You connect 4PS Construct and ESIS to Microsoft Entra ID by letting the rights in the industry application follow from job and operating company or school in Entra ID, and by closing access as soon as the Entra account is disabled. A generic SCIM integration does not know the specific rules of these applications, such as permission sets per company in 4PS and an appointment with assigned duties per school in ESIS.
An industry application holds the work itself: postings and approvals in 4PS, pupil data in ESIS from Rovict. Who sees which company or school depends on job and location. That is more than switching an account on or off. Without an integration, an administrator assigns rights by hand, per company or per school. A disabled account may then still be active in the industry application, which is exactly where the sensitive data sits.
4PS Construct: rights per job and operating company
4PS Construct runs on Microsoft Dynamics 365 Business Central. Business Central can already link rights to Entra groups itself. If you work with groups per role and per company, that is often enough.
It changes when job and operating company have to determine the rights. KoppelHet then assigns the permission sets that belong to that combination from Entra ID, instead of groups that IT maintains by hand. Every day KoppelHet compares the assigned rights in 4PS with the role table and reports differences. A right someone was given by hand stands out that way.
Two points differ per installation:
- Cloud. In the cloud version of 4PS, a user only exists once created in Microsoft 365. KoppelHet leaves the creation to 4PS itself. The integration starts as soon as the user is in 4PS.
- On-premises. Entra groups can only be used as a security group from certain Business Central versions onwards. On older versions, KoppelHet assigns the permission sets per user.
The Business Central licence stays in Microsoft 365, assigned by IT or your partner. Without a licence, the user cannot sign in and does not get into 4PS either.
ESIS: an account at the right school
In ESIS, a user is linked to an employee, and that employee has an appointment and assigned duties at a school. The integration first creates the employee with appointment and assigned duties at the school that belongs to the group in Entra ID. Then it links the user.
If a teacher works at two schools, they are in two school groups in Entra ID. In ESIS they get assigned duties at both locations, with one user.
You agree two things in advance:
- The email address. ESIS passes employees on to applications such as Basispoort and the parent portal. The email address from Entra ID must therefore be correct before the employee enters ESIS.
- Supply teachers and interns. We agree which group in Entra ID brings them into ESIS.
Leaving: access closes straight away
When someone leaves, what counts is the day the account is disabled in Entra ID. Business Central only processes a disabled Entra account once an administrator updates the users. KoppelHet sets the 4PS user to disabled as soon as Entra ID reports it, and never deletes.
In ESIS, KoppelHet blocks the user at the same moment, as soon as the account is disabled in Entra ID. A later clean-up is then no longer needed to close access.
Entra ID or the HR system as the source
Entra ID as the source is practical if IT already keeps the accounts up to date and the groups per school or role are correct. If the HR system can be the source instead, for example AFAS or YouForce, appointment and job come directly from there. That can be added later as an extension. What is involved in HR as the source for accounts and rights is explained under HR as the source.
How KoppelHet builds this
KoppelHet builds the integration per organisation on its own platform, with Entra ID as the source and 4PS Construct or ESIS as the target. As an indication, allow two to four weeks to go-live.
See the combinations Entra ID and 4PS Construct and Entra ID and ESIS. Read more about industry applications in construction and education, see the whole pillar user management in applications, or read about identity and access management in education.