Accounts in applications
Entra ID to Magister integration: staff accounts in Magister through the SCIM API, blocked on departure
With an integration between Microsoft Entra ID and Magister, every new staff member IT creates in Entra ID automatically gets a staff account in Magister, with employee number, email address and the right organisational unit. A changed username in Entra ID is passed on to Magister, and a disabled account is blocked in Magister.
What the integration does
Secondary schools and boards that manage staff accounts in Entra ID often create new teachers in Magister by hand or through an old SOAP connection that Magister is phasing out. When the username changes in Entra ID, sign-in to Magister no longer matches, and accounts of staff who left keep access to pupil data.
- The school requests access to the SCIM API for KoppelHet from Magister, with only the rights the integration needs.
- IT creates the new staff member in Entra ID, with employee number and the group that matches their unit in Magister.
- KoppelHet creates a staff account in Magister, with name, email address, employee number and unit.
- When the username changes in Entra ID, KoppelHet updates it in Magister.
- When IT disables the account, KoppelHet blocks the Magister account.
What to watch for with Microsoft Entra ID and Magister
- Magister offers a SCIM API for identity management, which replaces the old SOAP connections being phased out. With the old connection an external system could not create a staff account; through SCIM it can, including the staff record if it does not exist yet.
- Name, email address, employee number, user type and unit can only be set at creation through the SCIM API. KoppelHet therefore checks beforehand that they are right in Entra ID, and reports a later change, for example a new surname, to the Magister administrator to apply by hand.
- The employee number links the account in Magister to the staff member. KoppelHet takes it from Entra ID, so a new teacher belongs to their own staff record in Magister straight away and no loose account without a staff member is created.
- Magister supports an external IAM system such as Entra ID updating the UPN directly, which the old connection could not do. When the UPN changes after a name change or a new domain, signing in with the Microsoft account keeps working.
- In the SCIM API active is the inverse of blocked, and an account can also get an expiry date. KoppelHet blocks on a disabled account and sets the leaving date from Entra ID as the expiry date, so access also stops if disabling happens later.
- A password cannot be supplied at creation through SCIM. KoppelHet therefore sets no password; staff sign in with their Microsoft account, which Magister supports as an external identity provider, also with several Entra ID environments.
- Consent per unit is only possible for read rights. As soon as the integration may write, consent applies to the whole Magister environment. A board with several schools in one environment therefore agrees up front which units KoppelHet manages.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
What happens to our old SOAP connection?
Magister is phasing out the SOAP web connections and replacing them with the SCIM API. This integration already uses the new SCIM API.
Can the HR system be the source instead?
Yes. Magister has its own HR integrations with AFAS and HR2day through Magister Join. Entra ID as the source fits when IT already creates accounts based on the hire.
Are pupils linked as well?
No. The SCIM API can only create staff accounts; pupils stay in Magister itself.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Magister is written through the SCIM API (SCIM v2.0): POST User for a staff account (staff only), PATCH User for userName, UPN, active/blocked, expiresOn and authenticationType, SEARCH and GET User to find existing accounts. Scopes iam.scim.user.read, iam.scim.user.manage, iam.scim.user.create and iam.scim.user.attributes.manage; not iam.scim.user.password.manage. Access through magister.nl/partners, a pilot with your own IdP through a ticket at Magister Service.
- Entra ID is read through Microsoft Graph with a delta query on users and group membership (userPrincipalName, givenName, surname, mail, employeeId, employeeLeaveDateTime, accountEnabled). The app registration only has read rights.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Microsoft Entra ID | Field in Magister | Notes |
|---|---|---|
userPrincipalName | userName en UPN | |
givenName en surname | name | At creation only |
mail | emails | One address, at creation only |
employeeId | employeeCode | Links account to staff member; at creation only |
Groep per afdeling | organizationalUnits | At creation only |
accountEnabled | active (omgekeerd: blocked) | |
employeeLeaveDateTime | expiresOn |
Related
ADP GlobalView → Microsoft Entra ID
ADP GlobalView to Entra ID integration: accounts per country from international payroll
ADP iHCM → Microsoft Entra ID
ADP iHCM to Entra ID integration: accounts from ADP payroll, with the right licence in every European country
ADP Workforce Now → Microsoft Entra ID
ADP Workforce Now to Entra ID integration: Microsoft accounts from ADP, with the work address back in ADP
AFAS Profit → Microsoft Entra ID
Connect AFAS with Microsoft Entra ID