Identity and access management
Deel to Active Directory integration: domain accounts per type of worker
With an integration between Deel and Active Directory, KoppelHet creates a domain account for every new employee, EOR employee or contractor from Deel in the OU that belongs to that type of worker. The account gets the contract end date as its expiry date and is disabled on the last working day.
What the integration does
Organisations that hire specialists through Deel, often as contractors for a project, create their Active Directory accounts by hand. After the project those accounts often stay active.
- IT installs a small KoppelHet program once on a server in the domain.
- After a contract is signed in Deel, KoppelHet creates the account in the OU for employees, EOR employees or contractors, disabled until the start date.
- The contract end date becomes the account's expiry date. An extension in Deel moves that date along.
- When the job title, department or manager changes in Deel, the details and groups in the domain follow.
- On the last working day KoppelHet disables the account and moves it to the leavers OU.
What to watch for with Deel and Active Directory
- Deel has three types of workers, and in a domain they often do not belong together. KoppelHet puts employees, EOR employees and contractors each in their own OU, so the group policy you have set per OU is right.
- Contractors in Deel almost always have an end date. Active Directory can let an account expire by itself, so that end date goes straight onto the account. It then stops on time even if nobody reports the departure.
- If a contract in Deel is withdrawn before the start date, the account has never been used. KoppelHet deletes such an unused account instead of keeping it as a leaver.
- People through Deel come from many countries and have names with accents or other characters. Logon names in Active Directory may have at most 20 characters; KoppelHet converts accents to plain letters and shortens long names according to your rule.
- Deel gives the number of the direct manager for every person. KoppelHet looks up the account with that same number in the domain, even if the manager is a contractor.
- Deel sends notifications to KoppelHet's platform, not to your network. The program in the domain collects the instructions over an outbound connection, so nothing is opened in the firewall.
- The account belongs to the person in Deel, not to a contract. A contractor who later joins your BV as an employee therefore keeps the same account; only the OU and groups change.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Do all people from Deel need a domain account?
No. We agree per type of worker, country or entity who gets an account. A contractor who only works in their own environment can stay outside the domain.
Does a port need to be opened in our firewall?
No. The program in your domain only makes an outbound connection to KoppelHet's platform.
Does this also work without Active Directory, with Microsoft 365 only?
Yes, we build that integration too.
What can be traced afterwards for an audit?
Every action of the integration is recorded in the audit logging of the KoppelHet platform. KoppelHet works with an ISO 27001 certified management system.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Deel is read through the HRIS People API (worker_id, preferred_first_name, last_name, job_title, department, hiring_type, direct_manager.worker_id, employments with client_legal_entity, termination_last_day and is_user_contract_deleted) and signed webhooks (x-deel-signature, HMAC-SHA256), with a daily full comparison.
- A KoppelHet agent on a Windows server in the domain writes employeeID (at most 16 characters), employeeType, sAMAccountName (at most 20 characters, without the forbidden characters), userPrincipalName, mail, givenName, sn, displayName, title, department, manager and accountExpires, and moves accounts between OUs.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Deel | Field in Active Directory | Notes |
|---|---|---|
worker_id | employeeID | At most 16 characters; per person |
preferred_first_name of first_name | givenName | |
last_name | sn en displayName | |
Naamgevingsregel | sAMAccountName | At most 20 characters, without accents |
Naamgevingsregel | userPrincipalName en mail | |
job_title | title | |
department.name | department | |
hiring_type en client_legal_entity | OU en employeeType | |
direct_manager.worker_id | manager | The account with that number in employeeID |
termination_last_day of einddatum contract | accountExpires |
Related
Ashby → Deel
Ashby to Deel integration: hires at the own entity as direct employee in Deel
Bullhorn → Deel
Bullhorn to Deel integration: first placement as a direct employee with a contract in Deel
Carerix → Deel
Carerix to Deel integration: successful placement as a person or contract in Deel
Deel → 4PS Construct
Deel to 4PS Construct integration: own employees of the construction entity in 4PS, with department and cost centre as dimensions