Identity and access management
ADP iHCM to Active Directory integration: network accounts per country, with an expiry date for temporary contracts
With an integration between ADP iHCM and Active Directory, every new employee from ADP automatically gets a network account in the OU for their country and department, with job title, manager and employee number. For a temporary contract the expected end date is set as the account's expiry date straight away, and a rehire gets their old account back.
What the integration does
Organisations that use ADP iHCM for personnel and payroll and Active Directory in their own network for workstations often only hear after the first working day that someone has started. Accounts of temporary staff stay active after the contract ends, because nobody sets the end date in Active Directory.
- IT installs the KoppelHet agent on a server in the domain, and the organisation grants KoppelHet read access in ADP to workers and notifications.
- ADP reports a new employee. KoppelHet fetches the worker and determines the OU from country and department.
- The account is created with employee number, job title and manager. If the contract is temporary, the account gets the expected end date as its expiry date.
- A new job or transfer in ADP updates the account and moves it to another OU if needed.
- After the last working day KoppelHet disables the account and moves it to the OU for leavers.
What to watch for with ADP iHCM and Active Directory
- Besides the leaving date ADP holds an expected leaving date, and indicates per work assignment whether the contract is permanent or temporary. For a temporary contract KoppelHet sets the expected date as the expiry date in Active Directory at creation, so a seasonal worker cannot keep signing in after the season.
- ADP's hire notification also arrives on a rehire. KoppelHet then first searches by employee number for the disabled account in the leavers OU and restores it, so the employee keeps their old username and folders.
- In iHCM employees from several countries sit in one environment. KoppelHet uses the country of the workplace for the OU, so group policy, printers and language settings are right per country and a transfer to Germany moves the account.
- ADP also reports a changed work assignment when a job record is deleted or the hire date changes. KoppelHet then fetches the whole worker again and looks at the primary work assignment, instead of translating the notification itself.
- ADP has a separate initials field that only applies to Dutch employees. KoppelHet uses it to fill the initials field in Active Directory, and builds the username from the employee's own surname, not from the full name ADP also supplies.
- A photo from ADP can be larger than the 100 kB Active Directory allows for a photo. KoppelHet resizes it first, so it appears in the address list instead of the update failing.
- The agent in the domain makes its own outbound connection to the KoppelHet platform. ADP's notifications arrive at the platform, not at the server, so nothing needs opening in the firewall.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Do we need to open ports?
No. The agent collects its instructions from the KoppelHet platform itself.
What if the end date of a temporary contract moves?
The expiry date in Active Directory then moves along at the next notification or daily check.
Can we move to Entra ID later?
Yes. Only the target changes; key, naming and dates stay the same, and the country becomes the usage location for licences.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- ADP iHCM is read through the Worker Management API (GET /hr/v2/workers with $top at most 100 and $skip, and per worker on associateOID or workerID). Notifications worker.hire (also on rehire), worker.terminate and worker.workAssignment.modify. Fields include workerID/idValue, person/legalName/initial (NL only), workAssignments/workerTypeCode (Permanent/Temporary), workAssignments/expectedTerminationDate, workerDates/terminationDate, homeWorkLocation/address/countryCode and reportsTo. Photo through /hr/v2/workers/{aoid}/worker-images/photo.
- Active Directory is written by an agent in the customer's network with an outbound connection. Attributes employeeID, sAMAccountName (at most 20 characters), userPrincipalName, givenName, sn, initials, displayName, title, department, c, manager, accountExpires and thumbnailPhoto (at most 100 kB). The service account only has write rights on the managed OUs.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in ADP iHCM | Field in Active Directory | Notes |
|---|---|---|
Reference number (workerID) | employeeID | Key between ADP and AD |
Naamgevingsregel op First Name en Last Name | sAMAccountName | At most 20 characters |
Known As, Last Name, Initial | givenName, sn, initials en displayName | |
Job Title | title | |
Organisation Unit | department en OU | |
Location (landcode) | c en OU per land | |
Reports to | manager | |
Permanent/Temporary en verwachte Date of Leaving | accountExpires | |
Date of Leaving | Uitschakelen en verplaatsen |
Related
ADP iHCM → Coupa
ADP iHCM to Coupa integration: approved Coupa expenses as a variable pay field in ADP iHCM NL
DyADP iHCM → Dyflexis
ADP iHCM to Dyflexis integration: employees and contracts in scheduling, hours back to ADP
ADP iHCM → Microsoft Entra ID
ADP iHCM to Entra ID integration: accounts from ADP payroll, with the right licence in every European country
ADP iHCM → Google Workspace
ADP iHCM to Google Workspace integration: Google accounts from the ADP administration, with the address back in ADP