Identity and access management
ADP Workforce Now to Active Directory integration: accounts in your own domain, with expiry date and rehire from ADP
With an integration between ADP Workforce Now and Active Directory, KoppelHet creates an account in the right OU for every new employee from ADP, with job title, department and manager. A departure in ADP sets the expiry date on the account, and on a rehire the employee gets their old account back.
What the integration does
Organisations with ADP Workforce Now as their HR and payroll system and their own Active Directory domain often have the help desk create accounts from an email from HR. Someone returning after a year gets a second account, and a leaver already entered in advance in ADP can log in until IT's last day and sometimes after.
- The organisation registers the integration in ADP, with read access to workers and notifications, and write access to the business email address.
- An agent in your own network opens an outbound connection to KoppelHet and only gets rights on the managed OUs.
- On a hire KoppelHet creates the account in the OU that belongs to the company or department in ADP; on a rehire KoppelHet first looks for the old account.
- A departure in ADP sets the expiry date on the account; after the last working day it moves to the OU for leavers.
- Every night KoppelHet compares all workers in ADP, including archived ones, with the domain.
Back: KoppelHet writes the email address that belongs to the account back as the business email address in ADP Workforce Now.
What to watch for with ADP Workforce Now and Active Directory
- ADP sends a separate notification when someone is rehired. KoppelHet then looks up the disabled account in the OU for leavers by ADP number and restores it, so the employee does not lose their old login name, folders and groups.
- With a departure dated in the future the position in ADP is already terminated, while the worker stays active. KoppelHet sets that date straight away as the expiry date on the account, so Active Directory closes the account itself, even if the nightly run fails once.
- A worker can have more than one position in ADP. KoppelHet uses the main position for OU, department and manager, and only disables the account when the last position ends.
- ADP also reports when someone goes on leave. If the organisation wants to disable accounts during long leave, KoppelHet does so on that notification and restores the account on return; by default we leave the account enabled.
- ADP only returns former workers if the integration asks for them with a dedicated header. KoppelHet does so in the nightly comparison, so a missed departure notification still leads to a disabled account.
- The business email address can be written in ADP through the API. As soon as the account and mailbox exist, KoppelHet puts the address in ADP, so payslips and ADP notifications go to the work address.
- A photo from ADP can be larger than the 100 kB Active Directory allows for thumbnailPhoto. KoppelHet reduces it first, and refreshes it when ADP reports a new photo was uploaded.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does a port need to be opened in the firewall?
No. The agent opens an outbound connection itself; ADP's notifications arrive at KoppelHet's platform, not at the server.
Do we also work with Entra ID?
Yes. If the domain is synchronised to Entra ID, the Microsoft account follows automatically. Without your own domain KoppelHet writes directly to Entra ID.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- ADP Workforce Now through the Worker Management API: GET /hr/v2/workers (50 per page, $top and $skip; $orderby and count with a filter not supported), Content-Type application/json;archived=true for archived workers. Notifications worker.hire, worker.rehire, worker.onLeave, worker.terminate, worker.workAssignment.modify and worker.photo.upload. Write-back with /events/hr/v1/worker.business-communication.email.add and .email.change.
- Active Directory is written by an agent in the customer's network with an outbound connection. Attributes employeeID, sAMAccountName (at most 20 characters), userPrincipalName, givenName, sn, displayName, title, department, manager, accountExpires and thumbnailPhoto (at most 100 kB). The service account only has rights on the managed OUs.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in ADP Workforce Now | Field in Active Directory | Notes |
|---|---|---|
associateOID | employeeID | Fixed key, also after rehire |
Preferred name en family name | givenName, sn, displayName | |
Achternaam en voornaam | sAMAccountName | At most 20 characters |
Job title | title | |
Department (homeOrganizationalUnits) | department en OU | |
reportsTo | manager | |
Termination date van de positie | accountExpires | |
Corporate contact photo | thumbnailPhoto | Reduced to at most 100 kB |
Related
ADP Workforce Now → 4PS Construct
ADP Workforce Now to 4PS Construct integration: employees with company, dimensions and statistics group in 4PS
ADP Workforce Now → AFAS Profit
ADP Workforce Now to AFAS integration: Dutch employees from the US HR system in AFAS Profit
ADP Workforce Now → AllSolutions
ADP Workforce Now to AllSolutions integration: employees with department, cost centre and manager in AllSolutions
DyADP Workforce Now → Dyflexis
ADP Workforce Now to Dyflexis integration: employees and contracts of the European sites in the schedule