Identity and access management
BuddeeHR to Entra ID integration: Microsoft 365 account from the employment in Buddee
With an integration between BuddeeHR and Microsoft Entra ID, every new employee in Buddee automatically gets a Microsoft 365 account, with job, department, location and manager from Buddee. When the employment in Buddee ends, the account is blocked after the last working day, and the new work email goes back to Buddee so the employee can sign in there with Microsoft.
What the integration does
Employers with HR in Buddee and Microsoft 365 for mail and Teams create accounts based on an email from HR. Interns and temps sometimes get a full licence, and after a departure an account stays active for weeks because nobody told IT.
- HR creates the employee in Buddee with employment, start date and position.
- KoppelHet creates the account in Entra ID with the agreed naming rule, and sets job, department, location and manager.
- The type of employment decides groups and licence. An intern gets something different from a permanent employee.
- The new work email goes back to Buddee, so the Buddee invitation goes to the business address.
- After the end date of the employment, sign-in is blocked; the licence is removed after the agreed period.
Back: Work email as business email in Buddee
What to watch for with BuddeeHR and Microsoft Entra ID
- Buddee offers sign-in with Microsoft, but that only covers signing in to Buddee. It does not create an account in Entra ID. The integration reverses this, the account is created from Buddee, and the employee then signs in to Buddee with that same account.
- Buddee has six types of employment, including intern, freelancer, agency worker, director-shareholder and volunteer. They go along to Entra ID, so groups and licences can be set per type and a volunteer does not get a full Microsoft 365 licence.
- In Buddee an employee has an indirect manager, an HR manager and a buddy besides the manager. Only the direct manager becomes manager in Entra ID; we do not set the buddy as manager, even though the buddy is often the first contact at the start.
- Buddee stores job, department, location and manager as positions with a start and end date. A move to another department on the first of the month is applied in Entra ID on that date, not on the day HR enters it.
- Buddee builds the surname from the own name and the partner's name, according to the name composition the employee chooses. For the email address KoppelHet uses the own name, so an address does not change if someone later adjusts the name composition.
- The Buddee API works with a regular user account. If that is an employee's account, the integration blocks its own access when that person leaves. KoppelHet therefore uses a separate Buddee account that falls outside the integration to Entra ID.
- With several companies in one Buddee environment, employee numbers are only unique per company. KoppelHet puts the company in front of the number, and the company name goes into Entra ID, so dynamic groups per company are possible.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Is signing in to Buddee with Microsoft not enough?
No. That only covers how someone signs in to Buddee. The Microsoft account must already exist, and this integration takes care of that.
Do agency workers and volunteers also get an account?
You decide that per type of employment. Whoever is in Buddee can get an account with limited groups; whoever is not stays outside the integration.
Does this also work with on-premises Active Directory?
Yes, through a small program in your network. That can be added later as an extension; we start with Entra ID.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Buddee is read through the REST API at api.buddee.nl: employees, employments (type, start_date, end_date; filters active_or_future and future) and positions (job_id, department_id, location_id, manager_id, cost_center_id with start_date and end_date). Changes through filters such as gte: on updated_at; webhooks are not in the documentation.
- Authentication with Basic Auth (email and password of a Buddee user) on /auth/token, then a JWT access token as Bearer. The work email goes back through PUT /employees/{id} (work_email); the invitation through POST /employees/{id}/invite?type=business.
- Entra ID is written through Microsoft Graph. Fields include employeeId, givenName, surname, userPrincipalName, mail, mailNickname, jobTitle, department, officeLocation, manager, companyName, employeeType, employeeHireDate, usageLocation and accountEnabled.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in BuddeeHR | Field in Microsoft Entra ID | Notes |
|---|---|---|
company_id + number | employeeId | The employee number is only unique within one company |
first_name | givenName | |
composed_last_name_prefix + composed_last_name | surname | According to the name composition in Buddee |
Naamgevingsregel | userPrincipalName, mail en mailNickname | |
Functie (job_id) | jobTitle | |
Afdeling (department_id) | department | |
Locatie (location_id) | officeLocation | |
manager_id | manager | |
Bedrijf (company) | companyName | |
employment.type | employeeType | employee, intern, self-employed, agency_worker, dga or volunteer |
employment.start_date | employeeHireDate | |
employment.end_date | accountEnabled = false | |
userPrincipalName | work_email | Return path to Buddee |
Related
BuddeeHR → Active Directory
BuddeeHR to Active Directory integration: domain account from employment and position in Buddee
BuddeeHR → AllSolutions
Buddee to AllSolutions integration: employees, positions and schedules from BuddeeHR in AllSolutions
ASBuddeeHR → Arbodienst (SIVI)
BuddeeHR to occupational health service via SIVI: verified sickness registrations from Buddee to the health service
BuddeeHR → Exact Online
BuddeeHR to Exact Online integration: cost centres, cost units and employees from Buddee consistent in Exact