Identity and access management
Cezanne HR to Active Directory integration: domain accounts per employer and location
With an integration between Cezanne HR and Active Directory, a new employee from Cezanne HR gets a domain account in the OU of their location, with job title, department and employer, and the account expires at the end of the employment in Cezanne. KoppelHet reads Cezanne through the OData API and a small program in your domain carries out the changes.
What the integration does
Organisations that use Cezanne HR for several countries and have a local Windows domain only want the employees of the employers that belong to that domain. IT now creates accounts based on a notification, and transfers to another location or department are often left undone.
- We record which employers belong to the domain, and the OU per location and the groups per org unit.
- KoppelHet reads people with their primary employment, including people who have yet to start.
- The program in the domain creates the account before the start date, in the location's OU.
- A new location or org unit moves the account on the effective date.
- An end date on the employment becomes the account's expiry date.
What to watch for with Cezanne HR and Active Directory
- Every employment in Cezanne belongs to an employer through a company code. The domain often only serves the employers in one country; KoppelHet only includes people whose primary employment belongs to such an employer, and puts the employer in the company attribute.
- Cezanne can directly return the primary current employment per person. If someone has more than one, for example a secondment next to a permanent job, that primary employment determines the OU and the expiry date.
- Location, job and org unit are separate assignments in Cezanne with their own effective date. The program moves an account to the OU of the new location on that date, so the group policy of the old location applies until the last day.
- An employment without an end is stored in Cezanne with 31 December 2999 as its end date. KoppelHet then sets no expiry date, and only a real end date ends up as accountExpires on the account.
- Requesting all people also returns leavers and future joiners; the filter on active employees does not. KoppelHet therefore reads the whole list, so an account is ready before the start date and a former colleague who returns gets their earlier account back.
- Cezanne arranges API access through its own Customer Success contact, and the API follows the user's rights. The integration user only sees the employers of this domain, so data from other countries never passes the program in the domain.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does anything need to be opened in the firewall?
No. The program in the domain only makes an outbound connection to the KoppelHet platform.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Cezanne HR API v2 (OData, dataservice.svc, JSON) with OAuth 2.0. Tables People (filter ActiveEmployee), PeopleToEmploymentCurrentPrimary, Employments (CompanyCode, TerminationDate), JobDeployments, OrgUnitPositionDeployments and LocationDeployments. Webhooks with People PLUS+, otherwise hourly reads.
- A KoppelHet agent on a Windows server in the domain fetches instructions through an outbound connection and writes employeeID, sAMAccountName, userPrincipalName, givenName, sn, displayName, title, department, company and accountExpires, manages groups and moves accounts between OUs.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Cezanne HR | Field in Active Directory | Notes |
|---|---|---|
PersonCode | employeeID | At most 16 characters |
Naamgevingsregel | sAMAccountName en userPrincipalName | sAMAccountName at most 20 characters |
FirstName en FamilyName | givenName, sn en displayName | |
JobDeployments | title | |
OrgUnitPositionDeployments | department en groepen | |
LocationDeployments | OU | |
CompanyCode | company | |
TerminationDate | accountExpires | 2999-12-31 counts as empty |
Related
Cezanne HR → ADP iHCM
Cezanne HR to ADP iHCM integration: compensation, single payments and leavers to Dutch ADP payroll
Cezanne HR → AFAS Profit
Cezanne HR to AFAS integration: the Dutch employer from Cezanne in AFAS Profit Payroll
ASCezanne HR → Arbodienst (SIVI)
Cezanne HR to the occupational health service via SIVI: sickness absence events as absence reports
Cezanne HR → DATEV
Cezanne HR to DATEV integration: the German company from Cezanne HR to the tax adviser