Identity and access management
Exact HR to Entra ID integration: Microsoft accounts from payroll in Exact Online
With an integration between Exact HR and Microsoft Entra ID, every new employee from payroll in Exact Online automatically gets a Microsoft account, with department, job, manager and licence. After the end date of the employment in Exact, sign-in is blocked.
What the integration does
Organisations that run payroll in Exact Online and work with Microsoft 365 only get a new colleague to IT when someone sends an email. A leaver is in Exact with an end date, but their Microsoft account stays active until someone remembers.
- A user with access to payroll approves KoppelHet's app in Exact Online once.
- KoppelHet reads the changed employees per administration with their employment, department and job.
- For a new employee a Microsoft account is ready before the start date, with manager and groups.
- Through a group the employee gets the licence that matches their contract type.
- After the end date of the employment KoppelHet blocks sign-in; deletion follows after the agreed period.
What to watch for with Exact HR and Microsoft Entra ID
- Payroll data in Exact Online can only be read through the API, not changed. That is enough for this integration, but a work email created in Microsoft cannot be written back to Exact by KoppelHet. Payroll then enters it themselves, or it stays in Entra ID only.
- Exact records the manager as a reference to another employee, who must be in the same administration. If a manager works for a different administration, Exact holds nothing. KoppelHet reports that, so IT sets the manager in Entra ID by hand.
- An employee in Exact has a business email, a private address and sometimes the address of their Exact user. KoppelHet only uses the business address, or the naming rule if it is empty, so a private address never ends up as a Microsoft sign-in name.
- Exact knows three contract types on the employment, including external. KoppelHet passes that on as the employee type in Entra ID, so an external worker gets a different licence and less access through a group than a permanent employee.
- Exact offers an overview of employee changes since a given moment, plus a list of deleted records. KoppelHet uses both, so an employee entered by mistake and deleted again also disappears from Entra ID before a licence is attached.
- After the retention period Exact can anonymise an employee. The name then changes in the API, but the person has not been renamed. KoppelHet recognises an anonymised employee and then leaves the account in Entra ID untouched.
- Exact Online stores payroll data per administration, and each administration has its own employee numbers. KoppelHet puts the administration code in front of the number and uses the administration as the company name in Entra ID, so email domain and licences can differ per administration.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does this also work with Exact Globe or Synergy?
This page is about payroll in Exact Online. For Exact Globe and Synergy, which often run in your own network, we look at the available route case by case.
Does the integration see salary and BSN?
KoppelHet only requests the fields Entra ID needs. We do not request salary, BSN or address.
What if the manager is in a different administration?
Exact then has no manager for that employee. The platform reports it, and IT sets the manager in Entra ID by hand.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Exact Online is read through the REST API with OAuth 2.0 (an app in the Exact App Center), per administration (division) and only with GET. Endpoints /api/v1/{division}/sync/Payroll/Employees (Timestamp), /payroll/Employments, /payroll/EmploymentOrganizations (Department, JobTitle, StartDate, EndDate), /payroll/ActiveEmployments (ContractType) and /sync/Deleted. Fields include EmployeeHID, FirstName, LastName, MiddleName, BusinessEmail, Manager and IsAnonymised; private fields are only returned for certain user roles. API limits per minute and per day per administration.
- Entra ID is written through Microsoft Graph (user) with employeeId (at most 16 characters), givenName, surname, displayName, userPrincipalName, mail, jobTitle, department, companyName, employeeType, manager, usageLocation, employeeHireDate, employeeLeaveDateTime (requires User-LifeCycleInfo) and accountEnabled.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Exact HR | Field in Microsoft Entra ID | Notes |
|---|---|---|
EmployeeHID (personeelsnummer) | employeeId | With administration code when there are several administrations |
FirstName of NickName | givenName | |
LastName met MiddleName | surname en displayName | |
BusinessEmail of naamgevingsregel | userPrincipalName en mail | |
JobTitleDescription | jobTitle | |
DepartmentDescription | department | |
Manager | manager | Through the manager's ID in the same administration |
ContractType | employeeType | 1 fixed-term, 2 permanent, 3 external |
StartDate van het dienstverband | employeeHireDate | |
EndDate van het dienstverband | employeeLeaveDateTime en accountEnabled |
Related
Exact HR → 4PS Construct
Exact HR to 4PS Construct integration: payroll costs from Exact Online payroll as a journal in 4PS, with cost centre and project as dimensions
Exact HR → Active Directory
Exact HR to Active Directory integration: accounts from payroll in Exact Online
Exact HR → AllSolutions
Exact HR to AllSolutions integration: payroll costs from Exact Online payroll as a journal posting in AllSolutions
ASExact HR → Arbodienst (SIVI)
Exact to occupational health service via SIVI: sick and recovery notifications from Exact Online payroll to the health service