Identity and access management
AlexisHR to Active Directory integration: accounts in your own domain from Simployer One
With an integration between AlexisHR, now Simployer One, and Active Directory, every new employee in AlexisHR gets an account in your own domain, in the folder of their company and department and with the right manager. On leaving, the AD account expires on the end date from AlexisHR, even if that date is known weeks in advance.
What the integration does
Organisations that have AlexisHR as their HR system and still manage their accounts in their own Active Directory often still create new accounts by hand, based on an email from HR. Their users are synchronised from the domain to the cloud, so the change has to happen in the domain.
- In AlexisHR we point webhooks at the KoppelHet platform, with a secret key for signing.
- In the domain IT installs a small KoppelHet program that only connects outbound and collects the jobs.
- For a new employee the program creates the account in the folder of company and department, with the agreed logon name.
- On a change of job, department or manager the program updates the data and moves the account if needed.
- As soon as an end date is known, KoppelHet sets the expiry date; after the offboarding the account is disabled and moved to the leavers folder.
What to watch for with AlexisHR and Active Directory
- According to Microsoft, users synchronised from Active Directory cannot be managed in Entra ID. KoppelHet therefore writes in the domain itself, and synchronisation carries the change to the cloud.
- AlexisHR is developed in Scandinavia and names are stored in their own spelling, with letters such as ø, å and ä. KoppelHet keeps that spelling in the display name and uses a fixed conversion for logon name and UPN, so it stays within 20 characters and works in every system.
- An office in AlexisHR has its own time zone. KoppelHet uses the time zone of the employee's office to convert the end date to the UTC moment accountExpires expects, so a colleague in Stockholm or Amsterdam is not locked out an hour too early or too late.
- AlexisHR only sends employee.offboarded once the end date of the offboarding has been reached. KoppelHet does not wait for that. As soon as the end date is in AlexisHR, it sets the expiry date on the account, so it also expires if the program in the domain does not run that day.
- The manager is stored in AlexisHR as another employee id. Active Directory expects the distinguished name of an account. KoppelHet looks up the manager's account through their employee number in employeeID; if it is not there yet, the manager follows in the next round.
- Departments in AlexisHR have a parent department, and one account can hold several companies. KoppelHet uses that to build a folder per company with the departments beneath it, so group policy can differ per company or per department.
- If HR deletes a profile in AlexisHR, an employee.deleted notification arrives. KoppelHet then does not delete an AD account, but disables it and moves it to the leavers folder; deleting remains a deliberate step by IT.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does AlexisHR need to reach our network?
No. The notifications arrive on the KoppelHet platform, and the program in your domain collects the jobs there through an outbound connection.
Does the integration see salary or personal identity number?
KoppelHet only requests the fields needed for the account. The AlexisHR token does have rights on the whole account; keep it on the platform only.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- AlexisHR through the HRM One API (api.alexishr.com/v1, bearer token with owner rights): GET /employee (employeeNumber, firstName, lastName, workEmail, title, managerEmployeeId, departmentId, companyId, officeId, endDate, offboardDate), /department (parentId), /company and /office (timezone); nightly with filters[updated][$gte]. Signed webhooks employee.created, employee.updated, employee.onboarded, employee.offboarded and employee.deleted.
- A KoppelHet agent in the domain applies the changes through an outbound connection. AD attributes include employeeID, sAMAccountName (at most 20 characters, unique in the domain), userPrincipalName (unique in the forest), mail, givenName, sn, displayName, title, department, company, manager and accountExpires (100-nanosecond intervals since 1 January 1601 UTC).
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in AlexisHR | Field in Active Directory | Notes |
|---|---|---|
employeeNumber | employeeID | Key between both systems |
firstName, lastName | givenName, sn en displayName | |
Naamgevingsregel | sAMAccountName en userPrincipalName | Logon name at most 20 characters |
workEmail | mail | |
title | title | |
departmentId (naam en parentId via /department) | department en OU | |
companyId (naam via /company) | company en OU | |
managerEmployeeId | manager | Distinguished name of the manager |
endDate met timezone van het kantoor | accountExpires |
Related
AlexisHR → AFAS Profit
AlexisHR (Simployer One) to AFAS integration: the Dutch entity in AFAS Profit Payroll
AlexisHR → Microsoft Entra ID
AlexisHR to Entra ID integration: users with employee number and groups, blocked on leaving
AlexisHR → Google Workspace
AlexisHR to Google Workspace integration: a Google account that follows the employee, from onboarding to departure
AlexisHR → Loket
AlexisHR to Loket integration: employees of the Dutch company from AlexisHR into payroll