Identity and access management
Daywize to Active Directory integration: accounts from the HR file, including the sign-in to Daywize
With an integration between Daywize and Active Directory, a new employee in Daywize automatically gets an account in Active Directory, with job title, department, manager and the right groups. After the last working day in Daywize the account is disabled, and because Daywize itself can sign in through ADFS, the same account also controls access to Daywize.
What the integration does
Anyone using Daywize Cloud for HR files, leave and expense claims who lets staff sign in through ADFS with their Active Directory account often creates those accounts by hand after an email from HR. A leaver whom IT forgets to disable can then still get into Daywize.
- IT installs a small KoppelHet program once on a server in the domain; Daywize and the service partner give KoppelHet access to the Daywize data.
- HR enters a new employee in Daywize. KoppelHet uses entity, job and department to decide where the account goes and which groups belong to it.
- Before the first working day the account is ready, with employee number, job title, department and manager. The employee also signs in to Daywize with that account.
- On a new job or department in Daywize, KoppelHet updates the details and swaps the groups.
- After the last working day the account is disabled and set aside. IT gets an alert, so mailbox and files can be handed over.
What to watch for with Daywize and Active Directory
- Daywize can sign in through SAML on the organisation's ADFS server. The account in Active Directory is then also the key to Daywize. Disabling it after departure therefore closes the network, email and the employee's own HR file in Daywize in one go.
- After implementation Daywize is, according to the vendor, leading for almost all employee changes, and payroll follows through an export. KoppelHet therefore reads Daywize and not Nmbrs or Loket, so an account does not have to wait until the change has been processed in payroll.
- A new entity in Nmbrs or Loket arrives in Daywize with all its employees during the nightly sync. For Active Directory that looks like dozens of hires at once. For such a new entity KoppelHet first looks for existing accounts and presents the list to IT, instead of creating new accounts straight away.
- Daywize is often set up and supported by an accounting or HR service provider, and according to Daywize custom integrations are built by the customer or a partner. KoppelHet is that partner for the accounts. The service partner keeps the HR file, and the program in the organisation's network only carries out the account changes.
- Employee numbers in Daywize come along from payroll, where they are issued per entity. With two entities KoppelHet puts a code in front of the number on the account, so employee 45 of one entity does not take over the account of 45 from the other entity.
- Daywize also records company assets such as laptop and phone on the employee. On departure the alert to IT can include the list of items to be returned from Daywize. That can be added later as an extension.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Can a leaver still submit an expense claim in Daywize after their last day?
Not with their own account if Daywize signs in through ADFS, because that account is then disabled. Agree that expense claims are in before the last working day, or that HR enters them on the employee's behalf.
Does anything need to be opened in our firewall?
No. The KoppelHet program sets up an outbound connection to the platform itself. Daywize and Active Directory do not need to reach each other directly.
Does this still work if we later move to Entra ID?
Yes. The integration then writes directly to Entra ID, and Daywize signs in through Entra ID instead of ADFS if Daywize sets that up for you. The agreements on naming and groups stay in place.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Daywize is read through the APIs and web services Daywize provides for custom integrations. There is no public documentation for them; which interface and fields we use is agreed per customer with Daywize and the service partner. Daywize supports single sign-on through SAML 2.0 with authentication on the customer's ADFS server.
- A KoppelHet agent on a Windows server in the domain carries out the changes through an outbound connection. AD attributes include employeeID (at most 16 characters), sAMAccountName (at most 20 characters), userPrincipalName, mail, givenName, sn, displayName, title, department, company, manager and accountExpires; OU per entity or department.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Daywize | Field in Active Directory | Notes |
|---|---|---|
BV + personeelsnummer | employeeID | At most 16 characters; fixed matching key |
Roepnaam | givenName | |
Achternaam volgens naamgebruik | sn en displayName | |
Naamgevingsregel | sAMAccountName | At most 20 characters, with a sequence number for duplicates |
Naamgevingsregel | userPrincipalName en mail | Equal to the address Daywize uses to recognise the employee through ADFS |
Functie | title en groepen | |
Afdeling | department en OU | |
BV | company | |
Leidinggevende | manager | Distinguished name of the manager's account |
Datum uit dienst | accountExpires en uitschakelen |
Related
ADP GlobalView → Active Directory
ADP GlobalView to Active Directory integration: domain accounts per country from outsourced payroll
ADP iHCM → Active Directory
ADP iHCM to Active Directory integration: network accounts per country, with an expiry date for temporary contracts
ADP Workforce Now → Active Directory
ADP Workforce Now to Active Directory integration: accounts in your own domain, with expiry date and rehire from ADP
AlexisHR → Active Directory
AlexisHR to Active Directory integration: accounts in your own domain from Simployer One