ACAccounts in applications
AFAS to Atlassian integration: employees from AFAS Profit as managed accounts in Jira and Confluence
With an integration between AFAS Profit and Atlassian Cloud, every new employee from AFAS gets a managed Atlassian account with job title, department and employer, and joins the groups that give access to Jira and Confluence. On the end date in AFAS the account is deactivated and access ends, while the employee's pages and issues remain.
What the integration does
Anyone who manages employees in AFAS and uses Jira and Confluence in Atlassian Cloud invites new colleagues by hand and puts them in groups. After a departure the Atlassian account often stays active until someone checks the licence list, and job title and department in the profiles go out of date.
- HR enters a new employee in AFAS, with job, department and work email.
- KoppelHet creates the account in your organisation's Atlassian directory, or links an existing account with the same work email.
- The employee joins the groups for their department and job. You have assigned the apps to those groups in Atlassian.
- When the job or department changes in AFAS, profile and groups follow.
- On the end date KoppelHet deactivates the account. Pages, issues and history remain.
What to watch for with AFAS Profit and Atlassian Cloud (Jira en Confluence)
- Atlassian only allows accounts to be created automatically from an external source with an Atlassian Guard Standard subscription. Without Guard KoppelHet cannot put managed accounts in your directory; we check that before the start.
- If an Atlassian account with the same work email already exists on a verified domain, Atlassian links it to the employee from AFAS. KoppelHet therefore first checks that the work emails in AFAS are right, so old accounts and their pages end up with the right person.
- A group created through this integration is read-only in Atlassian and cannot be renamed. When an organisational unit in AFAS gets a new name, KoppelHet creates a new group, moves the members and removes the old one. The unit code in the group name avoids this for small name changes.
- A group with the same name as an Atlassian default group appears to be accepted, but is not synced to the site. KoppelHet therefore gives groups from AFAS a fixed prefix, so a department that happens to have such a name does not silently drop out.
- A full update in Atlassian clears every field that is not sent. KoppelHet only changes the fields that come from AFAS, so a time zone or language the employee chose stays in place.
- Removing through the integration means deactivating in Atlassian; the account remains. That fits a departure in AFAS, because the leaver's Confluence pages and Jira issues stay readable and linked to them.
- The Atlassian profile has job title, department and organisation, but no manager. The manager from AFAS is therefore not passed on; if a team wants to work per manager, a group per manager is possible.
- Groups determine who has access in Atlassian. Because the groups come from the department or job in AFAS, only employees who need Jira or Confluence get a licence, not the whole organisation automatically.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
We already connect Entra ID to Atlassian. Do we need this?
Probably not. Let Entra ID stay the source for Atlassian and make AFAS fill the accounts and groups in Entra ID. That is one integration instead of two sources for the same accounts.
Can we still edit profiles ourselves in Atlassian?
No. According to Atlassian, accounts and groups from the integration are managed only from the source. You make changes in AFAS; permissions within Jira and Confluence remain yours to set.
What happens to external users and freelancers?
They stay outside the integration unless they are in AFAS. Their existing access does not change.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- AFAS is read with a dedicated GetConnector (employees with job, organisational unit, employer, work email and end date) under its own app connector, filtered on modification date. The classic token expires on 31 August 2027.
- Atlassian through the User provisioning REST API (SCIM 2.0) at https://api.atlassian.com/scim/directory/{directoryId}, with the directory API key as bearer token. Users: POST to create (409 if the user exists), PATCH for changes; PUT clears attributes that are not sent. DELETE deactivates, the same as setting active to false.
- Groups through the same API: an existing name returns 409, renaming is not supported, and default group names are not synced to the site. Limits according to Atlassian: 150,000 users per directory and 35,000 per group. employeeNumber through the enterprise extension (urn:ietf:params:scim:schemas:extension:enterprise:2.0:User).
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in AFAS Profit | Field in Atlassian Cloud (Jira en Confluence) | Notes |
|---|---|---|
E-mail werk | userName en emails | Also the link to an existing account |
Roepnaam | name.givenName | |
Voorvoegsel + Achternaam | name.familyName | |
Roepnaam + Voorvoegsel + Achternaam | displayName | |
Functie | title | |
Organisatorische eenheid | department | |
Werkgever | organization | |
Medewerkernummer | employeeNumber (enterprise-extensie) | |
Organisatorische eenheid of functie | Groepslidmaatschap (Groups) | Group name with a fixed prefix and the unit code |
Datum uit dienst | active = false |
Related
ADP Workforce Now → AFAS Profit
ADP Workforce Now to AFAS integration: Dutch employees from the US HR system in AFAS Profit
AFAS Profit → 4PS Construct
AFAS to 4PS Construct integration: payroll journal per employer in the right 4PS company
AFAS Profit → Adobe Creative Cloud
AFAS to Adobe Creative Cloud integration: users and product profiles from AFAS Profit
AFAS Profit → AG5
AFAS to AG5 integration: employees, employments and absence from AFAS Profit in the skills matrix