BiAccounts in applications
AFAS to Bitwarden integration: members and groups from AFAS, revoked after the last working day
With an integration between AFAS Profit and Bitwarden, every employee from AFAS becomes a member of the Bitwarden organisation, in the groups of their organisational unit and function, and is revoked after the last working day of their last employment. The groups determine which shared collections someone can access, so a move in AFAS also changes access to passwords.
What the integration does
Organisations that use AFAS Profit for HR and keep shared credentials in Bitwarden add new colleagues by hand. Someone who changes team often stays in the old team's group and so keeps access to collections that no longer belong to their work.
- HR enters a new employee in AFAS, with unit, function and start date.
- On the start date KoppelHet invites the employee to Bitwarden, in the groups of their unit and function.
- After acceptance an administrator confirms the member, and their groups' collections become visible.
- On another unit or function in AFAS the member moves to the new groups on the effective date and loses the old ones.
- After the last working day the member is revoked. After the period you choose, KoppelHet removes the member from the organisation.
What to watch for with AFAS Profit and Bitwarden
- Organisational units in AFAS are hierarchical, for example a team under an office. KoppelHet puts an employee in the group of their own unit and in that of the office above it, so a collection for the whole office also applies to every team.
- Some collections belong to a function and not to a team, such as banking environments for the payroll department. HR maintains a table from AFAS function to extra Bitwarden group; a new function needs no change to the integration.
- On a move to another unit KoppelHet takes the member out of the old group on the effective date. The member stays in the organisation and keeps their own vault; only the old team's collections disappear.
- An employee can have several employments in AFAS. The member stays active while one is running, and is only revoked after the end date of the last one.
- Revoked members do not count as a licence in Bitwarden and cannot reach collections. KoppelHet revokes first and only removes after a period, so an end date entered too early can be undone without the employee having to be invited again.
- Only employee number, work email, unit and function go from AFAS to Bitwarden. KoppelHet reads with its own app connector without BSN, salary or home address, and the Bitwarden connection itself cannot reach the content of the vault.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
We have Entra ID. Is SCIM not better then?
If the groups in Entra ID already match teams and functions, Bitwarden's SCIM integration with Entra ID is the simplest route. This integration is for organisations where only AFAS knows the right unit and function.
Does the integration also create collections?
No. You set up collections and which group can access them in Bitwarden. The integration makes sure the right people are in the groups.
What if the work email is not in AFAS yet?
Then KoppelHet waits with the invitation until it is there, and alerts HR after the start date. We do not send an invitation to a private address.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- AFAS is read with a dedicated app connector with GetConnectors for employees, employments and organisational units (with parent unit), filtered on change date. Only the fields in the mapping.
- Bitwarden is written through the Bitwarden Public API (api.bitwarden.com or api.bitwarden.eu) with the organisation API key (grant_type client_credentials, scope api.organization; token 3600 seconds). Members and groups with externalId, revoke and restore through the member endpoints from release 2026.2, lists with continuationToken. Available to Teams and Enterprise organisations.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in AFAS Profit | Field in Bitwarden | Notes |
|---|---|---|
Medewerker (EmId) | externalId van het lid | |
E-mail werk | email | |
Organisatorische eenheid (code en omschrijving) | Groep: externalId en name | |
Functie | Extra groep via een tabel die HR beheert | |
Datum in dienst | Moment van uitnodigen | |
Einddatum laatste dienstverband | Lid intrekken | |
Einddatum plus termijn | Lid verwijderen |
Related
ADP Workforce Now → AFAS Profit
ADP Workforce Now to AFAS integration: Dutch employees from the US HR system in AFAS Profit
AFAS Profit → 4PS Construct
AFAS to 4PS Construct integration: payroll journal per employer in the right 4PS company
AFAS Profit → Adobe Creative Cloud
AFAS to Adobe Creative Cloud integration: users and product profiles from AFAS Profit
AFAS Profit → AG5
AFAS to AG5 integration: employees, employments and absence from AFAS Profit in the skills matrix