Accounts in applications
Entra ID to Slack integration: Slack accounts and user groups from Microsoft Entra ID, on rehire too
With an integration between Microsoft Entra ID and Slack, every colleague in the right Entra group automatically gets a Slack account with name, job title, department and manager, and the account is deactivated as soon as they leave the group or their account is disabled. KoppelHet also works for a Slack Enterprise organisation, switches returning former colleagues back on, makes external people guests with an end date and puts the start date in the Slack profile.
What the integration does
Organisations that manage all accounts in Entra ID and work in Slack run into the same things when accounts are created. A returning colleague gets no account because their old email address still belongs to a deactivated user, a new surname does not reach Slack by itself, and freelancers get a full account instead of a guest account with an end date.
- IT adds a new colleague to the Entra group for Slack and to their department group.
- KoppelHet first checks whether Slack already has a deactivated user with that email address or employee number, and reactivates that user instead of creating a new one.
- Otherwise KoppelHet creates the account with name, job title, department, manager and start date, and adds the colleague to their department's user group.
- External people become a guest with an end date, so their access stops by itself.
- When IT disables the account, KoppelHet deactivates the Slack user.
What to watch for with Microsoft Entra ID and Slack
- Slack cannot delete a user, only deactivate them, and refuses a new account with an email address that already belongs to a deactivated user. When a former colleague returns, KoppelHet looks up the old Slack user and switches it back on, with their earlier messages and channels.
- A new surname in Entra ID belongs in the Slack display name too, which colleagues see in every channel. KoppelHet updates the display name on every name change.
- For a Slack Enterprise organisation the token must come from the organisation itself, not from one workspace, and groups become IDP groups. KoppelHet sets up the integration at organisation level.
- A Slack username is at most 21 characters and shares its namespace with channel names, so a colleague cannot get a username that is already a channel. KoppelHet makes the username from Entra ID short enough and picks an agreed variant on a clash.
- According to Slack, single-channel guests cannot be fully created through provisioning; multi-channel guests can, with an expiry date. KoppelHet makes external people from Entra ID a guest with the end date of their assignment.
- Slack has a profile field for the start date, so colleagues can see who has just started. Entra ID does have a hire date; KoppelHet puts it in the Slack profile.
- A mention such as @finance cannot be set through provisioning. The administrator creates the user group and the mention once in Slack; KoppelHet then keeps the membership in line with the department group in Entra ID.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does this work with Slack Pro?
No. Slack's SCIM API is only available on Business+ and Enterprise. On lower plans no integration can manage accounts automatically.
Why Entra ID as the source and not the HR system?
If IT already keeps the groups in Entra ID accurate, that is the shortest route. If start date and department must come straight from HR, the HR system can be the source; see Workday to Slack.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Entra ID is read through Microsoft Graph with a delta query on users and group membership, with an app registration with read-only permissions. Fields used include employeeId, employeeHireDate, displayName, jobTitle, department, manager, userType and accountEnabled.
- Slack is written through the Slack SCIM API (v2) with an OAuth token with the admin scope. DELETE /Users sets a user to deactivated; reactivation uses active = true. The start date goes through the schema urn:scim:schemas:extension:slack:profile:1.0, guests through urn:scim:schemas:extension:slack:guest:1.0 with type multi and expiration.
- Slack only allows matching on userName and email. Slack rate-limits the SCIM API with HTTP 429 and allows at most 50 custom profile fields.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Microsoft Entra ID | Field in Slack | Notes |
|---|---|---|
employeeId | enterprise.employeeNumber | Fixed key, also on rehire |
mailNickname (ingekort) | userName | At most 21 characters, unique and not equal to a channel name |
givenName en surname | name.givenName en name.familyName | |
displayName | displayName | On changes too, not only on creation |
mail | emails | |
jobTitle | title | |
department en companyName | enterprise.department en enterprise.organization | |
manager | enterprise.manager.managerId | Looked up as the manager's Slack ID |
employeeHireDate | profile.startDate | |
userType = Guest of externe groep | Gast met einddatum | |
accountEnabled | active |
Related
ADP GlobalView → Microsoft Entra ID
ADP GlobalView to Entra ID integration: accounts per country from international payroll
ADP iHCM → Microsoft Entra ID
ADP iHCM to Entra ID integration: accounts from ADP payroll, with the right licence in every European country
ADP Workforce Now → Microsoft Entra ID
ADP Workforce Now to Entra ID integration: Microsoft accounts from ADP, with the work address back in ADP
AFAS Profit → Microsoft Entra ID
Connect AFAS with Microsoft Entra ID