Identity and access management
BambooHR to Active Directory integration: accounts in your own domain from HR
With an integration between BambooHR and Active Directory, KoppelHet creates an account in the right OU for every new employee in BambooHR, with job title, department, manager and photo, and disables the account on the last working day. IT no longer retypes forms or Slack messages, and leavers do not stay active in the domain.
What the integration does
International organisations that use BambooHR for every country and still have Active Directory in the Netherlands create accounts by hand after an email from HR. The OU structure lags behind the organisation in BambooHR.
- IT installs a small KoppelHet program once on a server in the domain. That program sets up an outbound connection itself.
- HR creates the new employee in BambooHR. KoppelHet uses the location or division to decide which OU the account belongs in.
- The account is ready with logon name, email address, job title, department, manager and the photo from BambooHR. Through the existing synchronisation it also appears in Microsoft 365.
- On a transfer the account moves to the new OU and the groups change.
- On the termination date the account is disabled and moved to a separate OU for leavers.
What to watch for with BambooHR and Active Directory
- BambooHR returns the manager's employee number. KoppelHet looks up the account with that number in the domain and sets it as manager, so the organisation view in Outlook and Teams is right after synchronisation.
- BambooHR supplies photos in fixed sizes. KoppelHet takes a size that stays below the 100 kB limit for photos in Active Directory, so the HR photo appears in the address book without IT uploading it separately.
- Locations and divisions in BambooHR are often set up for head office, not for your OU structure. A lookup table decides the OU per location or division, and a location missing from the table triggers a warning instead of an account in a random place.
- Logon names in Active Directory may not exceed 20 characters. For long Dutch names with prefixes KoppelHet shortens the name according to a fixed rule and adds a sequence number if the name already exists.
- A termination can be entered weeks ahead in BambooHR. KoppelHet sets the end date as the account's expiry date straight away, so it also stops on that date if the program in the domain is not running that day.
- The notifications from BambooHR go to KoppelHet's platform, not to your network. The program in the domain collects the instructions, so no port needs to be opened in the firewall.
- BambooHR holds employees from all countries. Only employees at locations that belong to this domain get an account; a colleague moving to another location is treated as a leaver in this domain.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does a port need to be opened in our firewall?
No. The KoppelHet program in your domain only makes an outbound connection.
What happens to accounts that already exist?
Before go-live we link existing accounts to employees in BambooHR by employee number or email address. Whatever we cannot link, IT reviews first.
Do the accounts also reach Microsoft 365?
Yes, through your existing synchronisation from Active Directory to Microsoft Entra ID. If you only use Entra ID, we connect BambooHR directly with Entra ID.
What about the GDPR?
You are the controller and KoppelHet is the processor, under a data processing agreement. The integration only reads the fields Active Directory needs.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- BambooHR is read through event-based webhooks (employee.created, employee.updated with monitor fields) with an HMAC signature, and the changed endpoint as a safety net. Fields include employeeNumber, preferredName, firstName, lastName, jobTitle, department, division, location, supervisorId (the manager's employee number, read only) and terminationDate. Photo through get-employee-photo (sizes from original to tiny, large is 340×340).
- A KoppelHet agent on a Windows server in the domain writes the AD attributes employeeID (at most 16 characters), sAMAccountName (at most 20 characters), userPrincipalName, mail, givenName, sn, displayName, title, department, physicalDeliveryOfficeName, manager, thumbnailPhoto (at most 102,400 bytes) and accountExpires, and moves accounts between OUs.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in BambooHR | Field in Active Directory | Notes |
|---|---|---|
employeeNumber | employeeID | Matching key; at most 16 characters in AD |
preferredName of firstName | givenName | |
lastName | sn en displayName | |
Naamgevingsregel | sAMAccountName | At most 20 characters, sequence number for duplicates |
Naamgevingsregel | userPrincipalName en mail | Goes back to workEmail in BambooHR |
jobTitle | title | |
department | department | |
location of division | OU en physicalDeliveryOfficeName | Through a lookup table |
supervisorId | manager | Distinguished name of the account with that employee number |
Foto (formaat large) | thumbnailPhoto | At most 100 kB |
terminationDate | accountExpires |
Related
Ashby → BambooHR
Ashby to BambooHR integration: hire, changed start date and employment status in BambooHR
BambooHR → 4PS Construct
BambooHR to 4PS Construct integration: employees from BambooHR in the 4PS company of their location
BambooHR → ADP iHCM
BambooHR to ADP iHCM integration: salary, bonuses and commissions to Dutch payroll
BambooHR → AFAS Profit
BambooHR to AFAS integration: contract and salary straight to payroll