An HR sync can mistakenly treat the same person as two employees when it identifies people by a name-based key and the incoming name is encoded differently from the existing one. In Sergey Shinder’s account, a feed change made José’s record stop matching; the sync disabled his existing account, then created a second one on a later run. The incident shows why identity matching should rely on a durable worker ID—and why a single missed match should not immediately trigger deactivation.
How the sync turned one person into a leaver and a new hire
Shinder describes an hourly integration that created, updated, or disabled directory accounts using HR data. After an HR vendor migrated its API platform, the incoming text representation changed. The old and new versions of José’s name looked the same on screen, but the integration compared raw strings as part of a key made from first name, last name, and date of birth. The resulting key no longer matched.
As an Amazon Associate I earn from qualifying purchases.
The sync interpreted the mismatch as evidence that José was no longer in HR and disabled his existing account. On a subsequent run, it found the HR record but no matching directory account, so it created a new one. Shinder reports that 23 employees with accented characters in their names were affected. That is the count in his account of this incident, not a measure of how often HR syncs fail generally.
Free tools Windows power users keep installed
One-click scans. No signup required.
“Two strings that look the same are not a promise that they are the same,” Shinder writes. In this case, a fragile identity key and immediate deactivation after one mismatch compounded each other. Normalizing text can help ensure consistent comparisons, but it does not make a key based on mutable personal attributes a durable way to identify a person.
#1 Best Overall
- Box of 100 Units
Why a name-based key is risky
Names and other personal attributes are useful for display and may help detect a record, but they can change or arrive in different forms. A composite of first name, last name, and date of birth remains dependent on those attributes matching exactly. Email has a similar weakness: it can change. The IT Canvass ServiceNow Workday integration guide puts the key-selection principle plainly: “Pick a matching key that does not change.” It recommends a stable worker identifier and describes an upsert keyed on employee_number.
Where the HR system provides a durable employee or worker ID, use it as the cross-system key. Match the existing directory record on that identifier, then update mutable fields such as name and email. The available identifiers and their meaning vary between HR systems, so confirm that the selected field is stable and consistently populated in your own integration.
Rank #2
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Controls that prevent a mismatch from becoming an outage
Normalize text at the boundary
Apply a consistent text-normalization policy to inbound values before comparison, storage, and logging. Shinder says normalization was part of the corrective design. Do not rely on visual inspection to establish that two strings compare equally: the test suite should include composed and decomposed accented names, apostrophes, and non-Latin characters. The point is consistent handling across the integration, not treating accented names as invalid.
Require confirmation before disabling an account
A missing match can indicate a real departure, but it can also result from incomplete or inconsistent source data. Shinder says the revised process waits for a second agreeing run before disabling an account. A confirmation run or review step gives the integration a chance to distinguish a persistent leaver from a transient mismatch before taking a destructive action.
Rank #3
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Universal Connectivity (USB-C, USB-A, & NFC): Designed for PCs, Macs, iPhones, and Android. For mobile use, simply unfold the key, align it with your phone’s NFC antenna, and hold for a few seconds to authenticate.
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC is supported only through mobile authentication, Not MacOS/windows.
Test the full employee lifecycle
A successful hire or profile update does not prove that identity matching works through termination and rehire. The IT Canvass guide recommends testing those transitions and checking that the original record is reused. Include a scenario that changes an employee attribute, terminates the worker, then rehires the same worker. Verify that the integration restores or updates the original account rather than creating a duplicate.
A practical validation checklist
- Confirm that the integration’s match key is a stable employee or worker ID, not a name, email, or composite of mutable personal attributes.
- Test name values with multiple Unicode representations, apostrophes, and non-Latin characters; verify the normalized values match as intended.
- Simulate a missing or inconsistent HR record and confirm that one failed match does not immediately disable the directory account.
- Exercise hire, update, termination, and rehire end to end; check that a rehired worker maps back to the original directory record.
- Check logs and duplicate detection so an unexpected mismatch can be investigated before it creates a second account.
Recovery in the reported incident
Shinder says the team restored existing accounts from the directory recycle bin, manually merged duplicates, and completed recovery by eleven. That was the recovery path available in the described environment; recycle-bin restoration and merge options depend on the directory and its retention settings. The more general safeguard is to prevent one uncertain identity match from triggering both account deactivation and a later duplicate creation.
Quick Recap
Best Value
- 𝟱𝟬 𝗣𝗔𝗖𝗞 𝗢𝗙 𝗖𝗔𝗥𝗗𝗔𝗖𝗖𝗘𝗦𝗦 𝗖𝗔𝗥𝗗𝗦: Format H10301, 125 kHz Prox card frequency, replaces 1326 & 1386 HID door access cards
- 𝗦𝗔𝗠𝗘 𝗗𝗔𝗬 𝗖𝗨𝗦𝗧𝗢𝗠 𝗘𝗡𝗖𝗢𝗗𝗘𝗗 𝗖𝗔𝗥𝗗𝗦: Card number range & Facility code
- 𝗖𝗔𝗥𝗗 𝗥𝗔𝗡𝗚𝗘 𝗡𝗨𝗠𝗕𝗘𝗥: Printed on each card
- 𝗣𝗥𝗜𝗡𝗧𝗔𝗕𝗟𝗘 𝗢𝗡 𝗕𝗢𝗧𝗛 𝗦𝗜𝗗𝗘𝗦 𝗪𝗜𝗧𝗛 𝗜𝗗 𝗖𝗔𝗥𝗗 𝗣𝗥𝗜𝗡𝗧𝗘𝗥: Fargo, Zebra, Evolis, Datacard & Magicard printers (NOT INKJET)
- 𝗙𝗜𝗥𝗦𝗧 𝗧𝗜𝗠𝗘 𝗕𝗨𝗬𝗘𝗥𝗦: 𝗢𝗡𝗘 𝗖𝗔𝗥𝗗 𝗪𝗜𝗟𝗟 𝗕𝗘 𝗦𝗘𝗡𝗧 𝗢𝗡 𝗗𝗔𝗬 𝗢𝗙 𝗢𝗥𝗗𝗘𝗥. After you verify it works with your system, we will send the rest of your order. Instructions included in box.
Rank #4
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Universal Connectivity (USB-C & NFC): The Thetis PRO-A features integrated USB Type C and NFC for a near-instant account unlock. Simply unfold the key and hold it to your smartphone’s NFC antenna to authenticate on the go.
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC is supported only through mobile authentication, Not MacOS/windows.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →
