Identity and access management
ADP GlobalView to Active Directory integration: domain accounts per country from outsourced payroll
With an integration between ADP GlobalView and Active Directory, a new employee in GlobalView automatically creates a domain account, in the OU of their country and entity, with job, department and manager. After the termination date in GlobalView, KoppelHet's program disables the account in Active Directory.
What the integration does
International organisations with a central Active Directory domain and their payroll per country at ADP GlobalView receive account requests differently per country. A departure in one country reaches IT quickly, in another only after the payroll run, and leavers' accounts thus stay active unnoticed.
- IT installs KoppelHet's program on a server in the domain; ADP and the customer prepare read access to GlobalView.
- KoppelHet reads the workers and their assignment from GlobalView per country.
- For a new employee the program creates an account in the OU of country and entity, with a logon name according to the rule.
- A different organisational unit or job updates department and groups.
- After the termination date the program disables the account and moves it to the leavers OU.
What to watch for with ADP GlobalView and Active Directory
- A list of workers from GlobalView always applies to one country, indicated with a country code in the request. The program therefore builds the OU structure per country, with the legal entity below it, so group policy and printers can differ per country.
- A logon name in Active Directory may count at most 20 characters and must be unique in the domain. Employees from countries with long or compound surnames, or with characters outside the Latin alphabet, get a logon name according to a fixed rule with transliteration and a sequence number.
- On a move to another entity or a rehire, the employee gets a new personnel number in GlobalView, and the old assignment disappears from the API. The program keeps the existing domain account and only updates number, entity and OU, so the employee keeps their files and rights.
- GlobalView returns at most a hundred workers per request. For large countries KoppelHet reads in pages and only compares once all pages are in, so an interrupted run does not lead to disabling employees who were on a later page.
- GlobalView records whether someone works full-time or part-time and whether the contract is fixed-term or permanent. The program turns that into group memberships, so temporary staff, for example, do not get access to folders meant only for permanent employees.
- GlobalView's organisational model follows SAP, with personnel area and organisational unit among others. The program fills the AD department field with the organisational unit and the company field with the legal entity, and leaves the other SAP units out of the domain.
- The manager is stored in GlobalView as the ADP ID of another worker, who may work in another country. KoppelHet therefore reads all countries first and only then sets the manager, so a manager from another country is also found in Active Directory.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Do any firewall ports need to be opened?
No. The program in the domain makes its own outbound connection to the KoppelHet platform.
Are all employees in GlobalView?
Only those in countries where ADP runs payroll. Employees in other countries, or externals, stay outside the integration at the start.
Can we also integrate with Entra ID?
Yes. If the domain is synchronised to Microsoft 365, the data comes along through that synchronisation. A direct integration with Entra ID is a separate integration.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- ADP GlobalView Worker API (read-only): GET /hr/v2/worker-demographics or /hr/v2/workers with header ADP-Context-ExpressionID country='XX', OData $top and $skip (at most 100 per request); fields include associateOID, payrollFileNumber, legalName, legalEntityID, homeOrganizationalUnits, assignmentCostCenters, jobTitle, reportsTo, workLevelCode, assignmentTermCode, hireDate and terminationDate. Registration in the Consumer Application Registry and a Communication User in GlobalView.
- A KoppelHet agent in the domain writes, through an outbound connection, employeeID, sAMAccountName (at most 20 characters), userPrincipalName (unique in the forest), mail, givenName, sn, displayName, title, department, company, c, manager, extensionAttributes for the ADP ID and cost centre, and userAccountControl; an OU per country and entity.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in ADP GlobalView | Field in Active Directory | Notes |
|---|---|---|
associateOID | Eigen attribuut als vaste sleutel | |
payrollFileNumber | employeeID | |
Naamgevingsregel | sAMAccountName | At most 20 characters, unique in the domain |
Naamgevingsregel met domein per land | userPrincipalName en mail | |
legalName.givenName en familyName1 | givenName, sn en displayName | |
assignedWorkLocations.address.countryCode | c en OU | |
legalEntityID | company en OU | |
homeOrganizationalUnits (type ORGEH) | department | |
assignmentCostCenters.costCenterID | Eigen attribuut kostenplaats | |
jobTitle | title | |
reportsTo.associateOID | manager | |
workLevelCode en assignmentTermCode | Groepen | |
terminationDate | userAccountControl (uitgeschakeld) |
Related
ADP GlobalView → Microsoft Entra ID
ADP GlobalView to Entra ID integration: accounts per country from international payroll
ADP GlobalView → Google Workspace
ADP GlobalView to Google Workspace integration: Google accounts per country from payroll
ADP GlobalView → Okta
ADP GlobalView to Okta integration: Okta users from all countries in GlobalView
ADP GlobalView → SailPoint
ADP GlobalView to SailPoint integration: identities from all GlobalView countries in SailPoint