Accounts in applications
Microsoft Entra ID to Zenya integration: users, positions and organisation units in Zenya from Entra ID
With an integration between Microsoft Entra ID and Zenya, every employee IT creates in Entra ID automatically gets a Zenya user, in the right user groups, and that user is set to inactive as soon as the account is disabled in Entra ID. KoppelHet sets up SCIM from Entra ID for this and also fills position, organisation units and manager in Zenya through the Zenya API.
What the integration does
Care and education organisations that manage accounts in Entra ID and keep protocols and reports in Zenya often only set up sign-in through SSO. Who must read which documents and who handles a team's reports is then maintained by hand in Zenya by application management, and that lags behind every reorganisation.
- Application management creates a provider with a permanent token under external user management in Zenya, and IT switches on provisioning to Zenya in Entra ID.
- Entra ID creates the users and groups assigned to Zenya through SCIM.
- KoppelHet reads department, job title and manager from Entra ID and looks up the matching position and organisation units in Zenya.
- KoppelHet updates the Zenya user with position, organisation units and manager.
- When IT disables the account, SCIM sets the user to inactive in Zenya; documents and reports in their name remain.
What to watch for with Microsoft Entra ID and Zenya
- Besides a text field for department, Zenya has organisation units with their own number, and Zenya reports incidents and risks on those. SCIM only fills the department text. KoppelHet translates the department from Entra ID into the Zenya organisation units, so a report reaches the right team.
- A position in Zenya is an object with its own ID, just like an organisation unit. A new job title from Entra ID therefore does not exist there yet. KoppelHet does not create positions on its own but lists them for application management, because read confirmations are often set up per position.
- Zenya has personal accounts and group accounts, for example for a ward computer. Entra ID only delivers people through SCIM. KoppelHet leaves group accounts in Zenya alone and excludes them from the daily check on users without an Entra account.
- Assignment to Zenya in Entra ID determines who gets a user. Anyone not assigned does not exist in Zenya. Organisations that want everyone in Zenya assign a dynamic group or use a scoping filter; IT sets that up in Entra ID, not in Zenya.
- The SCIM provider in Zenya uses a permanent token that is only visible once, with an optional IP address restriction. KoppelHet uses its own API key in Zenya for its addition, so a replaced SCIM token does not stop the addition and vice versa.
- SCIM fills the external_id in Zenya with the ID from Entra ID. KoppelHet looks up the Zenya user by that external_id and not by name or login, so a name change in Entra ID does not make the enrichment fail.
- Entra ID gives the manager as its own Entra object, Zenya wants the ID of a Zenya user in manager_id. KoppelHet first looks up the manager in Zenya by their external_id; if that user does not exist there yet, the manager follows in the next run.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
What happens to documents of someone who leaves?
The user becomes inactive, not deleted. Documents, reports and tasks in their name stay in Zenya and application management transfers them.
Does this work without SSO?
Yes, but Microsoft recommends SSO. With SSO the employee signs in with their Entra account and Zenya needs no password of its own.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- SCIM 2.0 from Entra ID (Tenant URL with /scim/, Secret Token is the permanent token from Zenya > Application management > External user management). User attributes active, displayName, emails[type eq "work"], preferredLanguage, userName, phoneNumbers[type eq "work"], externalId, title and the enterprise extensions department and manager; groups with displayName, members and externalID.
- Addition through the Zenya REST API v5 (token through POST /tokens with api_key and username). GET /users filtered on external_ids, PATCH /users/{user_id} with position_id, organization_unit_ids and manager_id; GET /positions and GET /organization_units for the IDs. account_type has personal and group. Entra ID is read through Microsoft Graph with a delta query (department, jobTitle, manager, accountEnabled), with read-only rights.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Microsoft Entra ID | Field in Zenya | Notes |
|---|---|---|
userPrincipalName | userName / login_code | |
displayName | displayName / name | |
mail | emails[type eq "work"] / email_address | |
objectId of employeeId | externalId / external_id | |
accountEnabled | active | |
jobTitle | title en position_id | position_id through KoppelHet; the position must exist in Zenya |
department | department en organization_unit_ids | organization_unit_ids through a KoppelHet lookup table |
manager | manager_id | Through KoppelHet, looked up by external_id |
Groepen toegewezen aan de app | user_groups met members |
Related
ADP GlobalView → Microsoft Entra ID
ADP GlobalView to Entra ID integration: accounts per country from international payroll
ADP iHCM → Microsoft Entra ID
ADP iHCM to Entra ID integration: accounts from ADP payroll, with the right licence in every European country
ADP Workforce Now → Microsoft Entra ID
ADP Workforce Now to Entra ID integration: Microsoft accounts from ADP, with the work address back in ADP
AFAS Profit → Microsoft Entra ID
Connect AFAS with Microsoft Entra ID