OnGuard by Lenel•S2

Learn more about how Envoy integrates with OnGuard to help simplify your security operations.

Updated over a week ago

What is OnGuard?

OnGuard is a security platform that offers applications relevant to every major industry, tools for integration with any critical business application, and the most extensive device support available anywhere.


  1. The following licenses must be added to your OnGuard subscription (additional charges may be incurred):

    1. OnGuard Software Subscription Modules: SWG-XXX

    2. OnGuard part numbers: Visitors (badging) & Protect - IPC-021-ENVY01 (needs to be purchased through a VAR)

  2. The following IPs must be whitelisted for inbound and outbound communication:



  3. Validate your on-premise URL and port for your OnGuard instance. The port will need to be whitelisted along-side the IPs listed above.

  4. OnGuard directory login credentials with Admin permissions are required in order to complete this setup.

How does OnGuard work with Envoy?

Envoy will send a record of every visitor who signs in on your kiosk to OnGuard to create visitors and badges, and optionally creates and signs in visits. Visits in OnGuard are assigned a cardholder (employee) for each visit record.

You can configure Envoy to apply a certain Badge type for your Envoy visitor types. You can then use all of OnGuard’s features for your visitors, such as badge provisioning, security alerts, and more.


  • Add every Envoy visitor to OnGuard as a visit record

  • Pre-configure each Envoy visitor type with a specific OnGuard Badge type

  • Stop manually logging user data in the OnGuard system

  • Automatically provide employees with building access after they’ve been approved through Protect

Step 1: Setup your admin account in OnGuard

You’ll need to have admin permissions on your OnGuard account to manage visitors to complete this integration. Either become an administrator or ask your administrator for help before completing the next steps.

Step 2: Install the OnGuard App in the Envoy app store

  1. In your Envoy dashboard, navigate to Apps > All Apps > Access Control.

  2. Search for OnGuard and click Install.

  3. Authorize the permissions between Envoy and OnGuard.

  4. Whitelist our static IPs and

  5. Enter your on-prem IP and port, in the URL field and click Next Step.

  6. Input your OnGuard directory login credentials, choose a Directory and click Next Step.

Step 3: Continue on with the OnGuard setup by selecting your Visitors options

  1. Assign Envoy some or all Visitor types to predefined Badge Types in OnGuard. This allows certain Envoy visitor types to have pre-defined access to specific doors and or elevators once you assign the visitor a hard badge.

  2. Complete optional steps:

    1. Assign a default Badge Type for any Envoy visitor type not configured.

    2. Choose to issue badges to registered guests only.

    3. Choose to create and sign-in a Visit in OnGuard if the Envoy host email matches a Cardholder within OnGuard.

    4. Choose to sign-out the Visit record in OnGuard.

  3. Click Next Step to continue with the Protect setup steps.

Step 4: Continue on with the OnGuard setup by selecting your Workplace Options

Important Notes:

  • Envoy does not touch the Badge Status field within OnGuard to enable access. We set the Activate and Deactivate dates upon the employees sign in and sign out of Envoy.

  • Checking the "Share Badge Event Data with Envoy" box and selecting an auto check-in option is required if you want to enable auto check-in. (See step f below)

Registration & check-in for access

  1. The badge is disabled by default.

    1. It is activated once an employee registers and checks in to the workplace via the Envoy dashboard or Envoy mobile app.

  2. Auto check-in with badge swipe.

    1. The badge is always active. Swiping the badge signs the employee into the workplace.

Configuration for Employee check-in:

  1. If you already have OnGuard setup in Envoy, you can edit your existing settings under the Employee tab. Be sure to re-save the app set-up anytime you make changes.

  2. Fill out the following information and then click Complete Setup.

    1. Envoy Protect (optional) - Check to enable employee access only if they've been cleared via Envoy Protect.

    2. Always activate badge - If this box is checked, badges associated to the employee will have their status changed to 'ACTIVE' (rather than only having expiration date/time updated) once they've been cleared by Envoy Protect.

    3. Employee access duration- Only applicable when "Envoy Protect" is checked. The length of time cleared employees have access control before it expires. Note: This feature is not applied when access groups or access levels are selected in the following options.

    4. Maintain Access Group - The selected access group will be added during protect sign-in and removed during protect sign-out. To skip this option simply ensure no values are selected.

    5. Maintain Access Levels - The selected access levels will be added during protect sign-in and removed during protect sign-out. Note: This feature is not available when "Maintain Access Group" has selections.

    6. Share Badge Event Data with Envoy - Allows Envoy to see Badge event data from OnGuard access events. This is REQUIRED if you want to enable auto check-in. Use the image in the next section to help you decide which workplace option is best for your company.

DISCLAIMER: Cardholder's badges (employees) are not disabled by default, Envoy did not take on the liability to mass disable badge access initially. In order to do this on your own, you will need to set the activation window of all employees' badges to disable your cardholders' access. In cases where an employee has multiple badges, note that all badges belonging to that employee would be enabled.

Envoy + OnGuard use cases

Invites (registration)

Pre-invited guests through Envoy will get registered in OnGuard ahead of time using the arrival date and time. In order to learn more about how to create invites, we have an extensive guide here.


Real-time visitors who are not registered will typically be registered through the iPad Kiosk app. These visitors will become registered visits within OnGuard once they complete sign-in through Envoy. Alternatively, an admin can register visitors through our web Dashboard, with an extensive guide here.

How to set up access control via QR codes?

Note: Must input card range within Envoy configuration only.

How to configure within OnGuard

  1. Configure OnGuard System Settings:

    1. Open the System Administration application for OnGuard.

    2. Navigate to "Administration" -> "Cardholder Options".

    3. In the new panel, navigate to "Badge ID Allocation".

    4. In the "ID Allocation" tab, set the field "Generate Badge ID" to "Manual Entry".

  2. Ensure that any OnGuard badge types used in Envoy use "Use system settings for badge ID Allocation (Automatic)".

    1. Open the System Administration application for OnGuard.

    2. Navigate to "Administration" -> "Badge Types".

    3. In the new panel, select the target badge type. The right-side panel tab "Badge ID Allocation" should be configured so that the option "Use system settings for badge ID allocation (Manual Entry)" is selected.

How to configure within Envoy

  1. On the Visitors step, map your OnGuard badge types configured in the steps above.

  2. Input a minimum and maximum card range. Card creation happens from the Envoy system.

  3. Choose "advanced access" for pre-registered guests, and their allotted period that the QR code will work before the scheduled meeting time.

  4. Check the 1st box to enable QR codes via email format

  5. Optionally: Check the 2nd box to enable QR codes via paper badge.


OnGuard licenses:

  • OnGuard Software Subscription Modules (SWG-XXX)

OnGuard part numbers:

  • Visitors (badging) & Protect - IPC-021-ENVY01 needs to be purchased through a VAR

Ready to sign up?

Get started in minutes. No credit card is required. See plans and pricing →

Did this answer your question?