Identity and access management
Deel to Entra ID integration: accounts for employees, EOR and contractors
With an integration between Deel and Microsoft Entra ID, everyone you hire through Deel, whether an own employee, EOR employee or contractor, gets a Microsoft account with the right country, the manager and suitable access. On the last working day in Deel sign-in is blocked, whichever country the colleague worked in.
What the integration does
Anyone who, next to their own Dutch entity, hires people in other countries through Deel, as EOR employees or contractors, and has everyone working in Microsoft 365 often only hears about a new colleague when they show up. Contractors whose contract has already ended keep access for months.
- HR or the manager sets up a new contract in Deel. As soon as the contract is signed, Deel reports the new person.
- KoppelHet creates the Microsoft account with name, country, department, manager and type of relationship, ready for the start date.
- Groups and licence follow from the country and the type of relationship. Contractors, for example, get no access to HR sites.
- When the job title, department or manager changes in Deel, the details in Entra ID follow.
- On the last working day from Deel KoppelHet blocks sign-in and removes the person from all groups.
What to watch for with Deel and Microsoft Entra ID
- Deel states in its own documentation that it does not send people to an identity provider such as Entra ID by itself; that requires a middle layer that reads Deel and updates the target. That middle layer is KoppelHet's integration.
- For payroll only own employees count, but everyone needs an account. The integration therefore includes EOR employees and contractors too and stores the type of relationship in Entra ID, so IT can use different access rules per group.
- When an EOR employee moves to your own BV, they get a new employment in Deel. KoppelHet links the account to the person and not to the contract, so the colleague keeps their account, mailbox and files.
- Deel returns the direct manager's work address for every person. KoppelHet uses it to find the manager's account in Entra ID, even if the manager works in another country or at another entity.
- Colleagues through Deel work in many countries, and Microsoft requires a country for every licence. The country of the employment in Deel is passed on, so a licence also works for a developer in Portugal or a sales manager in Brazil.
- Deel stops sending notifications to an address after ten failed attempts, after roughly a day. KoppelHet monitors this and also compares all active people in Deel with Entra ID every day, so a departure never depends on a single notification.
- Someone who has not started yet is listed in Deel as not started. KoppelHet does create the account in advance, but only enables it on the start date.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Do contractors get the same access as employees?
Only if you want them to. The type of relationship from Deel is stored in Entra ID, so groups and access rules can differ per type.
What happens when a contractor contract ends but is extended?
An extension in Deel moves the end date. KoppelHet only blocks on the latest end date Deel then holds.
Does the integration see salaries or bank details in Deel?
No. We only request access to the people and organisation data an account needs.
Does this also work with Active Directory in our own network?
Yes, we build that integration too.
What about the GDPR?
You are the controller and KoppelHet is the processor, under a data processing agreement. The integration only reads the fields Entra ID needs.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Deel is read through the HRIS People API (including worker_id, preferred_first_name, job_title, department, direct_manager.work_email, hiring_type, person_status ACTIVE, NOT_STARTED or INACTIVE, employments with client_legal_entity and termination_last_day) and the Deel SCIM API (GET /scim/Users). Changes arrive through webhooks such as Worker V2 Created, Updated and Deleted, signed with x-deel-signature (HMAC-SHA256).
- Deel retries a failed webhook after 1, 2, 4 up to 16 hours; after the tenth failed attempt the webhook is disabled. Notifications can arrive twice; KoppelHet processes them idempotently on event_id.
- Entra ID is written through Microsoft Graph (user) with employeeId (at most 16 characters), companyName, usageLocation (required for licences), employeeType, manager and accountEnabled.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Deel | Field in Microsoft Entra ID | Notes |
|---|---|---|
worker_id | employeeId | Per person, not per contract |
preferred_first_name of first_name | givenName en displayName | |
preferred_last_name of last_name | surname | |
Naamgevingsregel of work_email | userPrincipalName en mail | |
job_title | jobTitle | |
department.name | department | |
client_legal_entity.name | companyName | Own entity or Deel's EOR entity |
direct_manager.work_email | manager | |
Land van het dienstverband | usageLocation | Required for a licence |
hiring_type | employeeType | Employee, EOR or contractor |
termination_last_day | accountEnabled = false |
Related
Ashby → Deel
Ashby to Deel integration: hires at the own entity as direct employee in Deel
Bullhorn → Deel
Bullhorn to Deel integration: first placement as a direct employee with a contract in Deel
Carerix → Deel
Carerix to Deel integration: successful placement as a person or contract in Deel
Deel → 4PS Construct
Deel to 4PS Construct integration: own employees of the construction entity in 4PS, with department and cost centre as dimensions