Skip to main content
HR Easy can act as a remote MCP server (Model Context Protocol), so an AI assistant such as Claude can answer questions like “how many vacation days do I have left?” or “which applications moved to interview this week?” against your installation — under your own permissions, with every call recorded. The connector is off by default per installation and, when on, only available to people who sign in with the company Microsoft account (Entra SSO). Magic-link sign-ins cannot connect an assistant.

​
What the assistant can read

Everything the assistant sees passes through the same role and permission checks as the web app, re-read on every call. Two scope families exist: Managers hold the HR scopes for their direct reports only. Some things never cross the connector, whatever the role: AHV numbers, bank details, withholding-tax data, dates of birth, private contact details, salary amounts and bands, AI fit scores, private recruiting notes, e-mail bodies and file names. Payslips are listed by period with a link to the portal; the document itself opens only in your browser session. Text a person typed — a leave reason, a cover letter, a note — is returned only when the assistant asks for it explicitly, capped and marked as data for you to read. The full tool list with schemas is in the MCP connector reference.

​
Connect Claude

  1. In the Claude desktop or web app open Settings → Connectors → Add custom connector and enter your installation’s connector URL: https://<your HR Easy host>/api/mcp.
  2. Click Connect. Your browser opens HR Easy, asks you to sign in with your company Microsoft account again, and shows a consent screen naming the assistant (by its web address) and the scopes it requests.
  3. Approve. Claude returns to the conversation; the connector is ready.
Ask Claude “who am I in HR Easy?” first — the whoami tool tells it which tools your connection may use.

​
Review and revoke

  • Portal → Connections lists your connected assistants with the date of their last call and a Revoke button. Revoking takes effect on the assistant’s next call.
  • The same page shows assistant accesses: which assistant read your record, when, and on whose behalf — your own connection or an HR colleague’s.
  • Connections expire on their own after 30 days without use (8 hours for privileged roles) and after 90 days at the latest. Leaving the company ends every connection.

​
For administrators

Settings → Connected assistants holds the installation policy:
  • whether assistants may register themselves (off by default), and which vendors are approved automatically (Claude by default);
  • a pause switch that refuses every assistant at once without deleting connections;
  • the daily allowance of person records one connection may read (default 1 000); a connection that reads 50 or more different people in a day is flagged in the audit log as an export;
  • every registered application and every connection, each with a revoke action.
Before switching the connector on, check the controller duties listed in the data-protection guide: a data-processing agreement with the assistant vendor, the entry in the processing register, and informing staff about the new processing.