Identity and access management
BambooHR to Entra ID integration: Microsoft accounts from HR, blocked on departure
With an integration between BambooHR and Microsoft Entra ID, every new employee in BambooHR gets a Microsoft account with job title, department, manager and licence, and sign-in is blocked on the leaving date. The work email address goes back to BambooHR, so HR and IT use the same address.
What the integration does
Organisations that use BambooHR for HR and Microsoft 365 for mail and Teams often hear informally that someone is starting and create the account by hand. BambooHR only holds the personal address, and leavers are sometimes only spotted on the licence invoice.
- HR creates the new employee in BambooHR, with location, department, job title and manager.
- BambooHR reports the new employee straight away. KoppelHet fetches the current data and creates the Microsoft account according to your naming rules.
- The new work address is written to BambooHR, so notifications and the invitation for the first day go to the work address.
- When the job title, department or manager changes, the details and groups in Entra ID follow.
- On the termination date KoppelHet blocks sign-in and removes the employee from the groups. The licence is removed after the period you choose.
What to watch for with BambooHR and Microsoft Entra ID
- Microsoft has its own HR integrations in Entra ID for Workday and SuccessFactors, but not for BambooHR. For other HR systems Microsoft points to delivery through an API. KoppelHet takes care of that delivery, without you maintaining scripts of your own.
- BambooHR returns the manager's email address with every employee. KoppelHet uses it to look up the manager's Microsoft account. If a new manager starts at the same time as their team, KoppelHet creates the manager's account first.
- BambooHR only sends a notification for a changed employee for fields that the notification monitors. KoppelHet therefore has job title, department, division, location, manager and employment status monitored; other changes, such as a new home address, stay out of Entra ID.
- BambooHR also has a notification for a deleted employee record. That is usually a record created by mistake, not a departure. KoppelHet then deletes no account, but puts it on a list for IT.
- The termination date is kept in BambooHR in the employment status history and can be entered in advance. KoppelHet blocks on that date, not at the moment HR records the departure.
- A Microsoft 365 licence requires a country on the user. BambooHR environments of international companies have locations in several countries; the location's country goes to Entra ID, and only employees at locations that belong to this Microsoft environment get an account.
- If a notification fails, BambooHR retries five more times, the last time after forty minutes. After that the daily check on changed employees picks it up.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
How quickly does a new BambooHR employee appear in Entra ID?
Shortly after BambooHR reports the change, usually on the day HR saves it. The account is then ready, even if the first working day is a few weeks away.
Does the integration see salaries in BambooHR?
No. The integration uses a BambooHR user without access to compensation. Only personal and job data goes to Entra ID.
Do contractors in BambooHR get an account too?
That is up to you. The employment status from BambooHR is stored in Entra ID, so IT can give contractors different groups and access rules than permanent staff.
Does this also work with Active Directory in our own network?
Yes, through a small program in your network.
What can be traced afterwards for an audit?
Every action of the integration is recorded in the audit logging of the KoppelHet platform. KoppelHet works with an ISO 27001 certified management system.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- BambooHR is read through event-based webhooks (employee.created, employee.updated with monitor fields, employee.deleted), signed with HMAC SHA-256 (X-BambooHR-Signature and X-BambooHR-Timestamp), and the changed employees endpoint on timestamp as a safety net. After a notification KoppelHet fetches the employee through get-employee.
- Fields include employeeNumber, firstName, preferredName, lastName, workEmail, jobTitle, department, division, location, supervisorEmail (read only), employmentStatus, hireDate and terminationDate (read only, set through the employmentStatus table). The work address goes back through update-employee (workEmail).
- Entra ID is written through Microsoft Graph (user) or through API-driven inbound provisioning (/bulkUpload with SCIM, at most 50 operations per call; requires Entra ID P1 or higher). Fields employeeId (at most 16 characters), companyName (at most 64 characters), usageLocation (required for licences), employeeType, employeeHireDate and accountEnabled = false on departure.
- The BambooHR API key belongs to a separate user with read access to personal and job data and write access to workEmail; no access to compensation.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in BambooHR | Field in Microsoft Entra ID | Notes |
|---|---|---|
employeeNumber (of het BambooHR-id) | employeeId | Fixed key; at most 16 characters in Entra ID |
preferredName of firstName | givenName en displayName | Preferred name when present |
lastName | surname | |
Naamgevingsregel | userPrincipalName en mail | Then goes back to workEmail in BambooHR |
jobTitle | jobTitle | |
department | department | |
division | companyName | At most 64 characters |
supervisorEmail | manager | Looked up as an existing account in Entra ID |
location (land) | usageLocation en officeLocation | |
employmentStatus | employeeType | For example Full-Time, Part-Time or Contractor |
hireDate | employeeHireDate |
Related
Ashby → BambooHR
Ashby to BambooHR integration: hire, changed start date and employment status in BambooHR
BambooHR → 4PS Construct
BambooHR to 4PS Construct integration: employees from BambooHR in the 4PS company of their location
BambooHR → Active Directory
BambooHR to Active Directory integration: accounts in your own domain from HR
BambooHR → ADP iHCM
BambooHR to ADP iHCM integration: salary, bonuses and commissions to Dutch payroll