Accounts in applications
Entra ID to 4PS Construct integration: users and permissions per company, disabled on departure
With an integration between Microsoft Entra ID and 4PS Construct, a new colleague gets the permission sets in 4PS that match their job and operating company, and their 4PS user is disabled as soon as the Entra ID account is switched off. Because 4PS runs on Business Central, Business Central itself can already link permissions to Entra groups; KoppelHet comes in when permissions must be handled per company, per job or immediately on departure.
What the integration does
Organisations that use 4PS Construct in the cloud give project managers, work planners and site managers different rights per operating company. The application administrator assigns them by hand after an email from HR, and a project manager who has left can sometimes still approve purchase orders for weeks.
- IT creates the account in Entra ID, with job title and department, and assigns the Business Central licence.
- The user arrives in 4PS on first sign-in or through the administrator's user import.
- KoppelHet picks up the new user and assigns per operating company the permission sets that belong to the job.
- On a job change KoppelHet adjusts the permissions; old permissions are removed, new ones added.
- When the account is disabled in Entra ID, KoppelHet disables the 4PS user immediately. That user's postings are kept.
What to watch for with Microsoft Entra ID and 4PS Construct
- In the cloud version of 4PS a user only exists once it has been created in Microsoft 365 first. An integration cannot create a user in 4PS; the user arrives on first sign-in or through an import by an administrator. KoppelHet then handles the permissions.
- The import of new users from Microsoft 365 does not work for an integration that signs in as an application, because it needs SUPER permissions in all companies. KoppelHet therefore leaves creation to 4PS itself and starts as soon as the user exists in 4PS.
- Business Central can link an Entra security group to a security group with permission sets, and restrict those permissions per company. If you already work with groups per role, that is often enough. KoppelHet adds something when job title and operating company in Entra ID should drive permissions instead of groups that IT maintains by hand.
- A user who has signed in to 4PS can no longer be deleted, only disabled. That is intended, because postings and approvals stay linked to that name. KoppelHet disables and never deletes.
- Business Central only updates a user's state when an administrator refreshes users from Microsoft 365. A disabled Entra account can therefore still show as enabled in 4PS. KoppelHet sets the 4PS user to disabled as soon as Entra ID reports it.
- Default permissions per licence type only apply to new users. If the administrator changes them later, the permissions of existing users do not change. KoppelHet compares the assigned permissions with the role table every day and reports differences.
- If 4PS runs on-premises, Entra groups can only be used as security groups from certain Business Central versions and with a server setting. On older versions KoppelHet assigns permission sets directly per user.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Why not just the Business Central security groups?
They are often enough when IT maintains a group per role. Choose custom work when permissions differ per operating company and job, or when a leaver must stop approving in 4PS immediately.
Does the integration also create the employee for time registration?
Not in this integration. A 4PS user is not the same as an employee. Employees preferably come from the HR system; that can be added later as an extension.
Who assigns the Business Central licence?
That stays in Microsoft 365, done by IT or your partner. Without a licence the user cannot sign in and does not reach 4PS either.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Entra ID is read through Microsoft Graph (delta query on users and group membership; fields id, userPrincipalName, jobTitle, department, companyName, accountEnabled and employeeLeaveDateTime), with read permissions only.
- 4PS is written through the Business Central automation API (microsoft/automation/v2.0) - users (GET and PATCH only, on state and expiryDate), userPermissions (POST and DELETE with roleId and company) and securityGroups (GET). The getNewUsersFromOffice365 and getNewUsersFromOffice365Async actions do not work with service-to-service authentication.
- Entra groups as security groups on-premises from Business Central 25.11, 26.5 or 27.4, with EnableEntraGroupsOnPrem set to true.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Microsoft Entra ID | Field in 4PS Construct | Notes |
|---|---|---|
id (objectId) en userPrincipalName | userSecurityId en userName | Matched on the Entra account; 4PS creates the user itself |
jobTitle | Permission sets (roleId) | Through a role table per job |
companyName of groep per werkmaatschappij | Company bij de permission set | Permissions only apply in that company |
Groepslidmaatschap | Beveiligingsgroep in 4PS | If you link Entra groups to 4PS security groups |
accountEnabled | state (Enabled of Disabled) | |
employeeLeaveDateTime | expiryDate | Optional, as a safety net next to disabling |
Related
ADP GlobalView → Microsoft Entra ID
ADP GlobalView to Entra ID integration: accounts per country from international payroll
ADP iHCM → Microsoft Entra ID
ADP iHCM to Entra ID integration: accounts from ADP payroll, with the right licence in every European country
ADP Workforce Now → Microsoft Entra ID
ADP Workforce Now to Entra ID integration: Microsoft accounts from ADP, with the work address back in ADP
AFAS Profit → Microsoft Entra ID
Connect AFAS with Microsoft Entra ID