Identity and access management
Connect AFAS to Google Workspace: Google accounts from HR
With an integration between AFAS Profit and Google Workspace, every new employee in AFAS automatically gets a Google account, in the right unit and groups and with the licence that belongs to the job. On departure the account is suspended, so mail and Drive files are kept until they have been handed over.
What the integration does
Organisations with HR in AFAS that work in Gmail, Drive and Meet create every Google account by hand in the Admin console and pick the organisational unit by feel. People who leave often remain in shared drives and groups.
- HR enters the new employee in AFAS with start date, job and department.
- KoppelHet derives the email address from the agreed naming rules, including when someone with the same name already exists.
- Before the first working day the Google account is ready in the right organisational unit, with an initial password that must be changed at first sign-in.
- The employee joins the Google groups for their department and job and gets the licence that belongs to the job.
- On the end date the account is suspended and removed from the groups. Deletion follows after a period you choose.
What to watch for with AFAS Profit and Google Workspace
- Google does not accept a new account without a password. KoppelHet sets a random initial password that must be changed at first sign-in, or leaves sign-in to single sign-on if you use it.
- When someone changes their name usage in AFAS, for example after marriage, KoppelHet updates the email address. Google keeps the old address as an alias, so mail to the old name still arrives.
- The department structure in AFAS is usually finer than you want in Google. We translate it into a few Google organisational units, because in Google those decide which apps and policies apply.
- A deleted Google account can only be restored for twenty days. That is why we suspend first and only delete once the data has been handed over.
- Google Workspace has no dedicated employee number field. KoppelHet stores the AFAS number as an external identifier, so the account stays tied to the same employee when a name changes.
- Google handles licences separately from accounts. The job in AFAS decides which Google Workspace edition an employee gets.
- In Google the integration only gets rights to users, groups and licences, and in AFAS only read access to the data Google needs.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Can Google groups be filled automatically?
Yes. Per department, job or location in AFAS we agree which groups someone belongs to. On a job change the integration updates the membership.
What happens to a leaver's Drive files?
The integration suspends the account, so the files remain. The administrator transfers them to a colleague in the Admin console before the account is deleted after the agreed period.
Does this also work for schools with Google Workspace for Education?
For staff yes, in the same way. Student accounts do not come from AFAS and are outside this integration.
We use both Microsoft 365 and Google. Is that possible?
Yes. The same AFAS data can go to Entra ID and Google Workspace. Per system we agree who gets which account and licence.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- AFAS is read through a dedicated GetConnector under its own app connector, filtered on change date.
- Google is written through the Admin SDK Directory API (users, groups) and the Enterprise License Manager API (product and SKU).
- Access through a service account with domain-wide delegation, limited to the scopes for users, groups and licences.
- New account with a random password and changePasswordAtNextLogin; on departure suspended = true.
- The AFAS number goes into externalIds with type organization; organisational unit through orgUnitPath.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in AFAS Profit | Field in Google Workspace | Notes |
|---|---|---|
Medewerker (EmId) | externalIds (type organization) | Google has no dedicated employee number field |
Roepnaam | name.givenName | |
Voorvoegsel + Achternaam | name.familyName | |
Naamgevingsregel | primaryEmail | |
Functie | organizations.title | |
Organisatorische eenheid | organizations.department | |
Kostenplaats | organizations.costCenter | |
Organisatorische eenheid of werkgever | orgUnitPath | Through a lookup table to a limited number of Google OUs |
Leidinggevende | relations (type manager) | |
Datum uit dienst | suspended = true |
Related
ADP Workforce Now → AFAS Profit
ADP Workforce Now to AFAS integration: Dutch employees from the US HR system in AFAS Profit
AFAS Profit → 4PS Construct
AFAS to 4PS Construct integration: payroll journal per employer in the right 4PS company
AFAS Profit → Adobe Creative Cloud
AFAS to Adobe Creative Cloud integration: users and product profiles from AFAS Profit
AFAS Profit → AG5
AFAS to AG5 integration: employees, employments and absence from AFAS Profit in the skills matrix