Identity and access management
ADP iHCM to Entra ID integration: accounts from ADP payroll, with the right licence in every European country
With an integration between ADP iHCM and Microsoft Entra ID, every new employee from ADP automatically gets a Microsoft account with job title, department, manager and the country they work in. A leaving date in ADP schedules the block in Entra ID for that day, and a changed leaving date moves the block along.
What the integration does
Organisations that record personnel and payroll in ADP iHCM and manage their Microsoft environment in Entra ID often create accounts from an export or a ticket. New colleagues in other countries then get a licence that is not available there, and leavers keep their account until the next export.
- The organisation grants KoppelHet read access in ADP to workers and to the notifications on changes.
- HR enters a new employee in iHCM. ADP reports the hire and KoppelHet fetches the full worker.
- KoppelHet creates the Microsoft account with job title, department, manager and the country of the workplace, so the right licence can be assigned.
- A job change or transfer in ADP updates job title, department and manager in Entra ID.
- On departure KoppelHet sets the leaving date on the account and blocks it after the last working day. If HR changes the date, the block follows.
What to watch for with ADP iHCM and Microsoft Entra ID
- Not every worker in iHCM has ADP's internal key, ADP itself says in the API guide. KoppelHet therefore uses the worker's reference number as the fixed number on the Microsoft account, so those workers can always be found again too.
- ADP sends the departure notification again when HR later changes the leaving date or reason; iHCM has no separate notification for only a changed date. KoppelHet processes every new departure notification, so an extended contract does not block an account that is still needed.
- In iHCM an employee can have both a manager ('Reports to') and a supervisor. Leave requests in ADP go to 'Reports to'; the supervisor is for recording only. KoppelHet therefore sets 'Reports to' as the manager in Entra ID, so Teams and approvals follow the same line as ADP.
- iHCM often serves several European countries at once. Microsoft wants a usage location per account before a licence can be assigned. KoppelHet fills it from the country of the workplace in ADP, so a new colleague in Germany or Belgium can get a licence on day one.
- ADP returns at most a hundred workers per request and cannot filter on work assignment. KoppelHet therefore fetches the population in parts and decides itself which departments or countries get an account in this Microsoft environment.
- ADP records per application in a registry which ADP data the integration may read. If the notifications for, for example, name changes are not enabled, KoppelHet's daily check still picks up that change.
- ADP holds a photo per employee in iHCM. KoppelHet sets it as the profile photo on the Microsoft account, so colleagues see the same photo in Teams and Outlook as in the personnel administration.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Can the new email address go back to ADP?
ADP's iHCM guide describes reading the work address and a notification when it changes, not writing it. Whether writing back is possible we work out with ADP per environment; otherwise HR copies the address.
Why does the ADP side often take longer?
ADP sets per application which APIs and fields the integration may use. Requesting and testing that takes lead time at ADP, separate from the build.
Does this also work with Active Directory in our own network?
Yes. KoppelHet then writes to Active Directory through an agent in your network, with the same rules for key, manager and leaving date.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- ADP iHCM is read through the Worker Management API: GET /hr/v2/workers with $top (at most 100) and $skip, and /hr/v2/workers/{associate-oid}, where the workerID idValue works when there is no associateOID. Notifications worker.hire, worker.terminate, worker.workAssignment.modify and worker.legalName.change. Canonical /hr/workerInformationManagement/workerManagement/workerProfileManagement/worker.read in the Consumer Application Registry (CAR). Photo through /hr/v2/workers/{aoid}/worker-images/photo.
- Fields include workerID/idValue, person/legalName (givenName, nickName, familyName1, initial), workAssignments (primaryIndicator, jobTitle, homeOrganizationalUnits, homeWorkLocation/address/countryCode, reportsTo with reportsToRelationshipCode, hireDate) and workerDates/terminationDate. According to ADP, filters on workAssignment are not supported.
- Entra ID is written through Microsoft Graph (user with employeeId, givenName, surname, displayName, userPrincipalName, jobTitle, department, usageLocation, manager, employeeHireDate, employeeLeaveDateTime with User-LifeCycleInfo.ReadWrite.All, and accountEnabled; profile photo through PUT photo/$value).
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in ADP iHCM | Field in Microsoft Entra ID | Notes |
|---|---|---|
Reference number (workerID) | employeeId | Key; also for workers without an associateOID |
Known As of First Name | givenName en displayName | |
Last Name | surname | |
Job Title van de primaire werktoewijzing | jobTitle | |
Organisation Unit | department | |
Location (landcode) | usageLocation | Needed for licences |
Reports to | manager | Not the supervisor |
Date of Join | employeeHireDate | |
Date of Leaving | employeeLeaveDateTime en accountEnabled | |
Foto | Profielfoto |
Related
ADP iHCM → Active Directory
ADP iHCM to Active Directory integration: network accounts per country, with an expiry date for temporary contracts
ADP iHCM → Coupa
ADP iHCM to Coupa integration: approved Coupa expenses as a variable pay field in ADP iHCM NL
DyADP iHCM → Dyflexis
ADP iHCM to Dyflexis integration: employees and contracts in scheduling, hours back to ADP
ADP iHCM → Google Workspace
ADP iHCM to Google Workspace integration: Google accounts from the ADP administration, with the address back in ADP