
Freshness	Real time, as changes happen in your IdP.	Daily sync.	On each sign-in. Employees who never sign in are not captured.
Setup	SCIM Connection Guide	Steps below.	SSO Connection Guide, then add the `department` claim below.

SCIM Directory Sync (Recommended)

Because SCIM also provisions and deprovisions your users, its setup lives under Identity & Access. If you have already connected SCIM for user provisioning, you may only need to map a few extra attributes (department, manager, and similar) to start enriching your reporting. No separate integration is required.

Full setup, supported identity providers, and the list of reporting attributes are in the SCIM Connection Guide.

Finch HRIS Connector

Use this path if you would rather connect your HRIS system directly, or if your org data is not available in your identity provider. The connection is established through Finch Connect, an embedded authorization widget that handles provider selection and authentication entirely within the Section HQ admin dashboard at hq.sectionai.com. No IT configuration or metadata exchange is required.

What Data Is Accessed

Section reads the following fields from your HRIS via Finch:

Data	Purpose
Employee directory (name, active status)	Match employees to Section Coach accounts
Department & manager	Power department-level analytics
Work email address	Join HRIS records to platform activity
Job title & employment type	Segment analytics by role and level
Company name & department structure	Organizational hierarchy

Section does not access payroll data, compensation, social security numbers, or any personally sensitive fields beyond those listed above.

Step 1 - Client: Initiate the Connection

Sign in to the Section HQ admin dashboard at hq.sectionai.com and navigate to Settings → Connectors. In the HRIS section, click the card for your provider (or Other HRIS Provider if your HRIS isn't listed individually - this covers any of the 200+ systems in the Finch network).

From the connector detail panel, choose one of two setup paths:

I have admin access - Opens the Finch Connect widget directly in your browser so you can authenticate with your HRIS right away. No redirect to an external site is required, and no configuration needs to be done in your HRIS system ahead of time.
Invite IT to complete setup - If you don't hold HRIS administrator credentials yourself, Section will generate a secure, single-use setup link you can forward to whoever does. Depending on your organization, that may be an IT admin, an HR admin, or both - they'll complete the Finch Connect flow on a dedicated setup page without needing a Section Coach login.

Step 2 - Client: Select Your Provider and Authenticate

Within the Finch Connect widget:

Select your HRIS provider from the list (e.g., Workday, ADP, BambooHR).
Enter your HRIS administrator credentials when prompted.
Authorize the connection.

Finch handles the provider-specific authentication flow entirely. Section never sees your HRIS credentials - Finch exchanges them for a secure access token on your behalf and returns only that token to Section.

Step 3 - Section: Confirm Connection and Begin Syncing

Once authorization is complete, the HRIS connector will appear as Connected under Settings → Connectors in hq.sectionai.com. Section's backend will begin an initial sync of your employee directory, which typically completes within a few minutes depending on organization size.

Subsequent syncs run automatically on a daily schedule to keep department and employee data current.

Supported Providers

Finch supports 200+ HRIS and payroll providers. Commonly used providers include:

Workday
ADP Workforce Now / ADP Run
BambooHR
Namely
UKG (Kronos / Pro)
Paychex Flex
TriNet
Ceridian Dayforce
Personio
HiBob

For the full list of supported providers, see Finch's provider network. If you are not sure whether yours is supported, your Customer Success representative can confirm, and can recommend SCIM directory sync if it is a better fit.

HRIS via SSO (SAML claim)

If your organization already signs in to Section with SAML SSO, you can send department without any additional connector. Add a department attribute to the SAML assertion your identity provider sends, and Section records it each time a user signs in.

This is the lightest path to set up, and a good fit when you want department breakdowns quickly without SCIM or an HRIS connector. It updates only when a user signs in, so it is the least current of the three paths, and it carries department and employee name only. SCIM (real time) or a Finch connection (daily) keeps data more current once you are ready.

What Section configures

Section maps the incoming department claim automatically. Nothing is required from you here.

What you configure in your IdP

Send a SAML attribute named department whose value is the user's department.

Identity provider	Attribute name / value
Microsoft Entra ID	Attribute name `http://schemas.microsoft.com/identity/claims/department`, source `user.department`.
Okta	Attribute `department`, value `user.department` (a native Okta profile field; no custom setup).
Google Workspace	App attribute `department`, mapped from Directory Basic Information → Department.
Any other SAML IdP	A SAML assertion with an attribute named `department` whose value is the user's department.

If you have not set up SSO yet, complete the SSO Connection Guide first, then add the department claim to that connection using the table above.

What to expect

Department is captured when a user signs in, and appears in Section HQ reporting after the next data refresh.
Only users who sign in are captured. Employees who never sign in will not appear through this path.
A department set this way stays until the user next signs in with a new value. Departures are not detected automatically, which SCIM or an HRIS connector handles for you.
This path carries department and name only. For manager, role, or level breakdowns, use SCIM or a Finch HRIS connection.

FAQs

Should we use SCIM, Finch, or HRIS via SSO?

If you use Okta or Microsoft Entra ID for SSO, we recommend SCIM directory sync: it is real time, keeps your data out of a third-party vendor, and carries the widest set of reporting fields. Use Finch when SCIM is not an option, for example when your org data does not live in your identity provider. HRIS via SSO is the lightest to set up, but it is the least current (it updates only when a user signs in) and carries department and name only, so use it when you want department breakdowns quickly and plan to move to SCIM or Finch later. Your Customer Success representative can help you decide.

What does Section do with HRIS data?

HRIS data is used exclusively to enrich your Section Coach / AI Connector analytics. Employee records are matched to platform activity by work email address, enabling department-level breakdowns of AI tool adoption, usage frequency, and engagement trends. HRIS data is never used for any other purpose.

Does Section store our employee data?

Yes, Section stores a synchronized copy of the employee fields listed above in order to power analytics. Data is encrypted at rest, and access is restricted to your organization's data within the platform.

What happens if an employee leaves or changes departments?

Section Coach syncs with your HRIS on a daily schedule. When an employee is marked inactive or their department changes in your HRIS, that change will be reflected in Section Coach after the next sync.

Can I disconnect the HRIS integration?

Yes. To protect against accidental removal of org-wide analytics enrichment, HRIS disconnection is handled through your Customer Success representative rather than self-serve. Contact them and Section will stop syncing data. Historical enriched analytics already in the platform will remain until your account is offboarded.

What if my HRIS provider isn't listed in Finch Connect?

Contact your Section Customer Success representative. Finch regularly adds new providers, and Section can work with you on alternative approaches (including SCIM directory sync) if your provider isn't currently supported.

Why is my connection showing a "Needs Reconnection" status?

HRIS connections can occasionally require reauthentication - for example, if your HRIS administrator credentials change or if your HRIS provider revokes the token. In hq.sectionai.com, navigate to Settings → Connectors, open the HRIS connector showing the error, and click Reconnect on the affected connection to re-authorize through Finch Connect. Your existing data and historical analytics will be preserved.

Can multiple HRIS providers be connected for the same organization?

Yes. Organizations that use more than one HRIS system (e.g., separate platforms for different business units) can connect multiple providers. Each provider goes through the same Finch Connect flow. Contact your Customer Success representative if you need assistance setting this up.