Identity and access management
Darwinbox to Entra ID integration: Microsoft accounts from Darwinbox, with the address back in Darwinbox
With an integration between Darwinbox and Microsoft Entra ID, a new employee from Darwinbox automatically gets a Microsoft account with department, job title and manager, and the account is blocked after the approved last working day. KoppelHet also puts the new work email back in Darwinbox, so the employee can sign in to Darwinbox itself with their Microsoft account.
What the integration does
Organisations with Darwinbox as their HR platform and Microsoft 365 as their workspace often sign in to Darwinbox through Entra ID, but still create the Microsoft accounts by hand. The address in Darwinbox then differs from the Microsoft sign-in name, so single sign-on fails for new colleagues, and leavers stay active until IT hears about it.
- Darwinbox enables API access and sets up a dataset with the fields the integration may read.
- KoppelHet reads the employees changed since the previous run, plus new employees on their activation date.
- A new employee gets a Microsoft account; KoppelHet puts the work email back in Darwinbox.
- On an approved departure KoppelHet sets the leaving date in Entra ID and blocks the account after the last working day.
- A hire that is deleted in Darwinbox before the start is cleaned up by KoppelHet in Entra ID.
Back: The work email from Entra ID arrives in Darwinbox as the employee's email address.
What to watch for with Darwinbox and Microsoft Entra ID
- Microsoft describes single sign-on to Darwinbox, started from Darwinbox, and says the user must already exist in Darwinbox and be activated for it. KoppelHet therefore puts the new Microsoft address back in Darwinbox through the API, so signing in works on the first working day.
- The same Darwinbox call that sets the email address can also activate an employee who is still pending and give them a hire date. KoppelHet only uses the address; activating stays a decision for HR in Darwinbox.
- Darwinbox can fetch employees by their activation date. KoppelHet uses this to give a new colleague an account on the day of activation, even if the rest of their data has not changed.
- A departure in Darwinbox is approved, pending or revoked. Only an approved departure sets the leaving date in Entra ID, so Microsoft's offboarding workflows start on that date. If the departure is revoked, KoppelHet removes the date again.
- Darwinbox keeps the manager as history with a start and end date per period. KoppelHet takes the line that applies today, so a temporary manager from an old period does not remain as manager in Entra ID.
- Darwinbox keeps a list of deleted hires, with the date and reason of deletion. If a Microsoft account was already created for one, KoppelHet blocks it and reports it to IT, so no active account remains for someone who never started.
- Darwinbox is used by large organisations with many group companies. Only employees of the group companies that belong to this Microsoft environment get an account; KoppelHet skips colleagues from other entities.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
What does Darwinbox need to arrange on its side?
API access and a dataset with the fields for the integration. Darwinbox only enables that on request, so ask for it early in the project.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Darwinbox through the Employee Core APIs with basic auth plus api_key per endpoint, or OAuth 2.0: masterapi/employee with datasetKey and last_modified or date_of_activation, orgmasterapi/employeeManager (From, To), UpdateEmployeeDetails/separationDetails (separation_status Approved, Pending or Revoked), UpdateEmployeeDetails/getDeletedEmployees and write-back with UpdateEmployeeDetails/update (email_id, optionally activate and date_of_joining). API access only on request from Darwinbox.
- To Entra ID through Microsoft Graph (user, manager) or through API-driven inbound provisioning (/bulkUpload with SCIM; Entra ID P1 or higher; at most 40 calls per 5 seconds and 2,000 per day with P1/P2, up to 50 operations per call). employeeLeaveDateTime for the offboarding workflows.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Darwinbox | Field in Microsoft Entra ID | Notes |
|---|---|---|
employee_id | employeeId | Up to 16 characters in Entra ID |
first_name, last_name | givenName, surname | |
Naamgevingsregel | userPrincipalName en mail | |
designation | jobTitle | |
department | department | |
group company | companyName | |
Leidinggevende (manager-historie) | manager | |
date_of_joining | employeeHireDate | |
Goedgekeurde laatste werkdag (separation) | employeeLeaveDateTime en accountEnabled |
Related
Darwinbox → Active Directory
Darwinbox to Active Directory integration: domain accounts that follow Darwinbox, per office location
Darwinbox → ADP iHCM
Darwinbox to ADP iHCM integration: CTC changes, extra payments and approved separations to Dutch ADP payroll
Darwinbox → AFAS Profit
Darwinbox to AFAS integration: Dutch employees from Darwinbox in AFAS payroll
ASDarwinbox → Arbodienst (SIVI)
Darwinbox to the occupational health service via SIVI: approved sick leaves as absence reports