Accounts in applications

Entra ID to ESIS integration: teachers set up in ESIS, access removed on departure

With an integration between Microsoft Entra ID and Rovict's ESIS, every new teacher or staff member of the school board automatically gets an ESIS account at the right school with the right role. When someone leaves, their ESIS access goes too, so pupil data is only visible to people who still work there.

Discuss your integration How the integration works

Written by Marcel van Beek, founder and integration specialistLast updated: 9 November 2026

What the integration does

School boards whose schools use ESIS create every new teacher twice, first as a staff member with an appointment at the school and then as a user with a role. On departure the account often remains, while ESIS holds pupil files and test results.

IT creates the new teacher in Entra ID and adds them to the group for their school and role.
KoppelHet picks up the new colleague and reads name, email address and groups.
The teacher then appears in ESIS as a staff member with a task at the right school.
A user with the role for the job, such as class teacher or internal support coordinator, is linked to that staff member in ESIS.
When IT disables the account or someone leaves the group, their ESIS access is withdrawn.

Out: Staff member with name and email address · Appointment and task assignment at a school · User linked to the staff member · Role, such as class teacher or internal support coordinator

What to watch for with Microsoft Entra ID and ESIS

In ESIS a staff member and a user are separate things. The staff member comes first, with an appointment and a task assignment at a site; only then can a user be linked to it. The integration does both steps in that order.
Without a task assignment at a site a staff member can only be found at board level, not at the school itself. KoppelHet therefore always sets a task assignment at the school that matches the group in Entra ID.
With the class teacher role a user in ESIS only sees the pupils of the groups they supervise. The school assigns groups in ESIS; the integration makes sure the role is right.
ESIS passes every staff member on to other applications such as Basispoort and the parent portal. The Entra ID email address must therefore be right before the staff member reaches ESIS, or sign-in to those applications fails.
Entra ID is the source here, not the HR system. That works well when IT creates accounts based on the hire; for supply teachers and trainees we agree which group brings them into ESIS.
In Entra ID the integration only needs to read users and groups, and writes nothing back there.
ESIS holds sensitive pupil data. On departure KoppelHet blocks the ESIS user as soon as the Entra ID account is disabled, not at a later clean-up.

This integration is also part of joiner, mover, leaver.

How we build and run it

The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
Every sync and every error is visible in the functional log; on an error your administrator is notified.
A change that cannot go through is not half-applied but queued for another attempt.
KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
After go-live we manage the integration and adjust it when your process changes.
The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.

Implementation, architecture and compliance

Implementation and price

This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.

A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.

Price indication · Basic

Customer case

How it runs at Spaarnesant

How these organisations use the integration. The configuration differs for each customer.

Spaarnesant

Education

Spaarnesant uses Entra ID as the source for ESIS. An active Entra ID account results in an ESIS user with single sign-on and access to the right schools; when the account is disabled, ESIS follows automatically.

Read the customer story

Frequently asked questions

Can the HR system be the source instead of Entra ID?

Yes. Appointment and job then come directly from, for example, AFAS or YouForce. Entra ID as the source is convenient when IT already keeps accounts accurate and the groups per school are right.

What if someone works at two schools?

The staff member is then in two school groups and gets a task assignment at both sites in ESIS, with one user.

Are classes linked as well?

No. Which teacher belongs to which class stays with the school in ESIS. The integration makes sure the teacher is there with the right role.

Does two-step verification in ESIS still work?

Yes. The integration creates the user; how they sign in, and whether two-step verification is mandatory, stays a board setting in ESIS.

Technical details for IT

For those who want to know how it works under the hood: APIs, fields and sources used.

Entra ID is read through Microsoft Graph, with a delta query on users and changes in group membership. The app registration only has read permissions on users and groups.
Graph fields used include givenName, surname, mail, userPrincipalName, employeeId and accountEnabled.
Rovict publishes no public API documentation for creating staff and users in ESIS; the connection on the ESIS side is agreed per board.

Which fields are transferred

The key fields. The full mapping is agreed per customer.

Field in Microsoft Entra ID	Field in ESIS	Notes
`givenName`	`Voornaam medewerker`
`surname`	`Achternaam medewerker`	Split off the name prefix where ESIS asks for it
`mail`	`E-mailadres medewerker`	Required for the integration; also used towards Basispoort
`userPrincipalName`	`Gebruikersnaam`
`Groep per school`	`Taakstelling op de vestiging`	Through a lookup from groups to ESIS sites
`Groep per functie`	`Rol van de gebruiker`	For example class teacher, internal support coordinator or head teacher
`employeeId`	`Vrij veld of personeelsnummer`	Fixed key to find the staff member again
`accountEnabled = false`	`Gebruiker geblokkeerd`

Sources