Identity and access management
Exact HR to Active Directory integration: accounts from payroll in Exact Online
With an integration between Exact HR and Active Directory, a new employee in payroll in Exact Online automatically creates an account in Active Directory, in the folder of their administration and with department, job and manager. After the end date of their employment in Exact the account is disabled.
What the integration does
Organisations that process payroll in Exact Online and have an Active Directory in their own network, often synchronised with Entra ID, handle accounts with forms between HR and IT. Payroll does process a different department or job in Exact, but Active Directory keeps the old state.
- IT installs KoppelHet's program once on a server in the domain, and payroll approves KoppelHet's app in Exact Online.
- KoppelHet reads the employees per administration and the organisation of their employment.
- For a new employee the program creates an account in the folder of their administration, with a username according to the naming rule.
- When the employee gets a different department or job, KoppelHet updates the account and groups on the start date.
- After the end date of the employment the account is disabled and moved to the leavers folder.
What to watch for with Exact HR and Active Directory
- Exact Online returns payroll data per administration, and every API request belongs to one administration. If the group has several, KoppelHet reads them one by one and the program puts each administration in its own folder in Active Directory.
- Department and job are stored in Exact with the organisation of the employment, with their own start date. KoppelHet only applies a change in Active Directory on that date, so group rights of the old department remain until the transfer.
- Jobs in Exact have a code next to the description. We link groups in Active Directory to the code, so a changed description in Exact does not make rights lapse.
- A department in Exact has its own cost centre. KoppelHet carries it over to a separate field in Active Directory, so printing or folders, for example, can be set up per cost centre.
- Exact records how someone's name is composed, for example with their partner's name. KoppelHet builds the display name in Active Directory according to that choice, while the username stays the same if the name changes later.
- Exact limits the number of API requests per minute and per day per administration. KoppelHet only requests the changed employees per run, so there is room left within that limit for other integrations with the same administration, such as accounting or expenses.
- Exact holds both the internal ID and the employee number of an employee. The program puts the employee number in Active Directory, but matches internally on the fixed ID, so renumbering in payroll does not create a second account.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Can the new work email go back to Exact?
Not through this integration: payroll data in Exact Online can only be read through the API. The address is in Active Directory and therefore in Microsoft 365.
Do any firewall ports need to be opened?
No. The program in your network makes its own outbound connection to the KoppelHet platform.
Does this also work with Exact Globe?
This page describes payroll in Exact Online. For Exact Globe or Synergy in your own network we look at what is possible case by case.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Exact Online is read through the REST API with OAuth 2.0 (an app in the Exact App Center), per division and only with GET. Endpoints /api/v1/{division}/sync/Payroll/Employees (Timestamp, ID, EmployeeHID, NameComposition, BusinessEmail, Manager), /payroll/EmploymentOrganizations (DepartmentCode, JobTitleCode, CostCenter, StartDate, EndDate), /payroll/Employments (StartDate, EndDate) and /hrm/Departments (Costcenter). API limits per minute and per day per administration.
- A KoppelHet agent in the domain applies the changes through an outbound connection. AD attributes include employeeID, sAMAccountName (at most 20 characters), userPrincipalName, mail, givenName, sn, displayName, title, department, company, manager, an extensionAttribute for the cost centre and userAccountControl; an OU per administration.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Exact HR | Field in Active Directory | Notes |
|---|---|---|
EmployeeHID (personeelsnummer) | employeeID | |
Naamgevingsregel | sAMAccountName | At most 20 characters |
FirstName en LastName volgens NameComposition | givenName, sn en displayName | |
BusinessEmail | mail | |
JobTitleCode en JobTitleDescription | title en groepen | |
DepartmentCode en DepartmentDescription | department | |
CostCenter van de afdeling | Eigen attribuut kostenplaats | |
Manager | manager | |
Administratie (division) | company en OU | |
EndDate van het dienstverband | userAccountControl (uitgeschakeld) |
Related
Exact HR → 4PS Construct
Exact HR to 4PS Construct integration: payroll costs from Exact Online payroll as a journal in 4PS, with cost centre and project as dimensions
Exact HR → AllSolutions
Exact HR to AllSolutions integration: payroll costs from Exact Online payroll as a journal posting in AllSolutions
ASExact HR → Arbodienst (SIVI)
Exact to occupational health service via SIVI: sick and recovery notifications from Exact Online payroll to the health service
Exact HR → Microsoft Entra ID
Exact HR to Entra ID integration: Microsoft accounts from payroll in Exact Online