Identity and access management
Darwinbox to Active Directory integration: domain accounts that follow Darwinbox, per office location
With an integration between Darwinbox and Active Directory, a new employee from Darwinbox automatically gets a domain account in the OU of their office location, with department, job title and manager. After the approved last working day the account expires by itself, and the work email from the domain goes back to Darwinbox.
What the integration does
Organisations that use Darwinbox as their HR platform and still manage their workstations in their own Active Directory domain have IT create accounts based on emails from HR. A move to another office or a different manager then never reaches the domain, and the address in Darwinbox lags behind.
- IT installs a KoppelHet program on a server in the domain, with rights on the integration's OUs.
- Darwinbox enables API access, with a dataset and a trigger that tracks changed fields.
- A new employee becomes a disabled account in the OU of their office location, which is enabled on the hire date.
- KoppelHet puts the account's work email back in Darwinbox.
- On an approved departure the account gets the last working day as its expiry date and then a place among the leavers.
Back: The work email of the domain account arrives in Darwinbox as the email address.
What to watch for with Darwinbox and Active Directory
- Darwinbox can return, per configured trigger, which field changed, with the old and the new value. KoppelHet uses that to act only on fields that matter for the domain, such as department, job title, office location and manager, and not on every change in an employee record.
- Darwinbox has a master table of office locations. KoppelHet maps each location to an OU, so group policy, printers and scripts are right per office. If a new location appears in Darwinbox without an OU, KoppelHet keeps the account in a holding OU and reports it to IT.
- Only when a departure is approved in Darwinbox does the domain account get the last working day as its expiry date. Active Directory then refuses sign-in itself on time, even if the program in the domain is not running that day. A revoked departure removes the expiry date again.
- A username in Active Directory may hold 20 characters at most, while names in Darwinbox can consist of several parts. KoppelHet builds the name following your rule from first name and last name, shortens it and adds a sequence number for a duplicate name.
- Only once Exchange or Microsoft 365 has confirmed the address does KoppelHet put the work email back in Darwinbox. Darwinbox has a dedicated call for it, so HR does not retype the address and mail from Darwinbox goes to the work mailbox.
- If HR deletes a hire in Darwinbox before the start date, it appears on the list of deleted employees. KoppelHet then removes the disabled account that was already prepared from the domain, so the username does not stay taken.
- Darwinbox runs in the cloud and cannot reach the domain. The KoppelHet program collects instructions itself over an outbound connection; nothing is opened in the firewall and the server needs no access to Darwinbox.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does anything need to be opened in the firewall?
No. The program in the domain makes an outbound connection to the KoppelHet platform itself.
What if we also use Entra ID?
Then Microsoft synchronises the domain account to Entra ID. KoppelHet only manages the account in Active Directory.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Darwinbox through the Employee Core APIs (basic auth plus api_key per endpoint, or OAuth 2.0): masterapi/employee with datasetKey and last_modified, UpdateEmployeeDetails/pushTriggerDataWithNoPushUrl (api_id, from, to; per change field, previous and latest), orgmasterapi/officelocationlist, separationDetails, getDeletedEmployees and UpdateEmployeeDetails/update for email_id.
- A KoppelHet agent on a Windows server in the domain with an outbound connection writes employeeID, sAMAccountName (at most 20 characters), userPrincipalName, givenName, sn, displayName, title, department, physicalDeliveryOfficeName, manager and accountExpires, and moves accounts between OUs.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Darwinbox | Field in Active Directory | Notes |
|---|---|---|
employee_id | employeeID | Up to 16 characters |
first_name, last_name | givenName, sn | |
Naamgevingsregel | sAMAccountName | 20 characters at most |
Naamgevingsregel | userPrincipalName en mail | |
designation | title | |
department | department | |
office location | physicalDeliveryOfficeName en OU | |
Leidinggevende | manager | |
Goedgekeurde laatste werkdag | accountExpires |
Related
Darwinbox → ADP iHCM
Darwinbox to ADP iHCM integration: CTC changes, extra payments and approved separations to Dutch ADP payroll
Darwinbox → AFAS Profit
Darwinbox to AFAS integration: Dutch employees from Darwinbox in AFAS payroll
ASDarwinbox → Arbodienst (SIVI)
Darwinbox to the occupational health service via SIVI: approved sick leaves as absence reports
Darwinbox → DATEV
Darwinbox to DATEV integration: German employees, pay and leavers from Darwinbox to the DATEV payroll program