Identity and access management
BuddeeHR to Active Directory integration: domain account from employment and position in Buddee
With an integration between BuddeeHR and Active Directory, every new employee in Buddee gets a domain account with job, department, location and manager from their position in Buddee. After the end date of the employment in Buddee, KoppelHet's program disables the account in Active Directory, and the new work email goes back to Buddee.
What the integration does
Organisations with HR in Buddee and their own domain with Active Directory create accounts through a form or ticket. A transfer to another department or location is recorded in Buddee, but the old groups and the old address stay in the domain.
- IT places KoppelHet's program in the domain once, and HR creates a separate account for the integration in Buddee.
- KoppelHet reads employees, employments and positions from Buddee.
- For a new employee the program creates an account in the OU of their company, with a logon name according to the agreed rule.
- The work email goes back to Buddee; a new position updates department, location and groups on its start date.
- After the end date of the employment the account is disabled and moved to the leavers OU.
Back: Work email from Active Directory as business email in Buddee
What to watch for with BuddeeHR and Active Directory
- Job, department, location, cost centre and manager are stored in Buddee on a position with its own start and end date, separate from the employment. The program applies a transfer in the domain on the start date of the new position, so folders of the old department keep working until that day.
- Besides the employment date, Buddee has a separate first working day. KoppelHet prepares the account for the first working day and only enables it then, so a contract that starts earlier than the real start does not produce an account that sits unused and open for weeks.
- The business email address can be changed in Buddee through the API. After creating the account, KoppelHet writes the UPN from Active Directory back as work email, so the Buddee invitation and notifications go to the new business address.
- Buddee has employment types such as employee, intern, freelancer, agency worker, director-shareholder and volunteer. In the domain these become groups, so an agency worker or volunteer only reaches the folders and programs that belong to their role.
- An employee in Buddee also holds BSN, IBAN and emergency contact. The program in the domain only receives the fields the account needs, so that data does not end up in Active Directory or with domain administrators.
- Buddee returns at most 200 records per page and has a filter for active employees that are not archived. KoppelHet still also reads archived employees, because an archiving in Buddee would otherwise go unnoticed and the domain account would stay enabled.
- The integration signs in to Buddee with the email and password of a regular user. If that user also gets a domain account, its password policy could stop the integration; that is why the integration account falls outside the synchronisation.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Do any firewall ports need to be opened?
No. The program in the domain makes its own outbound connection to the KoppelHet platform.
Does this also work with Entra ID?
Yes. If the domain is synchronised to Microsoft 365, the data reaches Entra ID through that synchronisation. A direct integration with Entra ID is a separate integration.
What happens to the buddy and the HR manager from Buddee?
We do not include them. Only the direct manager of the position becomes manager in Active Directory.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Buddee is read through api.buddee.nl after Basic Auth on /auth/token (JWT access token and refresh token): GET /employees (company_id, number, first_name, composed_last_name, work_email, first_day_at_work_date, archived_at), /employments (type, start_date, end_date) and /positions (job_id, department_id, location_id, cost_center_id, manager_id with start_date and end_date); 200 per page. Writing back with PUT /employees/{id} (work_email).
- A KoppelHet agent in the domain writes, through an outbound connection, employeeID, sAMAccountName (at most 20 characters, unique in the domain), userPrincipalName, mail, givenName, sn, displayName, title, department, physicalDeliveryOfficeName, company, manager, an extensionAttribute for the cost centre and userAccountControl; an OU per company.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in BuddeeHR | Field in Active Directory | Notes |
|---|---|---|
company_id + number | employeeID | The number is only unique per company |
Naamgevingsregel | sAMAccountName | At most 20 characters |
Naamgevingsregel met domein | userPrincipalName en mail | |
first_name | givenName | |
composed_last_name_prefix + composed_last_name | sn en displayName | |
job_id van de actieve positie | title | |
department_id van de actieve positie | department en groepen | |
location_id | physicalDeliveryOfficeName | |
cost_center_id | Eigen attribuut kostenplaats | |
manager_id | manager | |
employment.type | Groepen per soort dienstverband | |
employment.end_date | userAccountControl (uitgeschakeld) | |
userPrincipalName | work_email | Return path to Buddee |
Related
BuddeeHR → AllSolutions
Buddee to AllSolutions integration: employees, positions and schedules from BuddeeHR in AllSolutions
ASBuddeeHR → Arbodienst (SIVI)
BuddeeHR to occupational health service via SIVI: verified sickness registrations from Buddee to the health service
BuddeeHR → Microsoft Entra ID
BuddeeHR to Entra ID integration: Microsoft 365 account from the employment in Buddee
BuddeeHR → Exact Online
BuddeeHR to Exact Online integration: cost centres, cost units and employees from Buddee consistent in Exact