Identity and access management
Cezanne HR to Entra ID integration: Microsoft account and SAML sign-in ready in one go
With an integration between Cezanne HR and Microsoft Entra ID, a new employee from Cezanne HR gets a Microsoft account with job title, department, location and company, and the account is blocked after the end of the employment in Cezanne. Cezanne only has an app in Entra ID for signing in through SAML, and Microsoft calls creating users for it manual work; KoppelHet creates the account and sets the SAML identifier in Cezanne through the API.
What the integration does
Organisations with Cezanne HR and Microsoft 365 often let employees sign in to Cezanne through Entra ID. IT then has to create the Microsoft account and add a SAML identifier per person in Cezanne, and with a new colleague that easily goes wrong once.
- HR records the person and the employment in Cezanne, with job, org unit and location.
- KoppelHet also reads people who have not joined yet and creates the Microsoft account before the start date.
- KoppelHet adds the SAML identifier with the new address in Cezanne, so signing in works on day one.
- Changes in job, org unit or location take effect on their effective date.
- After the end of the employment KoppelHet blocks the account.
What to watch for with Cezanne HR and Microsoft Entra ID
- Cezanne is in the Entra gallery for SAML sign-in only, with one instance per tenant. Microsoft writes that users for this app are created by hand in Cezanne, with a SAML identifier per person equal to the email address. KoppelHet fills that identifier through the API as soon as the Microsoft account exists.
- In the SAML settings Cezanne uses the email address as the user ID. The address KoppelHet creates as userPrincipalName and mail is therefore also the value Cezanne expects at sign-in.
- A request for all people in Cezanne also returns leavers and people who have yet to start; the filter on active employees leaves out the latter. KoppelHet therefore reads all people and looks at the start date, so a new colleague has an account a week in advance.
- Job, org unit and location are stored in Cezanne in separate tables with an effective date. KoppelHet changes jobTitle, department and officeLocation on that date, not at the moment HR enters a future change.
- An ongoing employment has 31 December 2999 as its end date in Cezanne. KoppelHet treats that date as empty, so no leave date far in the future ends up on the Microsoft account.
- Webhooks are only included in Cezanne's People PLUS+ package. With that package KoppelHet responds to the notification; without it KoppelHet reads the tables every hour and compares them with the previous state.
- The API sees exactly what the user behind the token may see in Cezanne. The integration user only gets rights on person, employment and SAML identifiers, not on salary or bank details.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Do we need People PLUS+?
No. Without webhooks the integration also works, with a run every hour.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Cezanne HR API v2 (OData, dataservice.svc, JSON) with OAuth 2.0; API access through Cezanne's Customer Success contact. Tables People (also leavers and future joiners; filter ActiveEmployee), PeopleToEmploymentCurrentPrimary, Employments (CompanyCode, TerminationDate), JobDeployments, OrgUnitPositionDeployments, LocationDeployments and SAMLIdentifiers. Webhooks with People PLUS+.
- To Entra ID through API-driven inbound provisioning (/bulkUpload with SCIM, requires Entra ID P1 or higher) or Microsoft Graph (user with employeeId, userPrincipalName, mail, jobTitle, department, officeLocation, companyName, usageLocation, employeeHireDate, employeeLeaveDateTime and accountEnabled).
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Cezanne HR | Field in Microsoft Entra ID | Notes |
|---|---|---|
PersonCode | employeeId | At most 16 characters |
FirstName en FamilyName | givenName, surname en displayName | |
Naamgevingsregel | userPrincipalName en mail | |
JobDeployments | jobTitle | |
OrgUnitPositionDeployments | department | |
LocationDeployments | officeLocation en usageLocation | |
CompanyCode (primaire employment) | companyName | |
TerminationDate | employeeLeaveDateTime en accountEnabled = false | |
userPrincipalName (Entra ID) | SAMLIdentifiers (Cezanne) |
Related
Cezanne HR → Active Directory
Cezanne HR to Active Directory integration: domain accounts per employer and location
Cezanne HR → ADP iHCM
Cezanne HR to ADP iHCM integration: compensation, single payments and leavers to Dutch ADP payroll
Cezanne HR → AFAS Profit
Cezanne HR to AFAS integration: the Dutch employer from Cezanne in AFAS Profit Payroll
ASCezanne HR → Arbodienst (SIVI)
Cezanne HR to the occupational health service via SIVI: sickness absence events as absence reports