BiAccounts in applications
Entra ID to Bitwarden integration: members and groups from Entra ID, access closed on disable
With an integration between Microsoft Entra ID and Bitwarden, users and groups from Entra ID become members and groups in the Bitwarden organisation, and someone loses access to shared collections as soon as their Entra ID account is disabled. Bitwarden itself provides a SCIM integration with Entra ID for this; KoppelHet comes in for nested groups, repairing existing members and linking groups to collections.
What the integration does
Organisations that keep passwords for client portals and other systems in Bitwarden collections per team have the IT administrator add members by hand. Someone who leaves is still in the Bitwarden organisation after their last day, with access to their team's collection.
- IT assigns the groups per team in Entra ID to the Bitwarden app.
- The members arrive staged in Bitwarden, with their groups. The group determines which collection someone can access.
- The new colleague receives an invitation, creates an account or signs in, and an administrator confirms them in the organisation.
- When someone leaves a group in Entra ID, they lose that group and its collection in Bitwarden, but remain a member.
- When IT disables the account in Entra ID, the member is revoked in Bitwarden. After permanent deletion in Entra ID the member is removed from the organisation.
What to watch for with Microsoft Entra ID and Bitwarden
- By default the Entra app links a member on the email address. If someone's email address changes, for example after a marriage, their Bitwarden account becomes detached according to Bitwarden and a second invitation is sent. Bitwarden recommends linking on the objectId from Entra ID.
- Members who existed before that setting have no objectId in Bitwarden yet. Bitwarden refers to the Public API for this. KoppelHet sets the objectId from Entra ID once on every existing member, based on the email address, and reports who cannot be matched.
- Disabling or soft-deleting in Entra ID revokes the member in Bitwarden. Only when Entra ID permanently deletes the user after thirty days is the member removed from the organisation. A mistake can therefore be undone in that period without a new invitation.
- Entra ID provisioning only includes direct members of an assigned group. If a team's group is built from subgroups, those people do not reach Bitwarden. KoppelHet reads the nested groups and puts the members in the Bitwarden group itself.
- A group renamed in Bitwarden reverts to its Entra ID name at the next run. You therefore change group names in Entra ID; collections and their permissions are managed in Bitwarden.
- Someone who leaves a group in Entra ID only loses that group in Bitwarden and remains a member of the organisation. An employee who switches team therefore keeps their own vault and gets the collection of their new group.
- A revoked member does not take up a licence seat in Bitwarden. Users who sign in with a trusted device instead of a master password are completely locked out when revoked.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Why not just Bitwarden's SCIM integration?
Often it is enough. Choose an addition if you already have an organisation with members that first need to be linked to Entra ID, or if your groups consist of subgroups.
Can the integration also handle the master password or the confirmation?
No. The new member accepts the invitation themselves and an administrator confirms them; that is how Bitwarden exchanges the keys needed for shared collections.
Can we use the EU region of Bitwarden?
Yes. The Public API exists for Bitwarden's US and EU cloud; KoppelHet uses the region your organisation is in.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Bitwarden SCIM for Entra ID - a non-gallery enterprise app with Bearer authentication, the SCIM URL as Tenant URL and the SCIM API key as Secret Token. Recommended mapping externalId to objectId (matching precedence 1) and userName to userPrincipalName or mail (precedence 2); groups with displayName, members and externalId to objectId. New members arrive staged by default; Bitwarden recommends leaving automatic invitations off for Entra.
- KoppelHet reads Entra ID through Microsoft Graph (users and transitive group members) and writes to the Bitwarden Public API (api.bitwarden.com or api.bitwarden.eu) with the organisation API key (client_credentials, scope api.organization, token 3600 seconds). The externalId of existing members through /public/members/{id}; revoke and restore through the member endpoints added to the Public API in release 2026.2.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Microsoft Entra ID | Field in Bitwarden | Notes |
|---|---|---|
id (objectId) | externalId | Match on the objectId, not on the email address |
mail of userPrincipalName | emails en userName | |
displayName | displayName | |
accountEnabled en soft delete | active (ingetrokken bij false) | |
Groep: displayName | Groep: displayName | |
Groep: id (objectId) | Groep: externalId | |
Groepsleden | Groep: members |
Related
ADP GlobalView → Microsoft Entra ID
ADP GlobalView to Entra ID integration: accounts per country from international payroll
ADP iHCM → Microsoft Entra ID
ADP iHCM to Entra ID integration: accounts from ADP payroll, with the right licence in every European country
ADP Workforce Now → Microsoft Entra ID
ADP Workforce Now to Entra ID integration: Microsoft accounts from ADP, with the work address back in ADP
AFAS Profit → Microsoft Entra ID
Connect AFAS with Microsoft Entra ID