Identity and access management

Connect AFAS with Microsoft Entra ID

Let employee data from AFAS flow into Microsoft Entra ID. New colleagues can receive accounts and access according to agreed rules, job changes are processed and access can be revoked when someone leaves. We define the precise setup together.

Discuss your integration How the integration works

Written by Marcel van Beek, founder and integration specialistLast updated: 28 September 2026

What the integration does

HR records new hires, job changes and departures in AFAS. IT creates the accounts in Entra ID by hand, based on an email or a service desk ticket. New colleagues lack access on day one, and leavers' accounts stay active.

HR enters the new employee in AFAS, with start date, job and department.
KoppelHet derives the email address and sign-in name from the agreed naming rules, including when someone with the same name already exists.
A few days before the first working day the account is ready in Entra ID, with manager and the groups that belong to the department and job.
The Microsoft 365 licence follows from the job. The manager receives a temporary password or one-time access pass for day one.
On a job change, details and groups are updated. On the end date the account is blocked and after an agreed period the licence is removed.

Out: Employee with name, employee number and email · Job and organisational unit · Manager · Groups based on department or job · Microsoft 365 licence

What to watch for with AFAS Profit and Microsoft Entra ID

KoppelHet reads only the data from AFAS that Entra ID needs. Salary and BSN are not included.
In AFAS an employee can have several employments. The main employment decides job and department in Entra ID; the account stays active as long as one employment is running.
Microsoft can only assign a licence when it knows which country someone works in. KoppelHet fills that in from the country of employment in AFAS.
If you run hybrid, with Active Directory in your own network, KoppelHet writes to Active Directory and Microsoft carries the account over to Entra ID.
In Entra ID the integration only gets the rights to manage users, group memberships and licences, and no full administrator role.
Before go-live KoppelHet sets AFAS against Entra ID. Accounts without an employee and employees without an account end up on a list that IT fixes first.

This integration is also part of joiner, mover, leaver.

How we build and run it

The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
Every sync and every error is visible in the functional log; on an error your administrator is notified.
A change that cannot go through is not half-applied but queued for another attempt.
KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
After go-live we manage the integration and adjust it when your process changes.
The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.

Implementation, architecture and compliance

Implementation and price

This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.

A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.

Price indication · Basic

Customer case

How it runs at DAEL Groep

How these organisations use the integration. The configuration differs for each customer.

DAEL Groep

Installation engineering

AFAS is the source for Active Directory and Entra ID. Accounts, email addresses and groups are created, updated and deactivated automatically based on HR changes.

“Thanks to KoppelHet's user comparison between the HR system and our AD, we quickly saw where AFAS and Microsoft differed.”
Wilvert Blaauwendraad, ICT manager

Read the customer story

Frequently asked questions

What happens to contractors who are not in AFAS?

They can be recorded in AFAS as external relations, or stay outside the integration. We agree up front which accounts the integration manages, so other accounts are left alone.

Is an account deleted when someone leaves?

No, blocked first. Deletion follows after a period you choose, so mailbox and files can still be handed over.

Can we change the naming rules ourselves?

Yes, in the KoppelHet platform. It also shows per employee which account was created and why.

How does this relate to Joinly?

Joinly is IAM software from the same makers with a fixed feature set. KoppelHet builds and manages the integration to fit, for example when your process differs or there are several sources.

Technical details for IT

For those who want to know how it works under the hood: APIs, fields and sources used.

AFAS is read through a dedicated GetConnector on employees and employments, filtered on change date, with only the fields Entra ID needs.
Entra ID is written through Microsoft Graph (user resource, assignLicense, manager relationship and group membership).
Graph permissions of the app registration include User.ReadWrite.All, GroupMember.ReadWrite.All and LicenseAssignment.ReadWrite.All; no Global Administrator.
Assigning a licence through assignLicense requires usageLocation to be set.
Blocking uses accountEnabled = false. The one-time access code is a Temporary Access Pass.
In a hybrid environment a KoppelHet agent writes to AD and Entra Connect syncs to Entra ID.

Which fields are transferred

The key fields. The full mapping is agreed per customer.

Field in AFAS Profit	Field in Microsoft Entra ID	Notes
`Medewerker (EmId)`	`employeeId`
`Roepnaam`	`givenName`
`Voorvoegsel + Achternaam`	`surname`	Include the name prefix as HR uses it
`Naamgevingsregel`	`userPrincipalName en mail`	For example firstname.lastname, with a sequence number for duplicates
`Functie (omschrijving)`	`jobTitle`
`Organisatorische eenheid`	`department`
`Leidinggevende`	`manager`	Through the manager's employee number; manager is a separate relationship on the user, not a plain attribute
`Datum in dienst`	`employeeHireDate`
`Land van het dienstverband`	`usageLocation`	Required to assign a licence
`Datum uit dienst`	`accountEnabled = false`

Sources